Merge remote-tracking branch 'origin/feat/container-details' into feat/l-for-details

# Conflicts:
#	internal/ui/app/app_test.go

README.md

@@ -60,12 +60,14 @@ lazysecrets         # start lazysecrets
 lazysecrets --demo  # test with demo data
 ```
 
-Pick a source on the left, then a vault, then a secret. The keys you'll
+Pick a source on the left, then a vault, then a secret. With nothing
+signed in yet, the right pane says how to get started. The keys you'll
 use most:
 
 | Key | Action |
 |---|---|
-| `j`/`k`, `h`/`l`, `enter`, `esc` | move, switch panes, drill in, back |
+| `j`/`k`, `enter`, `esc` | move, drill in, back |
+| `l` / `h` | the details of what's selected / back |
 | `/` | filter the list you're in |
 | `space` | reveal / hide the value |
 | `y` | copy the value (cleared from the clipboard after 30s) |

docs/azure.md

@@ -64,3 +64,9 @@ Secrets, keys and certificates, each on their own tab of the Secrets pane
 key (PEM public key) or certificate; private key material is never
 fetched. `v` lists an item's versions. Items expiring within
 `expiryWarningDays` (30 by default) are marked `⚠ 12d`, expired ones `✗`.
+
+On a vault, the right pane shows its settings: resource group, location,
+SKU, whether access is by Azure roles or access policies, soft delete and
+purge protection, which networks can reach it, private endpoints and tags.
+They come with the list of vaults, so they cost no extra requests and are
+cached with it.

docs/config.md

@@ -114,8 +114,9 @@ What lazysecrets has loaded is kept in
 you: the Sources lists, vaults and scopes, and secrets' names and metadata
 (tags, dates, references), never values. On the next start they show at
 once, and anything older than two minutes reloads in the background when
-you go to it, or when Go to searches it. Revealing and copying always
-fetch the value live.
+you go to it, or when Go to searches it. While it does, the pane's
+bottom border says how old what it shows is (`cached 3h ago`). Revealing
+and copying always fetch the value live.
 
 Lists not loaded for 30 days are dropped, and so is everything from an
 account you're no longer signed in to. Repos aren't cached: their files

docs/databricks.md

@@ -13,6 +13,10 @@ Secrets in Azure Key Vault-backed scopes are read through Databricks; if
 Databricks refuses, lazysecrets reads the backing vault directly with your
 az login (which then needs the [Key Vault roles](azure.md#permissions)).
 
+On a scope, the right pane shows who has access to it and how much
+(manage, write, read). Databricks shows that only to the scope's
+managers; to others it says so.
+
 Hide profiles you don't want in the [config](config.md):
 
 ```yaml

docs/keys.md

@@ -13,7 +13,8 @@ The rule: a letter in the lists, ctrl+ that letter where you type a filter
 |---|---|
 | `j`/`k`, `↑`/`↓` | move |
 | `g`/`G` | top / bottom |
-| `tab`/`l`, `shift+tab`/`h` | next / previous pane |
+| `tab`, `shift+tab`/`h` | next / previous pane |
+| `l` | the details of what's selected, on the right (`h` goes back) |
 | `1`–`4` | jump to pane |
 | `enter` / `esc`, `⌫` | drill in / back (also clears a filter or leaves the versions view) |
 | `[` / `]` | previous / next tab of the focused pane: Sources and Favourites in Sources; Secrets, Keys, Certs in Secrets |
@@ -107,9 +108,8 @@ anything loads.
 
 The pane on the right describes what's selected in the pane you're in: the
 account or subscription in Sources, the vault in Vaults, the secret in
-Secrets. Going into it (`4`, or `tab` from an account's row) keeps it on
-that; there `j`/`k`, `/` and `y` work on its rows, and `shift+tab` goes
-back. A value you reveal stays in view whichever pane you're in, until
+Secrets. Going into it (`l`, or `4`) keeps it on that; there `j`/`k`,
+`/` and `y` work on its rows, and `h` goes back. A value you reveal stays in view whichever pane you're in, until
 it's hidden.
 
 On top, the status pane (`0`) shows the version, a newer release and how

docs/repos.md

@@ -63,6 +63,13 @@ copying or `lazysecrets get` decrypts one value with your `sops` binary, so
 whatever sops uses works (age keys, Azure Key Vault through az, AWS/GCP
 KMS, PGP). When sops can't decrypt, its whole error message is shown.
 
+On a file, the right pane shows how it's encrypted and the keys it's
+encrypted for (public: age recipients, Key Vault keys, KMS ARNs, PGP
+fingerprints), when it was last encrypted, and what git knows of it:
+tracked, ignored or neither, and its last commit. A plain `.env` file that
+git tracks, or that isn't ignored, is marked in red: its values are in the
+repo's history, or easily could be.
+
 ## Opening files
 
 `e` opens the selected file, or on a secret, its file at that key's line:

internal/provider/azure/azure.go

@@ -185,10 +185,6 @@ func (p *Provider) tenant(subscriptionID string) string {
 	return p.tenants[subscriptionID]
 }
 
-const vaultQuery = `resources
-| where type =~ 'microsoft.keyvault/vaults'
-| project id, name, uri = tostring(properties.vaultUri)`
-
 func (p *Provider) graphVaults(ctx context.Context, src provider.Source) ([]provider.Container, error) {
 	var out []provider.Container
 	req := armresourcegraph.QueryRequest{
@@ -228,7 +224,7 @@ func graphVault(src provider.Source, row any) (provider.Container, bool) {
 	if id == "" || name == "" || uri == "" {
 		return provider.Container{}, false
 	}
-	return provider.Container{Source: src, ID: id, Name: name, Detail: uri, Types: objectTypes}, true
+	return provider.Container{Source: src, ID: id, Name: name, Detail: uri, Types: objectTypes, Attrs: graphInfo(m).attrs()}, true
 }
 
 func (p *Provider) armVaults(ctx context.Context, src provider.Source) ([]provider.Container, error) {
@@ -249,7 +245,7 @@ func (p *Provider) armVaults(ctx context.Context, src provider.Source) ([]provid
 			}
 			out = append(out, provider.Container{
 				Source: src, ID: deref(v.ID), Name: deref(v.Name),
-				Detail: *v.Properties.VaultURI, Types: objectTypes,
+				Detail: *v.Properties.VaultURI, Types: objectTypes, Attrs: armInfo(v).attrs(),
 			})
 		}
 	}

internal/provider/azure/azure_test.go

@@ -19,6 +19,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"reflect"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -417,3 +418,49 @@ func ecPoint(t *testing.T, k *ecdsa.PrivateKey) (x, y []byte) {
 	size := (len(b) - 1) / 2
 	return b[1 : 1+size], b[1+size:]
 }
+
+func TestVaultSettings(t *testing.T) {
+	want := []string{"group=rg-sec", "location=norwayeast", "SKU=premium", "access=Azure roles (RBAC)",
+		"soft delete=on, 30 days", "purge prot.=on", "network=selected networks (1 IP ranges, 0 subnets)",
+		"private=1 endpoint", "tags=env: prod", "=team: platform"}
+	check := func(name string, attrs []provider.Attr) {
+		t.Helper()
+		var got []string
+		for _, a := range attrs {
+			got = append(got, a.Label+"="+a.Value)
+		}
+		if !slices.Equal(got, want) {
+			t.Errorf("%s\n got %q\nwant %q", name, got, want)
+		}
+	}
+
+	// Resource Graph: the query's columns, as JSON gives them.
+	c, ok := graphVault(provider.Source{ID: "s"}, map[string]any{
+		"id": "/x/kv", "name": "kv", "uri": "https://kv.vault.azure.net/", "location": "norwayeast",
+		"resourceGroup": "rg-sec", "tags": map[string]any{"team": "platform", "env": "prod"},
+		"sku": "premium", "rbac": true, "softDelete": nil, "retention": 30.0, "purge": true,
+		"publicAccess": "", "defaultAction": "Deny", "ipRules": 1.0, "subnets": 0.0, "endpoints": 1.0, "policies": 0.0,
+	})
+	if !ok {
+		t.Fatal("row not read")
+	}
+	check("resource graph", c.Attrs)
+
+	// The management API, when Resource Graph fails.
+	id := "/subscriptions/s/resourceGroups/rg-sec/providers/Microsoft.KeyVault/vaults/kv"
+	p, _ := fakeAzure(t, staticCred{}, func(w http.ResponseWriter, r *http.Request) {
+		writeJSON(w, 200, map[string]any{"value": []any{map[string]any{"id": id, "name": "kv", "location": "norwayeast",
+			"tags": map[string]any{"team": "platform", "env": "prod"},
+			"properties": map[string]any{
+				"tenantId": "t", "vaultUri": "https://kv.vault.azure.net/", "sku": map[string]any{"family": "A", "name": "premium"},
+				"enableRbacAuthorization": true, "enablePurgeProtection": true, "softDeleteRetentionInDays": 30,
+				"networkAcls":                map[string]any{"defaultAction": "Deny", "ipRules": []any{map[string]any{"value": "10.0.0.0/8"}}},
+				"privateEndpointConnections": []any{map[string]any{"id": "pe1"}},
+			}}}})
+	})
+	vaults, err := p.armVaults(context.Background(), provider.Source{ID: "s"})
+	if err != nil || len(vaults) != 1 {
+		t.Fatalf("arm: %v %v", vaults, err)
+	}
+	check("management API", vaults[0].Attrs)
+}

internal/provider/azure/details.go

@@ -0,0 +1,158 @@
+package azure
+
+import (
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
+	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+)
+
+// A vault's settings come with the listing, from Resource Graph or the
+// Key Vault management API, with no requests of their own: where it is,
+// how access to it works, and how it's protected.
+
+type vaultInfo struct {
+	group, location, sku        string
+	rbac, softDelete, purge     *bool
+	retention                   *int32
+	publicAccess, defaultAction string
+	ipRules, subnets, endpoints int
+	policies                    int
+	tags                        map[string]string
+}
+
+// vaultQuery lists vaults with just the settings shown, not their whole
+// properties (access policies can be long).
+const vaultQuery = `resources
+| where type =~ 'microsoft.keyvault/vaults'
+| project id, name, uri = tostring(properties.vaultUri), location, resourceGroup, tags,
+  sku = tostring(properties.sku.name), rbac = properties.enableRbacAuthorization,
+  softDelete = properties.enableSoftDelete, retention = properties.softDeleteRetentionInDays,
+  purge = properties.enablePurgeProtection, publicAccess = tostring(properties.publicNetworkAccess),
+  defaultAction = tostring(properties.networkAcls.defaultAction),
+  ipRules = array_length(properties.networkAcls.ipRules),
+  subnets = array_length(properties.networkAcls.virtualNetworkRules),
+  endpoints = array_length(properties.privateEndpointConnections),
+  policies = array_length(properties.accessPolicies)`
+
+// graphInfo reads a vaultQuery row's settings.
+func graphInfo(m map[string]any) vaultInfo {
+	str := func(k string) string { s, _ := m[k].(string); return s }
+	num := func(k string) int { f, _ := m[k].(float64); return int(f) }
+	flag := func(k string) *bool {
+		if b, ok := m[k].(bool); ok {
+			return &b
+		}
+		return nil
+	}
+	v := vaultInfo{
+		group: str("resourceGroup"), location: str("location"), sku: str("sku"),
+		rbac: flag("rbac"), softDelete: flag("softDelete"), purge: flag("purge"),
+		publicAccess: str("publicAccess"), defaultAction: str("defaultAction"),
+		ipRules: num("ipRules"), subnets: num("subnets"), endpoints: num("endpoints"), policies: num("policies"),
+	}
+	if f, ok := m["retention"].(float64); ok {
+		r := int32(f)
+		v.retention = &r
+	}
+	if tags, ok := m["tags"].(map[string]any); ok {
+		v.tags = map[string]string{}
+		for k, t := range tags {
+			v.tags[k] = fmt.Sprint(t)
+		}
+	}
+	return v
+}
+
+// armInfo reads a vault's settings from the management API.
+func armInfo(v *armkeyvault.Vault) vaultInfo {
+	info := vaultInfo{location: deref(v.Location), tags: map[string]string{}}
+	if id, err := arm.ParseResourceID(deref(v.ID)); err == nil {
+		info.group = id.ResourceGroupName
+	}
+	for k, t := range v.Tags {
+		info.tags[k] = deref(t)
+	}
+	pr := v.Properties
+	if pr == nil {
+		return info
+	}
+	if pr.SKU != nil && pr.SKU.Name != nil {
+		info.sku = string(*pr.SKU.Name)
+	}
+	info.rbac, info.softDelete, info.purge = pr.EnableRbacAuthorization, pr.EnableSoftDelete, pr.EnablePurgeProtection
+	info.retention, info.publicAccess = pr.SoftDeleteRetentionInDays, deref(pr.PublicNetworkAccess)
+	if acl := pr.NetworkACLs; acl != nil {
+		if acl.DefaultAction != nil {
+			info.defaultAction = string(*acl.DefaultAction)
+		}
+		info.ipRules, info.subnets = len(acl.IPRules), len(acl.VirtualNetworkRules)
+	}
+	info.endpoints, info.policies = len(pr.PrivateEndpointConnections), len(pr.AccessPolicies)
+	return info
+}
+
+func (v vaultInfo) attrs() []provider.Attr {
+	var out []provider.Attr
+	add := func(label, value string) {
+		if value != "" {
+			out = append(out, provider.Attr{Label: label, Value: value})
+		}
+	}
+	add("group", v.group)
+	add("location", v.location)
+	add("SKU", v.sku)
+	// Who may read secrets is decided by Azure roles or by the vault's
+	// own access policies, never both.
+	if on(v.rbac, false) {
+		add("access", "Azure roles (RBAC)")
+	} else {
+		add("access", fmt.Sprintf("access policies (%d)", v.policies))
+	}
+	if on(v.softDelete, true) {
+		days := int32(90)
+		if v.retention != nil {
+			days = *v.retention
+		}
+		add("soft delete", fmt.Sprintf("on, %d days", days))
+	} else {
+		add("soft delete", "off")
+	}
+	add("purge prot.", map[bool]string{true: "on", false: "off"}[on(v.purge, false)])
+	switch {
+	case strings.EqualFold(v.publicAccess, "disabled"):
+		add("network", "private endpoints only")
+	case strings.EqualFold(v.defaultAction, "deny"):
+		add("network", fmt.Sprintf("selected networks (%d IP ranges, %d subnets)", v.ipRules, v.subnets))
+	default:
+		add("network", "all networks")
+	}
+	if v.endpoints > 0 {
+		add("private", fmt.Sprintf("%d endpoint%s", v.endpoints, map[bool]string{true: "s"}[v.endpoints > 1]))
+	}
+	keys := make([]string, 0, len(v.tags))
+	for k := range v.tags {
+		keys = append(keys, k)
+	}
+	slices.Sort(keys)
+	for i, k := range keys {
+		label := ""
+		if i == 0 {
+			label = "tags"
+		}
+		out = append(out, provider.Attr{Label: label, Value: k + ": " + v.tags[k]})
+	}
+	return out
+}
+
+// on is *b, or def when it isn't set.
+func on(b *bool, def bool) bool {
+	if b == nil {
+		return def
+	}
+	return *b
+}

internal/provider/databricks/databricks_test.go

@@ -140,6 +140,13 @@ func workspaceAPI(t *testing.T, status int) *httptest.Server {
 				map[string]any{"key": "storage-key", "last_updated_timestamp": 1767225600000},
 				map[string]any{"key": "client-secret"},
 			}})
+		case r.URL.Path == "/api/2.0/secrets/acls/list" && q.Get("scope") == "app":
+			write(w, 200, map[string]any{"items": []any{
+				map[string]any{"principal": "users", "permission": "READ"},
+				map[string]any{"principal": "admins", "permission": "MANAGE"},
+			}})
+		case r.URL.Path == "/api/2.0/secrets/acls/list" && q.Get("scope") == "locked":
+			write(w, 403, map[string]any{"error_code": "PERMISSION_DENIED", "message": "User does not have MANAGE permission"})
 		case r.URL.Path == "/api/2.0/secrets/get" && q.Get("scope") == "app":
 			write(w, 200, map[string]any{"key": q.Get("key"),
 				"value": base64.StdEncoding.EncodeToString([]byte("value-of-" + q.Get("key")))})
@@ -291,3 +298,20 @@ func TestClassify(t *testing.T) {
 		t.Error("cancellation classified as auth")
 	}
 }
+
+func TestScopeDetails(t *testing.T) {
+	p := newTestProvider(t, workspaceAPI(t, 0), nil)
+	src := provider.Source{ID: "prod"}
+	attrs, err := p.Details(context.Background(), provider.Container{Source: src, Name: "app"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []provider.Attr{{Label: "access", Value: "admins · manage"}, {Value: "users · read"}}
+	if !reflect.DeepEqual(attrs, want) {
+		t.Errorf("app: %+v", attrs)
+	}
+	attrs, err = p.Details(context.Background(), provider.Container{Source: src, Name: "locked"})
+	if err != nil || len(attrs) != 1 || !strings.Contains(attrs[0].Value, "managers") {
+		t.Errorf("locked: %+v, %v", attrs, err)
+	}
+}

internal/provider/databricks/details.go

@@ -0,0 +1,43 @@
+package databricks
+
+import (
+	"cmp"
+	"context"
+	"errors"
+	"slices"
+	"strings"
+
+	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/service/workspace"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+)
+
+// Details are who has access to a scope, and how much. Only the scope's
+// managers may see that; to others it says so.
+func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provider.Attr, error) {
+	w, pr, err := p.client(c.Source.ID)
+	if err != nil {
+		return nil, err
+	}
+	acls, err := w.ListAclsAll(ctx, workspace.ListAclsRequest{Scope: c.Name})
+	var api *apierr.APIError
+	switch {
+	case errors.As(err, &api) && api.StatusCode == 403:
+		return []provider.Attr{{Label: "access", Value: "only the scope's managers can see who has it"}}, nil
+	case err != nil:
+		return nil, classify(pr, err)
+	case len(acls) == 0:
+		return []provider.Attr{{Label: "access", Value: "workspace admins only"}}, nil
+	}
+	rank := map[workspace.AclPermission]int{workspace.AclPermissionManage: 0, workspace.AclPermissionWrite: 1, workspace.AclPermissionRead: 2}
+	slices.SortFunc(acls, func(a, b workspace.AclItem) int {
+		return cmp.Or(cmp.Compare(rank[a.Permission], rank[b.Permission]), cmp.Compare(a.Principal, b.Principal))
+	})
+	out := make([]provider.Attr, len(acls))
+	for i, a := range acls {
+		out[i] = provider.Attr{Value: a.Principal + " · " + strings.ToLower(string(a.Permission))}
+	}
+	out[0].Label = "access"
+	return out, nil
+}

internal/provider/provider.go

@@ -93,6 +93,8 @@ type Container struct {
 	// secrets only.
 	Types []ObjectType
 	URL   string // web page for the container, if any
+	// Attrs describe it further, from the listing (a vault's settings).
+	Attrs []Attr `json:",omitempty"`
 }
 
 // ObjectTypes returns the container's object types, defaulting to secrets.
@@ -107,6 +109,7 @@ func (c Container) ObjectTypes() []ObjectType {
 type Attr struct {
 	Label string
 	Value string
+	Warn  bool // worth a look (a plain .env tracked by git): shown in red
 }
 
 // Object describes a secret, key or certificate without its value.
@@ -199,6 +202,14 @@ type Account struct {
 	Copy, CopyLabel string
 }
 
+// ContainerDetails is implemented by providers that can say more about a
+// container than its listing does: a vault's settings, who has access to
+// a scope, how a file is encrypted and what git knows of it. It may go
+// over the network; ErrUnsupported means there's nothing more for c.
+type ContainerDetails interface {
+	Details(ctx context.Context, c Container) ([]Attr, error)
+}
+
 // AccountGroups is implemented by providers that can list the groups
 // their account is a member of, directly or through other groups. It
 // goes over the network.

internal/provider/repo/details.go

@@ -0,0 +1,62 @@
+package repo
+
+import (
+	"context"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+)
+
+// Details are how a file is encrypted and for whom, and what git knows of
+// it: a plain .env file that git tracks, or could, is marked.
+func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provider.Attr, error) {
+	r, ok := p.repo(c.Source.ID)
+	if !ok {
+		return nil, provider.ErrUnsupported
+	}
+	rel, err := filepath.Rel(r.root, c.ID)
+	if err != nil {
+		return nil, err
+	}
+	var out []provider.Attr
+	meta, isSops := readMeta(c.ID)
+	if isSops {
+		out = append(out, provider.Attr{Label: "encryption", Value: "sops · " + strings.Join(meta.methods, ", ")})
+		for i, k := range meta.recipients {
+			label := ""
+			if i == 0 {
+				label = "keys"
+			}
+			out = append(out, provider.Attr{Label: label, Value: k})
+		}
+		if !meta.modified.IsZero() {
+			out = append(out, provider.Attr{Label: "encrypted", Value: meta.modified.Local().Format("2006-01-02 15:04")})
+		}
+	} else {
+		out = append(out, provider.Attr{Label: "encryption", Value: "none: plain text"})
+	}
+
+	git := func(args ...string) (string, bool) {
+		b, err := exec.CommandContext(ctx, "git", append([]string{"-C", r.root}, args...)...).Output()
+		return strings.TrimSpace(string(b)), err == nil
+	}
+	switch _, tracked := git("ls-files", "--error-unmatch", "--", rel); {
+	case tracked && !isSops:
+		out = append(out, provider.Attr{Label: "git", Value: "tracked: its values are in the repo's history", Warn: true})
+	case tracked:
+		out = append(out, provider.Attr{Label: "git", Value: "tracked"})
+	default:
+		if _, ignored := git("check-ignore", "-q", "--", rel); ignored {
+			out = append(out, provider.Attr{Label: "git", Value: "ignored"})
+		} else {
+			out = append(out, provider.Attr{Label: "git", Value: "untracked and not ignored: easy to commit by mistake", Warn: !isSops})
+		}
+		return out, nil
+	}
+	if last, ok := git("log", "-1", "--format=%h · %ar · %an: %s", "--", rel); ok && last != "" {
+		out = append(out, provider.Attr{Label: "last commit", Value: last})
+	}
+	return out, nil
+}

internal/provider/repo/repo.go

@@ -815,8 +815,30 @@ func anyMatch(res []*regexp.Regexp, f string) bool {
 // --- sops files ---
 
 type sopsMeta struct {
-	methods  []string // age, azure_kv, …
-	modified time.Time
+	methods    []string // age, azure_kv, …
+	recipients []string // "age age1…", "azure_kv https://kv…/keys/sops"
+	modified   time.Time
+}
+
+// recipient names a key a file is encrypted for, from its sops metadata:
+// public, never a secret.
+func recipient(method string, f map[string]string) string {
+	var v string
+	switch method {
+	case "age":
+		v = f["recipient"]
+	case "pgp":
+		v = f["fp"]
+	case "kms":
+		v = f["arn"]
+	case "gcp_kms":
+		v = f["resource_id"]
+	case "azure_kv":
+		v = strings.TrimSuffix(f["vault_url"], "/") + "/keys/" + f["name"]
+	case "hc_vault":
+		v = strings.TrimSuffix(f["vault_address"], "/") + " " + f["engine_path"] + "/" + f["key_name"]
+	}
+	return method + " " + v
 }
 
 const maxFileSize = 4 << 20
@@ -848,6 +870,15 @@ func readMeta(file string) (sopsMeta, bool) {
 		for _, k := range known {
 			if v, ok := doc.Sops[k].([]any); ok && len(v) > 0 {
 				m.methods = append(m.methods, k)
+				for _, e := range v {
+					fields := map[string]string{}
+					if em, ok := e.(map[string]any); ok {
+						for fk, fv := range em {
+							fields[fk] = fmt.Sprint(fv)
+						}
+					}
+					m.recipients = append(m.recipients, recipient(k, fields))
+				}
 			}
 		}
 		if s, ok := doc.Sops["lastmodified"].(string); ok {
@@ -864,6 +895,7 @@ func readMeta(file string) (sopsMeta, bool) {
 		for _, k := range known {
 			if strings.Contains(text, "sops_"+k+"__") {
 				m.methods = append(m.methods, k)
+				m.recipients = append(m.recipients, envRecipients(text, k)...)
 			}
 		}
 		if i := strings.Index(text, "sops_lastmodified"); i >= 0 {
@@ -881,6 +913,35 @@ func readMeta(file string) (sopsMeta, bool) {
 	return m, true
 }
 
+// envRecipients are method's keys in a dotenv or ini sops file, whose
+// metadata is flattened: sops_age__list_0__map_recipient=age1….
+func envRecipients(text, method string) []string {
+	prefix := "sops_" + method + "__list_"
+	var order []string
+	keys := map[string]map[string]string{}
+	for line := range strings.Lines(text) {
+		k, v, ok := strings.Cut(strings.TrimSpace(line), "=")
+		rest, found := strings.CutPrefix(strings.TrimSpace(k), prefix)
+		if !ok || !found {
+			continue
+		}
+		n, field, ok := strings.Cut(rest, "__map_")
+		if !ok {
+			continue
+		}
+		if keys[n] == nil {
+			keys[n] = map[string]string{}
+			order = append(order, n)
+		}
+		keys[n][field] = strings.TrimSpace(v)
+	}
+	out := make([]string, len(order))
+	for i, n := range order {
+		out[i] = recipient(method, keys[n])
+	}
+	return out
+}
+
 func formatOf(file string) string {
 	switch strings.ToLower(filepath.Ext(file)) {
 	case ".yaml", ".yml":

internal/provider/repo/repo_test.go

@@ -477,3 +477,47 @@ func TestFile(t *testing.T) {
 		t.Errorf("lines %v\nwant  %v", lines, want)
 	}
 }
+
+func TestFileDetails(t *testing.T) {
+	root := gitRepo(t, map[string]string{
+		".gitignore":       ".env\n",
+		"secrets/app.yaml": sopsYAML,
+		"prod.env":         sopsEnv,
+		"tracked.env":      "TOKEN=x\n", // a plain .env in git: worth a look
+	})
+	os.WriteFile(filepath.Join(root, ".env"), []byte("TOKEN=x\n"), 0o600)
+	os.WriteFile(filepath.Join(root, "local.env"), []byte("TOKEN=x\n"), 0o600)
+	p := New(Settings{Dir: root})
+	ctx := context.Background()
+	srcs, _ := p.Sources(ctx)
+	details := func(name string) map[string]provider.Attr {
+		t.Helper()
+		attrs, err := p.Details(ctx, provider.Container{Source: srcs[0], ID: filepath.Join(root, name), Name: name})
+		if err != nil {
+			t.Fatal(err)
+		}
+		out := map[string]provider.Attr{}
+		for _, a := range attrs {
+			out[a.Label] = a
+		}
+		return out
+	}
+
+	d := details("secrets/app.yaml")
+	if d["encryption"].Value != "sops · age" || d["keys"].Value != "age age1xxxx" || d["git"].Value != "tracked" ||
+		!strings.Contains(d["last commit"].Value, "t: files") || d["encrypted"].Value == "" {
+		t.Errorf("sops yaml: %+v", d)
+	}
+	if d := details("prod.env"); d["keys"].Value != "age age1xxxx" {
+		t.Errorf("sops env: %+v", d)
+	}
+	if d := details("tracked.env"); d["encryption"].Value != "none: plain text" || !d["git"].Warn {
+		t.Errorf("tracked plain env: %+v", d)
+	}
+	if d := details(".env"); d["git"].Value != "ignored" || d["git"].Warn {
+		t.Errorf("ignored env: %+v", d)
+	}
+	if d := details("local.env"); !d["git"].Warn || !strings.Contains(d["git"].Value, "not ignored") {
+		t.Errorf("untracked env: %+v", d)
+	}
+}

internal/ui/app/app.go

@@ -56,6 +56,7 @@ const (
 	slotDescribe // extra metadata for the selected object
 	slotCopy     // fetch a value straight to the clipboard
 	slotVersions // count the selected object's versions
+	slotDetails  // a vault's, scope's or file's details
 	slotCount
 )
 
@@ -177,6 +178,7 @@ type Model struct {
 	fields   panes.Fields
 	lastLeft pane
 	groups   map[string]groupsState
+	details  map[string]detailsState // by containerKey
 	getenv   func(string) string
 	nvimOpen func(server, path string, line int) error // edit.go
 	now      func() time.Time
@@ -376,6 +378,7 @@ func New(providers []provider.Provider, opts Options) Model {
 		nvimOpen:      nvimOpen,
 		cache:         newCache(),
 		groups:        map[string]groupsState{},
+		details:       map[string]detailsState{},
 		fields:        panes.NewFields(),
 	}
 	if m.clip == nil {
@@ -456,6 +459,8 @@ func New(providers []provider.Provider, opts Options) Model {
 		m.loadCacheFile()
 		if len(m.sourceResults) > 0 {
 			m.rebuildSources()
+			m.sources.Loading = true // reloading what the file had
+			m.sources.Age = m.cachedAge(m.oldestSources())
 		}
 	}
 	if m.placeDir != "" && opts.Open == nil {
@@ -588,6 +593,16 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	case groupsMsg:
 		m.groups[msg.provider] = groupsState{names: msg.names, err: msg.err}
 
+	case detailsMsg:
+		if msg.req == m.reqID[slotDetails] {
+			m.done(slotDetails)
+		}
+		if errors.Is(msg.err, context.Canceled) || errors.Is(msg.err, context.DeadlineExceeded) {
+			delete(m.details, msg.key) // tried again when shown again
+		} else {
+			m.details[msg.key] = detailsState{attrs: msg.attrs, err: msg.err}
+		}
+
 	case crawlMsg:
 		cmds = append(cmds, m.handleCrawl(msg))
 
@@ -821,6 +836,8 @@ func (m *Model) handleKey(msg tea.KeyPressMsg) (cmd tea.Cmd, quit bool) {
 		if r, ok := m.sources.Selected(); ok && m.focus == paneContainers && r.kind == rowGroup {
 			m.focus = paneDetail // an account's row: nothing between
 		}
+	case key.Matches(msg, k.Details):
+		m.focus = paneDetail // what's selected, on the right
 	case key.Matches(msg, k.PrevPane):
 		if m.focus == paneDetail {
 			m.focus = m.lastLeft // back to what it describes
@@ -1032,6 +1049,7 @@ func (m *Model) refresh() tea.Cmd {
 	case paneContainers:
 		if src, ok := m.selectedSource(); ok {
 			m.containers.Refresh()
+			m.details = map[string]detailsState{}
 			return m.loadContainers(src, m.selSource)
 		}
 	case paneSecrets:
@@ -1154,6 +1172,7 @@ func (m *Model) showContainers(src provider.Source, key string) tea.Cmd {
 		return nil
 	}
 	m.containers.Refresh()
+	m.containers.Age = m.cachedAge(e.at)
 	return m.loadContainers(src, key)
 }
 
@@ -1170,6 +1189,7 @@ func (m *Model) showObjects(c provider.Container, key string) tea.Cmd {
 		return nil
 	}
 	m.secrets.Refresh()
+	m.secrets.Age = m.cachedAge(e.at)
 	return m.loadObjects(c, m.objType, key)
 }
 
@@ -1299,6 +1319,26 @@ func (m *Model) detailStale() bool {
 	return hasSecret || shown != m.containers.SelectedID()
 }
 
+// cachedAge is how old a list loaded at at is, if it's older than
+// cacheTTL: the panes say it while it reloads.
+func (m Model) cachedAge(at time.Time) string {
+	if d := m.now().Sub(at); d >= cacheTTL {
+		return ago(d)
+	}
+	return ""
+}
+
+// oldestSources is when the oldest of the cached Sources lists loaded.
+func (m Model) oldestSources() time.Time {
+	var oldest time.Time
+	for _, at := range m.sourcesAt {
+		if oldest.IsZero() || at.Before(oldest) {
+			oldest = at
+		}
+	}
+	return oldest
+}
+
 func (m *Model) handleSources(msg sourcesMsg) tea.Cmd {
 	if msg.gen != m.sourcesGen {
 		return nil

internal/ui/app/app_test.go

@@ -758,7 +758,9 @@ func TestFocusKeys(t *testing.T) {
 	}{
 		{"tab", paneContainers}, {"enter", paneSecrets}, {"enter", paneDetail},
 		{"enter", paneDetail}, {"esc", paneSecrets}, {"shift+tab", paneContainers},
-		{"4", paneDetail}, {"l", paneSources}, {"h", paneDetail},
+		{"4", paneDetail}, {"tab", paneSources}, {"shift+tab", paneDetail},
+		// l: what's selected, on the right; h: back to it.
+		{"2", paneContainers}, {"l", paneDetail}, {"h", paneContainers}, {"h", paneSources}, {"l", paneDetail},
 	} {
 		d.keys(tc.key)
 		if d.m.focus != tc.want {
@@ -1236,3 +1238,53 @@ func TestStatusPane(t *testing.T) {
 		t.Errorf("back to %v", d.m.focus)
 	}
 }
+
+// empty is an account with nothing in it, like Databricks without profiles.
+type empty struct{ provider.Provider }
+
+func (empty) Sources(context.Context) ([]provider.Source, error) { return nil, nil }
+
+func TestGetStarted(t *testing.T) {
+	t.Parallel()
+	d := newDriverOpts(t, Options{}, signedOut{fake.Azure(0)}, empty{fake.Databricks(0)})
+	scr := d.screen()
+	for _, want := range []string{"get started", "Azure      az login", "L runs it here",
+		"databricks auth login --host", "lazysecrets --demo"} {
+		if !strings.Contains(scr, want) {
+			t.Errorf("missing %q:\n%s", want, scr)
+		}
+	}
+	d.keys("l", "j")
+	if a := d.m.loginFor(); a == nil || a.Account != "Azure · admin" {
+		t.Errorf("L signs in to %+v", a)
+	}
+	d.keys("y")
+	if got := d.clip().content; got != "az login" {
+		t.Errorf("y copied %q", got)
+	}
+
+	// Once an account has something, an empty one says what it needs.
+	d = newDriverOpts(t, Options{}, fake.Azure(0), empty{fake.Databricks(0)})
+	d.m.sources.SelectWhere(func(r sourceRow) bool { return r.kind == rowGroup && r.provider == fake.Databricks(0).ID() })
+	d.send(nil)
+	if scr := d.screen(); strings.Contains(scr, "get started") || !strings.Contains(scr, "databricks auth login") {
+		t.Errorf("empty Databricks:\n%s", scr)
+
+// detailed is an account whose vaults have details.
+type detailed struct{ provider.Provider }
+
+func (detailed) Details(_ context.Context, c provider.Container) ([]provider.Attr, error) {
+	return []provider.Attr{{Label: "access", Value: "Azure roles (RBAC)"}, {Label: "git", Value: "tracked", Warn: true}}, nil
+}
+
+func TestContainerDetails(t *testing.T) {
+	t.Parallel()
+	d := newDriverOpts(t, Options{}, detailed{fake.Azure(0)})
+	d.keys("2")
+	if scr := d.screen(); !strings.Contains(scr, "access     Azure roles (RBAC)") || !strings.Contains(scr, "URI") {
+		t.Errorf("details:\n%s", scr)
+	}
+	if st := d.m.details[d.m.containers.SelectedID()]; st.loading || len(st.attrs) != 2 {
+		t.Errorf("state %+v", st)
+	}
+}

internal/ui/app/fields.go

@@ -29,6 +29,22 @@ type groupsMsg struct {
 	err      error
 }
 
+// A vault's, scope's or file's details beyond its listing load once a
+// session, when the cursor rests on it, and again with refresh. They're
+// extra: moving on cancels the load, and search never waits for them.
+type detailsState struct {
+	attrs   []provider.Attr
+	err     error
+	loading bool
+}
+
+type detailsMsg struct {
+	req   int
+	key   string
+	attrs []provider.Attr
+	err   error
+}
+
 // detailOf is the pane the fourth pane describes: the one in focus, or,
 // with the fourth in focus, the one it was entered from.
 func (m Model) detailOf() pane {
@@ -53,6 +69,8 @@ func (m *Model) syncFields() tea.Cmd {
 	case paneSources:
 		r, ok := m.sources.Selected()
 		switch {
+		case m.nothingFound():
+			m.fields.Show("get started", m.getStartedFields())
 		case !ok:
 			m.fields.Show("", nil)
 		case m.selectedProblem() != "":
@@ -68,7 +86,9 @@ func (m *Model) syncFields() tea.Cmd {
 		m.fields.Show("lazysecrets", m.statusFields())
 	case paneContainers:
 		if c, ok := m.containers.Selected(); ok {
+			cmd := m.loadDetails(c)
 			m.fields.Show(c.Name, m.containerFields(c))
+			return cmd
 		} else {
 			m.fields.Show("", nil)
 		}
@@ -106,6 +126,10 @@ func (m *Model) showAccount(r sourceRow) tea.Cmd {
 		}
 		fields = append(fields, groupFields(st)...)
 	}
+	if res, done := m.sourceResults[r.provider]; done && res.err == nil && len(res.sources) == 0 {
+		hint := emptyHint(p.Kind())
+		fields = append(fields, panes.Field{Label: "nothing", Value: "found: try", Info: true}, panes.Field{Value: hint.Value, URL: hint.URL})
+	}
 	m.fields.Show(p.Label(), fields)
 	return cmd
 }
@@ -171,9 +195,48 @@ func (m Model) containerFields(c provider.Container) []panes.Field {
 			add(strings.ToLower(string(t))+"s", fmt.Sprint(len(e.value)))
 		}
 	}
+	for _, a := range c.Attrs {
+		out = append(out, panes.Field{Label: a.Label, Value: a.Value, Err: a.Warn})
+	}
+	switch st := m.details[containerKey(c)]; {
+	case st.loading:
+		out = append(out, panes.Field{Label: "details", Value: "loading…", Info: true})
+	case errors.Is(st.err, provider.ErrUnsupported):
+	case st.err != nil:
+		out = append(out, panes.Field{Label: "details", Value: "couldn't load them: " + st.err.Error(), Info: true, Err: true})
+	}
+	for _, a := range m.details[containerKey(c)].attrs {
+		out = append(out, panes.Field{Label: a.Label, Value: a.Value, Err: a.Warn})
+	}
 	return out
 }
 
+// loadDetails loads c's details, if its provider has them and they
+// aren't loaded yet.
+func (m *Model) loadDetails(c provider.Container) tea.Cmd {
+	d, ok := m.providerFor(c.Source).(provider.ContainerDetails)
+	key := containerKey(c)
+	if _, seen := m.details[key]; !ok || seen {
+		return nil
+	}
+	// One at a time: the previous one, if it's still loading, is
+	// cancelled and forgotten, to load when it's shown again.
+	for k, st := range m.details {
+		if st.loading {
+			delete(m.details, k)
+		}
+	}
+	m.details[key] = detailsState{loading: true}
+	ctx, req := m.begin(slotDetails)
+	return m.settled(ctx, func() tea.Msg {
+		attrs, err := d.Details(ctx, c)
+		if ctx.Err() != nil {
+			err = ctx.Err()
+		}
+		return detailsMsg{req: req, key: key, attrs: attrs, err: err}
+	})
+}
+
 // problemFields show why an account has nothing to show, wrapped to the
 // pane, in red.
 func (m Model) problemFields(problem string) []panes.Field {

internal/ui/app/getstarted.go

@@ -0,0 +1,66 @@
+package app
+
+import (
+	"errors"
+
+	"git.kebcloud.no/keb/lazysecrets/internal/provider"
+	"git.kebcloud.no/keb/lazysecrets/internal/ui/panes"
+	"git.kebcloud.no/keb/lazysecrets/internal/update"
+)
+
+// When no account has anything to show, as on a first run, the right
+// pane says how to get started: the sign-in for each kind of account
+// (y copies it, L runs az login), and the demo.
+
+// nothingFound reports whether every account has loaded, with nothing.
+func (m Model) nothingFound() bool {
+	if m.sourcesPending > 0 {
+		return false
+	}
+	for _, p := range m.providers {
+		if len(m.sourceResults[p.ID()].sources) > 0 {
+			return false
+		}
+	}
+	return true
+}
+
+// getStartedFields are the rows saying how to get started.
+func (m Model) getStartedFields() []panes.Field {
+	out := []panes.Field{{Value: "Nothing to show yet: sign in where your secrets are.", Info: true}}
+	seen := map[provider.Kind]bool{}
+	for _, p := range m.providers {
+		if seen[p.Kind()] {
+			continue
+		}
+		seen[p.Kind()] = true
+		f := emptyHint(p.Kind())
+		var auth *provider.AuthError
+		switch err := m.sourceResults[p.ID()].err; {
+		case errors.As(err, &auth) && len(auth.Login) > 0:
+			f.Provider = p.ID() // L signs in
+			out = append(out, f, panes.Field{Value: withKey(m.keys.Login, "%s runs it here"), Info: true})
+		case err != nil:
+			out = append(out, f, panes.Field{Value: err.Error(), Info: true, Err: true})
+		default:
+			out = append(out, f)
+		}
+	}
+	return append(out,
+		panes.Field{Label: "try", Value: "lazysecrets --demo"},
+		panes.Field{Value: "built-in sample data, to look around", Info: true},
+		panes.Field{Label: "docs", Value: "getting started", URL: update.DefaultRepo + "#get-started"},
+	)
+}
+
+// emptyHint is how an account of kind gets something to show.
+func emptyHint(kind provider.Kind) panes.Field {
+	switch kind {
+	case provider.KindDatabricks:
+		return panes.Field{Label: "Databricks", Value: "databricks auth login --host https://<workspace>"}
+	case provider.KindRepo:
+		return panes.Field{Label: "repos", Value: "SOPS and .env files in your git repos",
+			URL: update.DefaultRepo + "/src/branch/main/docs/repos.md"}
+	}
+	return panes.Field{Label: string(kind), Value: "az login"}
+}

internal/ui/app/persist_test.go

@@ -39,6 +39,9 @@ func TestCacheFileShowsLastRunAtOnce(t *testing.T) {
 	// Next run, with a backend too slow to answer during the test: the
 	// lists show from the file, and the cursor is where it was.
 	d2 := newDriverOpts(t, Options{CacheFile: file}, fake.Azure(time.Minute))
+	if strings.Contains(d2.screen(), "cached") {
+		t.Errorf("a fresh cache said its age:\n%s", d2.screen())
+	}
 	d2.keys("2")
 	if _, v, _ := d2.selected(); v != vault {
 		t.Errorf("vaults from the cache: selected %q, want %q\n%s", v, vault, d2.screen())
@@ -49,6 +52,29 @@ func TestCacheFileShowsLastRunAtOnce(t *testing.T) {
 	}
 }
 
+// Lists from an older cache say how old they are while they reload.
+func TestCacheFileSaysItsAge(t *testing.T) {
+	t.Parallel()
+	file := filepath.Join(t.TempDir(), "cache.json")
+	d := newDriverOpts(t, Options{CacheFile: file}, fake.Azure(0))
+	d.keys("3")
+	at := time.Now().Add(-3 * time.Hour)
+	for k, e := range d.m.cache.containers {
+		d.m.cache.containers[k] = entry[[]provider.Container]{e.value, at}
+	}
+	for id := range d.m.sourcesAt {
+		d.m.sourcesAt[id] = at
+	}
+	if err := d.m.Persist(); err != nil {
+		t.Fatal(err)
+	}
+	d2 := newDriverOpts(t, Options{CacheFile: file}, fake.Azure(time.Minute))
+	d2.keys("2")
+	if n := strings.Count(d2.screen(), "cached 3h ago"); n != 2 {
+		t.Errorf("Sources and Vaults should say they're from 3h ago (%d do):\n%s", n, d2.screen())
+	}
+}
+
 func TestCacheFileDropsOldAndSignedOut(t *testing.T) {
 	t.Parallel()
 	file := filepath.Join(t.TempDir(), "cache.json")

internal/ui/keys/keys.go

@@ -36,7 +36,7 @@ const (
 type Map struct {
 	// lists
 	Up, Down, Top, Bottom             key.Binding
-	NextPane, PrevPane                key.Binding
+	NextPane, PrevPane, Details       key.Binding
 	Pane0, Pane1, Pane2, Pane3, Pane4 key.Binding
 	NextTab, PrevTab                  key.Binding
 	Enter, Back, Filter               key.Binding
@@ -87,7 +87,8 @@ func (m *Map) Actions() []Action {
 		a(Lists, "top", &m.Top, "top", "move", "Jump to the top of the focused list."),
 		a(Lists, "bottom", &m.Bottom, "bottom", "move", "Jump to the bottom of the focused list."),
 		a(Lists, "nextPane", &m.NextPane, "next pane", "move", "Focus the next pane: Sources, Vaults, Secrets, detail."),
-		a(Lists, "prevPane", &m.PrevPane, "prev pane", "move", "Focus the previous pane."),
+		a(Lists, "prevPane", &m.PrevPane, "prev pane", "move", "Focus the previous pane; from the detail pane, the one it describes."),
+		a(Lists, "details", &m.Details, "details", "move", "Focus the detail pane on the right, on what's selected: a source, vault, file or secret."),
 		a(Lists, "pane1", &m.Pane1, "Sources pane", "move", "Focus the Sources pane."),
 		a(Lists, "pane2", &m.Pane2, "Vaults pane", "move", "Focus the Vaults (or Scopes) pane."),
 		a(Lists, "pane3", &m.Pane3, "Secrets pane", "move", "Focus the Secrets pane."),
@@ -178,7 +179,7 @@ func (m *Map) Actions() []Action {
 var defaults = map[string][]string{
 	"lists.up": {"k", "up", "ctrl+k", "ctrl+p"}, "lists.down": {"j", "down", "ctrl+j", "ctrl+n"},
 	"lists.top": {"g", "home"}, "lists.bottom": {"G", "end"},
-	"lists.nextPane": {"tab", "l", "right"}, "lists.prevPane": {"shift+tab", "h", "left"},
+	"lists.nextPane": {"tab"}, "lists.prevPane": {"shift+tab", "h", "left"}, "lists.details": {"l", "right"},
 	"lists.pane1": {"1"}, "lists.pane2": {"2"}, "lists.pane3": {"3"}, "lists.pane4": {"4"}, "lists.pane0": {"0"},
 	"lists.enter": {"enter"}, "lists.back": {"esc", "backspace"},
 	"lists.filter": {"/"}, "lists.prevTab": {"["}, "lists.nextTab": {"]"}, "lists.sourcesView": {"`"},

internal/ui/panes/list.go

@@ -34,6 +34,9 @@ type List[T any] struct {
 	Empty   string // shown when loaded with no items
 	Loading bool
 	Err     error
+	// Age says how old the items are ("2h ago") while they reload, by
+	// the counter.
+	Age string
 
 	item    Item[T]
 	items   []T
@@ -88,6 +91,7 @@ func (l *List[T]) SetError(err error) {
 func (l *List[T]) Refresh() {
 	l.Loading = true
 	l.Err = nil
+	l.Age = ""
 }
 
 func (l *List[T]) SetLoading() {
@@ -369,6 +373,9 @@ func (l List[T]) View(st styles.Styles, focused bool, spin string) string {
 	if len(l.visible) > 0 {
 		counter = fmt.Sprintf("%d of %d", l.cursor+1, len(l.visible))
 	}
+	if l.Loading && l.Age != "" && len(l.items) > 0 {
+		counter = "cached " + l.Age + " · " + counter
+	}
 	return BoxCounted(st, title, "", counter, body, l.w, l.h, focused)
 }