refactor: one copy of the UI's repeated helpers

- Text inputs come from newTextInput; the link and folder prompts share one width.
- One starred-first sort for sources, vaults and secrets; accountOf where the account was cut from the label by hand.
- One helper each for the reveal and clipboard countdowns' tick and seconds, the "Open with" choices, the vaults-loaded count, and Go to's and the panes' tabs.
- The details pane builds its label prefix, indent, note and source once; list rows mark matches with MarkMatches.
- The release page opens through openPage, so it now says it opened, as other pages do.
- The cache's account filter is built once per load or save, not per key.

CHANGELOG.md

@@ -2,12 +2,6 @@
 
 Every release of lazysecrets, newest first.
 
-## v0.2.1 – 2026-10-15
-
-### Fixed
-
-- A link opens lazysecrets with your cache and next to your running instances ([#71](https://git.kebcloud.no/keb/lazysecrets/pulls/71)) ([bb41767](https://git.kebcloud.no/keb/lazysecrets/commit/bb41767cbad00bab4f1824f4e0754cc7abd98c59))
-
 ## v0.2.0 – 2026-10-14
 
 ### Added

README.md

@@ -23,7 +23,7 @@ A terminal UI for finding, reading and sharing secrets. Inspired by the fantasti
 - **Your way**: rebind any key, pick a theme, and add custom commands to run
   on a secret.
 - **Try it first**: `lazysecrets --demo` runs on built-in sample data.
-- **Sources**: Azure Key Vault, Databricks secret scopes, and SOPS, `.env` and Spring Boot config files in your git repos.
+- **Sources**: Azure Key Vault, Databricks secret scopes, and SOPS and `.env` files in your git repos.
 
 > **Early development:** expect rough edges. See [CHANGELOG.md](CHANGELOG.md) for what's new.
 
@@ -87,7 +87,7 @@ pickers and scripts: see [Integration](docs/integration.md#an-fzf-picker).
 - [Keys](docs/keys.md): every key, Go to, the layout, and rebinding keys
 - [Azure Key Vault](docs/azure.md): accounts, permissions, pinned vaults
 - [Databricks](docs/databricks.md): profiles and Key Vault-backed scopes
-- [SOPS, .env and Spring files](docs/repos.md): which repos and files, decrypting
+- [SOPS and .env files](docs/repos.md): which repos and files, decrypting
 - [Sharing](docs/sharing.md): links to secrets, encrypted env files, and
   opening links, also from the browser and chat
 - [Integration](docs/integration.md): how lazysecrets can integrate into other systems

cmd/lazysecrets/main.go

@@ -346,7 +346,7 @@ Flags:
 		if config.On(pc.Repos.Enabled) {
 			repos := repo.New(repo.Settings{
 				Dir: startDir, Paths: pc.Repos.Paths, Roots: valueOr(pc.Repos.Roots, repo.DefaultRoots),
-				Starred: starredRepos(st), Include: pc.Repos.Include, Exclude: pc.Repos.Exclude, Spring: pc.Repos.Spring,
+				Starred: starredRepos(st), Include: pc.Repos.Include, Exclude: pc.Repos.Exclude,
 			})
 			// The repo it started in (shown on top as Repo) and the
 			// others, checked for secret files in the background like

docs/config.md

@@ -74,7 +74,6 @@ theme:
   azureColor: ["#82aaff"]
   databricksColor: ["#ff757f"]
   repoColor: ["#c099ff"]
-  springColor: ["#c3e88d"]               # Spring Boot config files
 ```
 
 A role lazysecrets doesn't know, a typo or one from a newer version, is

docs/keys.md

@@ -53,7 +53,7 @@ match case exactly.
 | `Y` | copy the reference (`@Microsoft.KeyVault(...)`, key/certificate URL, `{{secrets/scope/key}}`) |
 | `v` | versions of the selected item (Azure); `space`/`y`/`Y` then act on that version; `esc`, `⌫` or `v` to go back |
 | `o` | open the selected item in the browser (over SSH: copy the link) |
-| `e` | open the selected SOPS, `.env` or Spring file, or a secret's file at its line ([how](repos.md#opening-files)) |
+| `e` | open the selected SOPS or `.env` file, or a secret's file at its line ([how](repos.md#opening-files)) |
 | `s` / `S` | copy a [link](sharing.md) to the selected item / share menu (also env files, [encrypted](sharing.md#sharing-env-files)) |
 | `ctrl+o` | open a link or reference (or just paste one) |
 | `x` | [custom commands](custom-commands.md) |

docs/repos.md

@@ -1,9 +1,9 @@
-# SOPS, .env and Spring files in git repos
+# SOPS and .env files in git repos
 
 lazysecrets shows git repositories under **Repos**: their
 [SOPS](https://github.com/getsops/sops)-encrypted files (YAML, JSON,
-`.env`, INI), plain env files and [Spring Boot config](#spring-boot-config)
-as vaults, and the keys in them (`db.password`, `list[0]`) as secrets. A dot or bracket inside a key is
+`.env`, INI) and plain env files as vaults, and the keys in them
+(`db.password`, `list[0]`) as secrets. A dot or bracket inside a key is
 escaped, `app\.name`, so it doesn't read as nesting.
 
 ## Which repos
@@ -46,7 +46,7 @@ Folders of dependencies and caches are never looked in, tracked or not:
 3. where the repo's `.sops.yaml` `creation_rules` say SOPS files go,
 4. the whole repo.
 
-`include`/`exclude` apply to env and Spring files too.
+`include`/`exclude` apply to env files too.
 
 ```yaml
 providers:
@@ -65,51 +65,13 @@ sharing:
   key: https://kv-team.vault.azure.net/secrets/env-share   # or its lazysecrets:// link
 ```
 
-## Spring Boot config
-
-`application.yml`, `application-prod.properties`, `bootstrap.yaml` and the
-like, tracked by git (not those in a Helm chart's `templates/`). Most of
-their keys aren't secret, so only those that look like one are listed:
-
-- **keys** named like a secret: ending in `password`, `pwd`, `secret`,
-  `token`, `key`, `credentials`, `salt`, `connection-string` and the
-  like (`spring.datasource.password`, `client-secret`, `checkoutKey`),
-- **values** that look like one: Jasypt's `ENC(...)`, a URL with a
-  password (`jdbc:postgresql://app:pw@db/app`), or a connection string
-  with `AccountKey=`, `SharedAccessKey=` or `Password=`.
-
-A file's details count the keys left out, and `e` opens it whole. A
-`${DB_PASSWORD}` value is marked as a reference: the secret is set
-elsewhere. A tracked file is marked in red only when a listed key has its
-value in plain text.
-
-Each list of regexps replaces its default; `keys: [".*"]` lists every key:
-
-```yaml
-providers:
-  repos:
-    spring:
-      keys: ["(?i)(password|secret|token|key)$", "bearer$"]   # matched against the key's name
-      values: ["^ENC\\(.+\\)$"]                               # and against its value
-```
-
-A repo's `.lazysecrets.yaml` can set `spring` too, for everyone, and wins
-over the config, one list at a time.
-
-Keys are named as Spring names them, `spring.datasource.password`; in a
-file with several documents (`---`, or `#---` in `.properties`), a later
-document's keys get its profile, `spring.datasource.password (prod)`.
-Values Maven fills in at build time (`@project.version@`) are read as
-they are.
-
 ## Decrypting
 
-Listing never decrypts: SOPS and Jasypt encrypt values only, so keys and
-metadata (encryption, last modified) are read straight from the files.
-Revealing, copying or `lazysecrets get` decrypts one value; SOPS's with
-your `sops` binary, so whatever sops uses works (age keys, Azure Key Vault
-through az, AWS/GCP KMS, PGP). When sops can't decrypt, its whole error
-message is shown.
+Listing never decrypts: SOPS encrypts values only, so keys and metadata
+(encryption, last modified) are read straight from the files. Revealing,
+copying or `lazysecrets get` decrypts one value with your `sops` binary, so
+whatever sops uses works (age keys, Azure Key Vault through az, AWS/GCP
+KMS, PGP). When sops can't decrypt, its whole error message is shown.
 
 On a file, the right pane shows how it's encrypted and the keys it's
 encrypted for (public: age recipients, Key Vault keys, KMS ARNs, PGP
@@ -118,22 +80,6 @@ tracked, ignored or neither, and its last commit. A plain `.env` file that
 git tracks, or that isn't ignored, is marked in red: its values are in the
 repo's history, or easily could be.
 
-### Jasypt
-
-A value like `ENC(...)` in a plain `.env` or Spring file is
-[Jasypt](http://www.jasypt.org)'s, decrypted when it's revealed or copied
-with jasypt-spring-boot's default algorithm (3.0+:
-`PBEWITHHMACSHA512ANDAES_256`). The password is, as in Spring:
-
-1. `$JASYPT_ENCRYPTOR_PASSWORD`,
-2. the file's own: `jasypt.encryptor.password` in a Spring file,
-   `JASYPT_ENCRYPTOR_PASSWORD` in a `.env`; a `${VAR}` (or
-   `${VAR:default}`) in it is read from the environment.
-
-Environment variables are lazysecrets' own: a link opened from the browser
-starts it without your shell's. A `.env` whose values are all Jasypt's
-isn't marked in red.
-
 ## Opening files
 
 `e` opens the selected file, or on a secret, its file at that key's line:

internal/config/config.go

@@ -15,7 +15,6 @@ import (
 	"go.yaml.in/yaml/v3"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/commands"
-	"git.kebcloud.no/keb/lazysecrets/internal/provider/repo"
 	"git.kebcloud.no/keb/lazysecrets/internal/share"
 	"git.kebcloud.no/keb/lazysecrets/internal/update"
 )
@@ -154,8 +153,6 @@ type Repos struct {
 	// a repo's .sops.yaml creation_rules say where to look.
 	Include []string `yaml:"include"`
 	Exclude []string `yaml:"exclude"`
-	// Spring says which keys of Spring Boot config files are secrets.
-	Spring repo.SpringPatterns `yaml:"spring"`
 }
 
 type Azure struct {
@@ -295,9 +292,6 @@ func (c Config) validate(path string) error {
 			return fmt.Errorf("%s: %s: %s is negative", path, name, d)
 		}
 	}
-	if err := c.Providers.Repos.Spring.Check(); err != nil {
-		return fmt.Errorf("%s: providers.repos.%w", path, err)
-	}
 	for i, v := range c.Providers.Azure.Vaults {
 		if !strings.HasPrefix(v, "https://") {
 			return fmt.Errorf("%s: providers.azure.vaults[%d]: %q is not an https:// vault URL", path, i, v)

internal/config/config_test.go

@@ -84,7 +84,6 @@ func TestLoadRejectsMistakes(t *testing.T) {
 		"workspace":  "sharing:\n  key: \"{{secrets/team/env-share}}\"\n",
 		"short keys": "sharing:\n  keyRules:\n    minLength: 8\n",
 		"classes":    "sharing:\n  keyRules:\n    minClasses: 5\n",
-		"regexp":     "providers:\n  repos:\n    spring:\n      keys: [\"(pass\"]\n",
 	} {
 		if _, err := LoadAll([]string{write(t, content)}); err == nil {
 			t.Errorf("%s: no error", name)

internal/jasypt/jasypt.go

@@ -1,67 +0,0 @@
-// Package jasypt decrypts values encrypted with Jasypt the way
-// jasypt-spring-boot 3.0 and later does by default: ENC(...) around the
-// base64 of a random salt, a random IV and the ciphertext, with
-// PBEWITHHMACSHA512ANDAES_256 (PBKDF2-HMAC-SHA512, 1000 iterations,
-// AES-256-CBC).
-package jasypt
-
-import (
-	"crypto/aes"
-	"crypto/cipher"
-	"crypto/pbkdf2"
-	"crypto/sha512"
-	"encoding/base64"
-	"errors"
-	"strings"
-	"unicode/utf8"
-)
-
-const iterations = 1000
-
-// ErrDecrypt is a value that doesn't decrypt with the password: a wrong
-// password, or one encrypted with another algorithm.
-var ErrDecrypt = errors.New("doesn't decrypt: a wrong password, or not Jasypt's default algorithm (PBEWITHHMACSHA512ANDAES_256)")
-
-// Is reports whether v is a Jasypt value, ENC(...).
-func Is(v string) bool {
-	return len(v) > len("ENC()") && strings.HasPrefix(v, "ENC(") && strings.HasSuffix(v, ")")
-}
-
-// Decrypt decrypts an ENC(...) value.
-func Decrypt(v, password string) (string, error) {
-	b, err := base64.StdEncoding.DecodeString(strings.TrimSuffix(strings.TrimPrefix(v, "ENC("), ")"))
-	if err != nil {
-		return "", errors.New("not Jasypt: ENC(...) isn't base64")
-	}
-	const size = aes.BlockSize // the salt's and the IV's too
-	if len(b) < 3*size || len(b)%size != 0 {
-		return "", ErrDecrypt
-	}
-	salt, iv, data := b[:size], b[size:2*size], b[2*size:]
-	key, err := pbkdf2.Key(sha512.New, password, salt, iterations, 32)
-	if err != nil {
-		return "", err
-	}
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return "", err
-	}
-	plain := make([]byte, len(data))
-	cipher.NewCBCDecrypter(block, iv).CryptBlocks(plain, data)
-	// A wrong password decrypts to noise: its padding is almost never
-	// valid, and the rest rarely UTF-8.
-	n := int(plain[len(plain)-1])
-	if n == 0 || n > size {
-		return "", ErrDecrypt
-	}
-	for _, c := range plain[len(plain)-n:] {
-		if int(c) != n {
-			return "", ErrDecrypt
-		}
-	}
-	plain = plain[:len(plain)-n]
-	if !utf8.Valid(plain) {
-		return "", ErrDecrypt
-	}
-	return string(plain), nil
-}

internal/jasypt/jasypt_test.go

@@ -1,37 +0,0 @@
-package jasypt
-
-import (
-	"errors"
-	"testing"
-)
-
-// Encrypted by Jasypt 1.9.3 itself, set up as jasypt-spring-boot's default
-// encryptor, with the password "test-password".
-var vectors = map[string]string{
-	"ENC(5IQUKT4B7j38TnZJ+BlWqo/zSkKHTjl4XRJyaQEHgkCy4r00avLt4dWqFB74X0Zw)":                         "hunter2",
-	"ENC(w4pm2JVZcbG5R+Ud9uKHg8VhJ/0aAK7sFXtNBv+Vo450SAchTQtfhw0TnIJ9gN+D0VFbwqJzfXU369coTJz2rw==)": "blåbærsyltetøy ✓",
-}
-
-func TestDecrypt(t *testing.T) {
-	for enc, want := range vectors {
-		if !Is(enc) {
-			t.Errorf("%s: not Jasypt", enc)
-		}
-		if got, err := Decrypt(enc, "test-password"); err != nil || got != want {
-			t.Errorf("%s: %q %v, want %q", enc, got, err, want)
-		}
-		if _, err := Decrypt(enc, "wrong"); !errors.Is(err, ErrDecrypt) {
-			t.Errorf("%s with a wrong password: %v", enc, err)
-		}
-	}
-	for _, v := range []string{"ENC(not base64!)", "ENC(aGVsbG8=)"} {
-		if _, err := Decrypt(v, "test-password"); err == nil {
-			t.Errorf("%s: no error", v)
-		}
-	}
-	for _, v := range []string{"ENC()", "hunter2", "ENC[AES256_GCM,data:x]", "${DB_PASSWORD}"} {
-		if Is(v) {
-			t.Errorf("%s: Jasypt", v)
-		}
-	}
-}

internal/provider/provider.go

@@ -133,7 +133,6 @@ type Object struct {
 	Type        ObjectType
 	ID          string
 	Name        string
-	Detail      string // shown after the name, e.g. "jasypt" for how its value is kept
 	Version     string
 	Enabled     *bool
 	Updated     time.Time

internal/provider/repo/details.go

@@ -2,8 +2,6 @@ package repo
 
 import (
 	"context"
-	"fmt"
-	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
@@ -24,12 +22,7 @@ func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provide
 	}
 	var out []provider.Attr
 	meta, isSops := readMeta(c.ID)
-	// A plain file's values are at risk in git, unless they're all Jasypt;
-	// a Spring file's only when one of its secrets is in plain text.
-	plain := !isSops
-	if !isSops && IsSpring(c.ID) {
-		out, plain = p.springDetails(c)
-	} else if isSops {
+	if isSops {
 		out = append(out, provider.Attr{Label: "encryption", Value: "sops · " + strings.Join(meta.methods, ", ")})
 		for i, k := range meta.recipients {
 			label := ""
@@ -42,7 +35,7 @@ func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provide
 			out = append(out, provider.Attr{Label: "encrypted", Value: meta.modified.Local().Format("2006-01-02 15:04")})
 		}
 	} else {
-		out, plain = envDetails(c.ID)
+		out = append(out, provider.Attr{Label: "encryption", Value: "none: plain text"})
 	}
 
 	git := func(args ...string) (string, bool) {
@@ -50,7 +43,7 @@ func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provide
 		return strings.TrimSpace(string(b)), err == nil
 	}
 	switch _, tracked := git("ls-files", "--error-unmatch", "--", rel); {
-	case tracked && plain:
+	case tracked && !isSops:
 		out = append(out, provider.Attr{Label: "git", Value: "tracked: its values are in the repo's history", Warn: true})
 	case tracked:
 		out = append(out, provider.Attr{Label: "git", Value: "tracked"})
@@ -58,7 +51,7 @@ func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provide
 		if _, ignored := git("check-ignore", "-q", "--", rel); ignored {
 			out = append(out, provider.Attr{Label: "git", Value: "ignored"})
 		} else {
-			out = append(out, provider.Attr{Label: "git", Value: "untracked and not ignored: easy to commit by mistake", Warn: plain})
+			out = append(out, provider.Attr{Label: "git", Value: "untracked and not ignored: easy to commit by mistake", Warn: !isSops})
 		}
 		return out, nil
 	}
@@ -67,28 +60,3 @@ func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provide
 	}
 	return out, nil
 }
-
-// envDetails says how a plain env file's values are encrypted, and whether
-// any is in plain text.
-func envDetails(file string) (attrs []provider.Attr, plain bool) {
-	b, err := os.ReadFile(file)
-	if err != nil {
-		return []provider.Attr{{Label: "encryption", Value: err.Error(), Warn: true}}, true
-	}
-	keys, _ := parseKeys(file, b)
-	n := 0
-	for _, k := range keys {
-		if k.jasypt {
-			n++
-		}
-	}
-	return []provider.Attr{{Label: "encryption", Value: jasyptShare(n, len(keys))}}, n < len(keys)
-}
-
-// jasyptShare is how many of a plain file's values are Jasypt's.
-func jasyptShare(n, of int) string {
-	if n == 0 {
-		return "none: plain text"
-	}
-	return fmt.Sprintf("jasypt: %d of %d values", n, of)
-}

internal/provider/repo/jasypt.go

@@ -1,74 +0,0 @@
-package repo
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"regexp"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/jasypt"
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-)
-
-// jasyptEnv is where Spring looks for the password first, before the
-// config's jasypt.encryptor.password, and so does lazysecrets.
-const jasyptEnv = "JASYPT_ENCRYPTOR_PASSWORD"
-
-// jasyptValue decrypts v when it's a Jasypt value, ENC(...), from a plain
-// file; other values are as they are.
-func jasyptValue(file string, v provider.SecretValue) (provider.SecretValue, error) {
-	s := v.Reveal()
-	if !jasypt.Is(s) {
-		return v, nil
-	}
-	password, from, err := jasyptPassword(file)
-	if err != nil {
-		return provider.SecretValue{}, err
-	}
-	plain, err := jasypt.Decrypt(s, password)
-	if errors.Is(err, jasypt.ErrDecrypt) {
-		return provider.SecretValue{}, fmt.Errorf("jasypt: with the password from %s: %w", from, err)
-	}
-	if err != nil {
-		return provider.SecretValue{}, fmt.Errorf("jasypt: %w", err)
-	}
-	return provider.NewSecretValue([]byte(plain)), nil
-}
-
-// jasyptPassword is the password for a file's Jasypt values, and where it's
-// from: $JASYPT_ENCRYPTOR_PASSWORD, else the file's own setting
-// (jasypt.encryptor.password in a Spring file, JASYPT_ENCRYPTOR_PASSWORD
-// in an env file), with a ${VAR} in it read from the environment.
-func jasyptPassword(file string) (password, from string, err error) {
-	if v := os.Getenv(jasyptEnv); v != "" {
-		return v, "$" + jasyptEnv, nil
-	}
-	setting, read := jasyptEnv, plainValue
-	if IsSpring(file) {
-		setting, read = "jasypt.encryptor.password", springValue
-	}
-	v, err := read(file, setting)
-	if err != nil {
-		return "", "", fmt.Errorf("jasypt: no password: set $%s, or %s in %s", jasyptEnv, setting, filepath.Base(file))
-	}
-	return resolvePlaceholder(v.Reveal(), setting+" in "+filepath.Base(file))
-}
-
-// placeholder is Spring's ${VAR} or ${VAR:default}.
-var placeholder = regexp.MustCompile(`^\$\{([^:}]+)(:[^}]*)?\}$`)
-
-// resolvePlaceholder reads a ${VAR} value from the environment, falling
-// back to its default; other values are as they are.
-func resolvePlaceholder(v, from string) (string, string, error) {
-	m := placeholder.FindStringSubmatch(v)
-	switch {
-	case m == nil:
-		return v, from, nil
-	case os.Getenv(m[1]) != "":
-		return os.Getenv(m[1]), "$" + m[1] + " (" + from + ")", nil
-	case m[2] != "":
-		return m[2][1:], "the default in " + from, nil
-	}
-	return "", "", fmt.Errorf("jasypt: no password: %s is %s, and $%s isn't set", from, v, m[1])
-}

internal/provider/repo/jasypt_test.go

@@ -1,102 +0,0 @@
-package repo
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-)
-
-// hunter2, encrypted by Jasypt with the password "test-password".
-const jasyptHunter2 = "ENC(5IQUKT4B7j38TnZJ+BlWqo/zSkKHTjl4XRJyaQEHgkCy4r00avLt4dWqFB74X0Zw)"
-
-func TestJasyptPassword(t *testing.T) {
-	dir := t.TempDir()
-	value := func(name, body string) (string, error) {
-		file := filepath.Join(dir, name)
-		if err := os.WriteFile(file, []byte(body), 0o600); err != nil {
-			t.Fatal(err)
-		}
-		key := "app.token"
-		if !IsSpring(name) {
-			key = "TOKEN"
-		}
-		v, err := (&Provider{}).Value(context.Background(), provider.Object{ID: file + "\x00" + key, Name: key})
-		return v.Reveal(), err
-	}
-	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "")
-	t.Setenv("MY_PASSWORD", "")
-	spring := func(password string) string {
-		return "jasypt.encryptor.password: " + password + "\napp.token: " + jasyptHunter2 + "\n"
-	}
-
-	for _, c := range []struct{ name, file, body, env, want string }{
-		{"the file's own", "application.yml", spring("test-password"), "", "hunter2"},
-		{"a ${VAR}", "application.yml", spring("${MY_PASSWORD}"), "test-password", "hunter2"},
-		{"a ${VAR}'s default", "application.yml", spring("${MY_PASSWORD:test-password}"), "", "hunter2"},
-		{"properties", "application-local.properties", "jasypt.encryptor.password=test-password\napp.token=" + jasyptHunter2 + "\n", "", "hunter2"},
-		{"env file", ".env", "JASYPT_ENCRYPTOR_PASSWORD=test-password\nTOKEN=" + jasyptHunter2 + "\n", "", "hunter2"},
-		{"not jasypt", ".env", "TOKEN=hunter2\n", "", "hunter2"},
-	} {
-		t.Setenv("MY_PASSWORD", c.env)
-		if got, err := value(c.file, c.body); err != nil || got != c.want {
-			t.Errorf("%s: %q %v", c.name, got, err)
-		}
-	}
-
-	// $JASYPT_ENCRYPTOR_PASSWORD wins over the file's, as in Spring.
-	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "test-password")
-	if got, err := value("application.yml", spring("wrong")); err != nil || got != "hunter2" {
-		t.Errorf("environment first: %q %v", got, err)
-	}
-	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "wrong")
-	if _, err := value("application.yml", spring("test-password")); err == nil || !strings.Contains(err.Error(), "the password from $JASYPT_ENCRYPTOR_PASSWORD") {
-		t.Errorf("a wrong one says where it's from: %v", err)
-	}
-
-	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "")
-	t.Setenv("MY_PASSWORD", "")
-	for body, want := range map[string]string{
-		spring("${MY_PASSWORD}"):      "$MY_PASSWORD isn't set",
-		"app.token: " + jasyptHunter2: "set $JASYPT_ENCRYPTOR_PASSWORD, or jasypt.encryptor.password in application.yml",
-	} {
-		if _, err := value("application.yml", body); err == nil || !strings.Contains(err.Error(), want) {
-			t.Errorf("no password: %v, want %q", err, want)
-		}
-	}
-}
-
-func TestJasyptEnvFile(t *testing.T) {
-	root := gitRepo(t, map[string]string{
-		"jasypt.env": "TOKEN=" + jasyptHunter2 + "\n",
-		"mixed.env":  "TOKEN=" + jasyptHunter2 + "\nURL=https://example.com\n",
-	})
-	ctx := context.Background()
-	p := New(Settings{Dir: root})
-	srcs, _ := p.Sources(ctx)
-	cs, _ := p.Containers(ctx, srcs[0])
-	for _, c := range cs {
-		attrs, _ := p.Details(ctx, c)
-		got := map[string]provider.Attr{}
-		for _, a := range attrs {
-			got[a.Label] = a
-		}
-		switch c.Name {
-		case "jasypt.env":
-			if got["encryption"].Value != "jasypt: 1 of 1 values" || got["git"].Warn {
-				t.Errorf("all jasypt: %+v", got)
-			}
-			keys, _ := p.Objects(ctx, c, provider.TypeSecret)
-			if len(keys) != 1 || keys[0].Attrs[1].Value != "jasypt" || keys[0].Detail != "jasypt" {
-				t.Errorf("keys: %+v", keys)
-			}
-		case "mixed.env":
-			if got["encryption"].Value != "jasypt: 1 of 2 values" || !got["git"].Warn {
-				t.Errorf("mixed: %+v", got)
-			}
-		}
-	}
-}

internal/provider/repo/repo.go

@@ -1,7 +1,6 @@
 // Package repo browses the encrypted secret files in git repositories:
 // a repo is a source, its secret files the containers (vault level), and
-// their keys the secrets. Secret files are SOPS files, plain env files and
-// Spring Boot config (spring.go).
+// their keys the secrets. Secret files are SOPS files and plain env files.
 //
 // Listing never decrypts: SOPS encrypts values only, so a file's keys and
 // metadata are read directly. A value is decrypted when it's revealed or
@@ -32,7 +31,6 @@ import (
 
 	"go.yaml.in/yaml/v3"
 
-	"git.kebcloud.no/keb/lazysecrets/internal/jasypt"
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 )
 
@@ -51,9 +49,6 @@ type Settings struct {
 	// Include and Exclude are globs relative to a repo's root (** matches
 	// any depth), for repos without their own .lazysecrets.yaml.
 	Include, Exclude []string
-	// Spring says which keys of Spring Boot config files are secrets, for
-	// repos whose .lazysecrets.yaml doesn't.
-	Spring SpringPatterns
 	// Sops is the sops binary; "sops" (on PATH) when empty.
 	Sops string
 }
@@ -325,8 +320,6 @@ func (p *Provider) Containers(ctx context.Context, src provider.Source) ([]provi
 			return // a SOPS file where .sops.yaml says SOPS files don't go
 		case IsEnv(f):
 			c.Detail = provider.DetailPlainEnv
-		case IsSpring(f):
-			c.Detail = "spring · " + springFormat(f)
 		default:
 			return
 		}
@@ -364,9 +357,6 @@ func (p *Provider) Objects(_ context.Context, c provider.Container, t provider.O
 		return nil, err
 	}
 	meta, isSops := parseMeta(c.ID, b)
-	if !isSops && IsSpring(c.ID) {
-		return p.springObjects(c, b)
-	}
 	keys, err := parseKeys(c.ID, b)
 	if err != nil {
 		return nil, fmt.Errorf("%s: %w", c.Name, err)
@@ -381,11 +371,8 @@ func (p *Provider) Objects(_ context.Context, c provider.Container, t provider.O
 			Container: c, Type: provider.TypeSecret,
 			ID: c.ID + "\x00" + k.extract, Name: k.name, Updated: meta.modified, Attrs: attrs,
 		}
-		switch {
-		case isSops && !k.encrypted:
+		if isSops && !k.encrypted {
 			o.Attrs = append(slices.Clip(attrs), provider.Attr{Label: "encrypted", Value: "no (left in plain text by the file's sops rules)"})
-		case !isSops && k.jasypt:
-			o.Attrs, o.Detail = []provider.Attr{attrs[0], {Label: "encrypted", Value: "jasypt"}}, "jasypt"
 		}
 		out = append(out, o)
 	}
@@ -400,29 +387,15 @@ func (p *Provider) Versions(context.Context, provider.Object) ([]provider.Object
 	return nil, provider.ErrUnsupported
 }
 
-// Value reads one key: from a plain file, decrypting a Jasypt value; from
-// a SOPS file, with sops.
+// Value decrypts one key with sops.
 func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.SecretValue, error) {
 	file, extract, ok := strings.Cut(o.ID, "\x00")
 	if !ok { // made from a link: the repo's root, the file's path, the key
 		file = filePath(o.Container)
+		extract = extractFor(file, o.Name)
 	}
 	if _, isSops := readMeta(file); !isSops {
-		read := plainValue
-		if IsSpring(file) {
-			read = springValue
-		}
-		v, err := read(file, o.Name)
-		if err != nil {
-			return v, err
-		}
-		return jasyptValue(file, v)
-	}
-	if !ok {
-		var err error
-		if extract, err = extractOf(file, o.Name); err != nil {
-			return provider.SecretValue{}, err
-		}
+		return plainValue(file, o.Name)
 	}
 	cmd := exec.CommandContext(ctx, p.s.Sops, "decrypt", "--extract", extract, file)
 	cmd.Dir = filepath.Dir(file) // sops looks for .sops.yaml from here
@@ -465,12 +438,6 @@ func (p *Provider) File(c provider.Container, o *provider.Object) (provider.File
 	if o == nil {
 		return f, nil
 	}
-	if f.Sops == "" && IsSpring(path) {
-		if k, err := springKeyNamed(path, o.Name); err == nil {
-			f.Line = k.line
-		}
-		return f, nil
-	}
 	b, err := os.ReadFile(path)
 	if err != nil {
 		return f, err
@@ -622,9 +589,8 @@ func normalizeRemote(remote string) (string, string) {
 
 // lazysecretsFile is a repo's own .lazysecrets.yaml.
 type lazysecretsFile struct {
-	Include []string       `yaml:"include"`
-	Exclude []string       `yaml:"exclude"`
-	Spring  SpringPatterns `yaml:"spring"`
+	Include []string `yaml:"include"`
+	Exclude []string `yaml:"exclude"`
 	Sharing struct {
 		// Key is the link to the secret that encrypts the repo's
 		// shared env files (package share).
@@ -1055,8 +1021,7 @@ type key struct {
 	name      string // db.password, list[0], with . [ ] \ in keys escaped
 	extract   string // sops --extract: ["db"]["password"]
 	encrypted bool
-	jasypt    bool // a plain env file's ENC(...) value
-	line      int  // 1-based
+	line      int // 1-based
 }
 
 // parseKeys lists a sops file's keys without decrypting anything.
@@ -1080,8 +1045,7 @@ func parseKeys(file string, b []byte) ([]key, error) {
 			if !ok || strings.HasPrefix(k, "sops_") {
 				continue
 			}
-			sopsKey, _, _ := strings.Cut(line, "=") // sops keeps export and spaces in the key
-			out = append(out, key{name: k, extract: quote(sopsKey), encrypted: strings.HasPrefix(v, "ENC["), jasypt: jasypt.Is(v), line: i + 1})
+			out = append(out, key{name: k, extract: quote(k), encrypted: strings.HasPrefix(v, "ENC["), line: i + 1})
 		}
 		return out, nil
 	case "ini":
@@ -1146,23 +1110,48 @@ func escape(k string) string {
 	return strings.NewReplacer(`\`, `\\`, `.`, `\.`, `[`, `\[`, `]`, `\]`).Replace(k)
 }
 
-// extractOf is the sops --extract path of the key named name, for objects
-// made from a link.
-func extractOf(file, name string) (string, error) {
-	b, err := os.ReadFile(file)
-	if err != nil {
-		return "", err
+// extractFor rebuilds the extract path from a key name, for objects made
+// from a link (db.password, list[0], app\.name). A dotenv file is flat:
+// its names are the keys as they are.
+func extractFor(file, name string) string {
+	if formatOf(file) == "dotenv" {
+		return quote(name)
 	}
-	keys, err := parseKeys(file, b)
-	if err != nil {
-		return "", err
-	}
-	for _, k := range keys {
-		if k.name == name {
-			return k.extract, nil
+	var b, part strings.Builder
+	flush := func() {
+		if part.Len() > 0 {
+			b.WriteString(quote(part.String()))
+			part.Reset()
 		}
 	}
-	return "", fmt.Errorf("%s isn't in %s", name, filepath.Base(file))
+	for i := 0; i < len(name); i++ {
+		switch c := name[i]; c {
+		case '\\':
+			if i+1 < len(name) {
+				i++
+			}
+			part.WriteByte(name[i])
+		case '.':
+			flush()
+		case '[':
+			end := strings.IndexByte(name[i:], ']')
+			if end < 0 || !digits(name[i+1:i+end]) {
+				part.WriteByte(c)
+				continue
+			}
+			flush()
+			b.WriteString(name[i : i+end+1])
+			i += end
+		default:
+			part.WriteByte(c)
+		}
+	}
+	flush()
+	return b.String()
+}
+
+func digits(s string) bool {
+	return s != "" && strings.Trim(s, "0123456789") == ""
 }
 
 func absPath(p string) string {

internal/provider/repo/repo_test.go

@@ -237,25 +237,6 @@ func TestDecrypt(t *testing.T) {
 		t.Errorf("from a link: %q %v", v.Reveal(), err)
 	}
 
-	// A dotenv file's export lines: sops keeps export in the key.
-	os.WriteFile(plain, []byte("export TOKEN=s3cret\n"), 0o600)
-	enc, err = exec.Command("sops", "encrypt", "--age", recipient, "--input-type", "dotenv", "--output-type", "dotenv", plain).Output()
-	if err != nil {
-		t.Fatal(err)
-	}
-	envFile := filepath.Join(root, "prod.env")
-	os.WriteFile(envFile, enc, 0o600)
-	envC := provider.Container{Source: srcs[0], ID: envFile, Name: "prod.env"}
-	envKeys, _ := p.Objects(ctx, envC, provider.TypeSecret)
-	if len(envKeys) != 1 {
-		t.Fatalf("env keys: %v", envKeys)
-	}
-	for _, o := range []provider.Object{envKeys[0], {Container: provider.Container{Source: srcs[0], Name: "prod.env"}, Name: "TOKEN"}} {
-		if v, err := p.Value(ctx, o); err != nil || v.Reveal() != "s3cret" {
-			t.Errorf("export line (link: %t): %q %v", o.ID == "", v.Reveal(), err)
-		}
-	}
-
 	// Without the key: sops' own error.
 	t.Setenv("SOPS_AGE_KEY_FILE", filepath.Join(dir, "missing.txt"))
 	if _, err := p.Value(ctx, keys[0]); err == nil || !strings.Contains(err.Error(), "no identity matched any of the recipients") {
@@ -573,22 +554,15 @@ func TestKeyNamesEscaped(t *testing.T) {
 	var got []string
 	for _, k := range keys {
 		got = append(got, k.name+" "+k.extract)
+		if e := extractFor("s.yaml", k.name); e != k.extract {
+			t.Errorf("extractFor(%q) = %s, want %s", k.name, e, k.extract)
+		}
 	}
 	want := `app\.name ["app.name"]|db.password ["db"]["password"]|list[0] ["list"][0]|list[1] ["list"][1]|odd\[1\] ["odd[1]"]`
 	if strings.Join(got, "|") != want {
 		t.Errorf("keys = %s\nwant   %s", strings.Join(got, "|"), want)
 	}
-
-	keys, err = parseKeys(".env", []byte("spring.url=a\nexport TOKEN=b\nSPACED = c\n"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	got = nil
-	for _, k := range keys {
-		got = append(got, k.name+" "+k.extract)
-	}
-	want = `spring.url ["spring.url"]|TOKEN ["export TOKEN"]|SPACED ["SPACED "]`
-	if strings.Join(got, "|") != want {
-		t.Errorf("dotenv keys = %s\nwant   %s", strings.Join(got, "|"), want)
+	if e := extractFor(".env", "spring.url"); e != `["spring.url"]` {
+		t.Errorf("dotenv: %s", e)
 	}
 }

internal/provider/repo/spring.go

@@ -1,411 +0,0 @@
-package repo
-
-import (
-	"bytes"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"path"
-	"path/filepath"
-	"regexp"
-	"strconv"
-	"strings"
-	"unicode"
-
-	"go.yaml.in/yaml/v3"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/jasypt"
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-)
-
-// Spring Boot config files (application*.properties/.yml, bootstrap*) hold
-// all of an app's config, most of it not secret: of their keys, only those
-// named like a secret or with a value that looks like one are listed. The
-// patterns are configurable, and the file's details count the rest, so a
-// secret the patterns miss isn't hidden without a trace.
-
-// DefaultSpringKeys and DefaultSpringValues are the patterns used when
-// neither the config nor the repo's .lazysecrets.yaml sets them. The key
-// pattern is anchored at the end of the name: spring.datasource.password,
-// client-secret and checkoutKey, not the oauth2.*, keycloak.* and
-// token-uri keys every Spring app has. passord is Norwegian. The file's
-// details count the keys left out.
-var (
-	DefaultSpringKeys = []string{
-		`(?i)(pass(word|wd|phrase|ord)?|pwd|secret|token|key|credentials?|salt|connection-?string)$`,
-	}
-	DefaultSpringValues = []string{
-		`^ENC\(.+\)$`,            // Jasypt
-		`://[^/\s:@]*:[^/\s@]+@`, // a URL with a password: jdbc:postgresql://user:pass@host
-		`(?i)(AccountKey|SharedAccessKey|Password|Pwd)=`, // a connection string with one
-	}
-)
-
-// SpringPatterns are regexps matched against a Spring config key's name
-// and its value: a key is listed when either matches. A list that isn't
-// set is DefaultSpringKeys or DefaultSpringValues.
-type SpringPatterns struct {
-	Keys   *[]string `yaml:"keys"`
-	Values *[]string `yaml:"values"`
-}
-
-// Check says which pattern doesn't compile.
-func (p SpringPatterns) Check() error {
-	_, err := compileSpring(p)
-	return err
-}
-
-type springFilter struct{ keys, values []*regexp.Regexp }
-
-func compileSpring(p SpringPatterns) (springFilter, error) {
-	var f springFilter
-	var errs []error
-	add := func(field string, patterns *[]string, defaults []string, out *[]*regexp.Regexp) {
-		list := defaults
-		if patterns != nil {
-			list = *patterns
-		}
-		for i, s := range list {
-			re, err := regexp.Compile(s)
-			if err != nil {
-				errs = append(errs, fmt.Errorf("spring.%s[%d]: %w", field, i, err))
-				continue
-			}
-			*out = append(*out, re)
-		}
-	}
-	add("keys", p.Keys, DefaultSpringKeys, &f.keys)
-	add("values", p.Values, DefaultSpringValues, &f.values)
-	return f, errors.Join(errs...)
-}
-
-func (f springFilter) secret(k springKey) bool {
-	return anyMatch(f.keys, k.key) || anyMatch(f.values, k.value)
-}
-
-// springFilterFor is the repo's patterns: its .lazysecrets.yaml's, else the
-// config's, each list on its own.
-func (p *Provider) springFilterFor(root string) (springFilter, error) {
-	f, err := readLazysecretsFile(root)
-	if err != nil {
-		return springFilter{}, err
-	}
-	patterns := p.s.Spring
-	if f.Spring.Keys != nil {
-		patterns.Keys = f.Spring.Keys
-	}
-	if f.Spring.Values != nil {
-		patterns.Values = f.Spring.Values
-	}
-	filter, err := compileSpring(patterns)
-	if err != nil && (f.Spring.Keys != nil || f.Spring.Values != nil) {
-		err = fmt.Errorf("%s/.lazysecrets.yaml: %w", root, err)
-	}
-	return filter, err
-}
-
-// springName is application.yml, application-prod.properties, bootstrap.yaml
-// and the like; not applications.yaml (Argo CD's) or application.yml.example.
-var springName = regexp.MustCompile(`^(application|bootstrap)(-[^.]+)?\.(properties|ya?ml)$`)
-
-// IsSpring reports whether f is named like a Spring Boot config file, and
-// isn't a Helm chart's template of one.
-func IsSpring(f string) bool {
-	return springName.MatchString(strings.ToLower(path.Base(f))) && path.Base(path.Dir(f)) != "templates"
-}
-
-func springFormat(f string) string {
-	if strings.ToLower(filepath.Ext(f)) == ".properties" {
-		return "properties"
-	}
-	return "yaml"
-}
-
-type springKey struct {
-	key   string // spring.datasource.password
-	name  string // key, with (profile) after it in a later document
-	value string
-	line  int // 1-based
-}
-
-// reference reports whether the value is only a placeholder, ${DB_PASSWORD}:
-// the secret is elsewhere. One with a default, ${DB_PASSWORD:hunter2}, has
-// the default in the file.
-func (k springKey) reference() bool {
-	return strings.HasPrefix(k.value, "${") && strings.HasSuffix(k.value, "}") &&
-		!strings.ContainsAny(k.value[2:len(k.value)-1], ":${}")
-}
-
-func (k springKey) jasypt() bool {
-	return jasypt.Is(k.value)
-}
-
-// plain reports whether the file holds the value itself, readable.
-func (k springKey) plain() bool {
-	return k.value != "" && !k.reference() && !k.jasypt()
-}
-
-// readSpring lists a Spring config file's keys, every one, with values.
-func readSpring(file string) ([]springKey, error) {
-	b, err := os.ReadFile(file)
-	if err != nil {
-		return nil, err
-	}
-	return parseSpring(file, b)
-}
-
-func parseSpring(file string, b []byte) ([]springKey, error) {
-	if springFormat(file) == "properties" {
-		return parseProperties(b), nil
-	}
-	return parseSpringYAML(b)
-}
-
-// springDocs names the keys of a multi-document file's later documents
-// after the profile they're for, so each name is one key:
-// spring.datasource.password (prod).
-func springDocs(docs [][]springKey) []springKey {
-	var out []springKey
-	for i, doc := range docs {
-		suffix := ""
-		if i > 0 {
-			suffix = fmt.Sprintf(" (document %d)", i+1)
-			for _, k := range doc {
-				if k.key == "spring.config.activate.on-profile" || k.key == "spring.profiles" {
-					suffix = " (" + k.value + ")"
-				}
-			}
-		}
-		for _, k := range doc {
-			k.name = k.key + suffix
-			out = append(out, k)
-		}
-	}
-	return out
-}
-
-// mavenFiltered is a value Maven fills in at build time, @project.version@:
-// not YAML until it's quoted.
-var mavenFiltered = regexp.MustCompile(`(?m)(:[ \t]+|^[ \t]*-[ \t]+)(@[^\n]*?)[ \t]*$`)
-
-func parseSpringYAML(b []byte) ([]springKey, error) {
-	b = mavenFiltered.ReplaceAllFunc(b, func(m []byte) []byte {
-		sub := mavenFiltered.FindSubmatch(m)
-		return fmt.Appendf(nil, "%s'%s'", sub[1], bytes.ReplaceAll(sub[2], []byte("'"), []byte("''")))
-	})
-	dec := yaml.NewDecoder(bytes.NewReader(b))
-	var docs [][]springKey
-	for {
-		var doc yaml.Node
-		err := dec.Decode(&doc)
-		if errors.Is(err, io.EOF) {
-			break
-		}
-		if err != nil {
-			return nil, err
-		}
-		var keys []springKey
-		if len(doc.Content) > 0 {
-			springWalk(doc.Content[0], "", &keys)
-		}
-		docs = append(docs, keys)
-	}
-	return springDocs(docs), nil
-}
-
-// springWalk names keys the way Spring does: nested keys joined by dots,
-// list items by index (servers[0]).
-func springWalk(n *yaml.Node, name string, out *[]springKey) {
-	switch n.Kind {
-	case yaml.MappingNode:
-		for i := 0; i+1 < len(n.Content); i += 2 {
-			child := n.Content[i].Value
-			if name != "" {
-				child = name + "." + child
-			}
-			springWalk(n.Content[i+1], child, out)
-		}
-	case yaml.SequenceNode:
-		for i, c := range n.Content {
-			springWalk(c, fmt.Sprintf("%s[%d]", name, i), out)
-		}
-	case yaml.AliasNode:
-		if n.Alias != nil {
-			springWalk(n.Alias, name, out)
-		}
-	case yaml.ScalarNode:
-		if name != "" {
-			*out = append(*out, springKey{key: name, value: n.Value, line: n.Line})
-		}
-	}
-}
-
-// parseProperties reads a Java .properties file: key=value, key: value or
-// key value, lines continued with a trailing backslash, # and ! comments,
-// and #--- between documents (Spring Boot 2.4+).
-func parseProperties(b []byte) []springKey {
-	lines := strings.Split(strings.ReplaceAll(string(b), "\r\n", "\n"), "\n")
-	var docs [][]springKey
-	var doc []springKey
-	for i := 0; i < len(lines); i++ {
-		start := i + 1
-		line := strings.TrimLeftFunc(lines[i], unicode.IsSpace)
-		if line == "#---" || line == "!---" {
-			docs, doc = append(docs, doc), nil
-			continue
-		}
-		if line == "" || line[0] == '#' || line[0] == '!' {
-			continue
-		}
-		for continued(line) && i+1 < len(lines) {
-			i++
-			line = line[:len(line)-1] + strings.TrimLeftFunc(lines[i], unicode.IsSpace)
-		}
-		k, v := splitProperty(line)
-		doc = append(doc, springKey{key: unescapeProperty(k), value: unescapeProperty(v), line: start})
-	}
-	return springDocs(append(docs, doc))
-}
-
-// continued reports whether the line ends in an odd number of backslashes.
-func continued(line string) bool {
-	n := len(line) - len(strings.TrimRight(line, `\`))
-	return n%2 == 1
-}
-
-// splitProperty cuts a logical line at its first unescaped =, : or
-// whitespace; whitespace around the separator isn't part of either side.
-func splitProperty(line string) (key, value string) {
-	const space = " \t\f"
-	for i := 0; i < len(line); i++ {
-		switch c := line[i]; {
-		case c == '\\':
-			i++
-		case c == '=' || c == ':':
-			return line[:i], strings.TrimLeft(line[i+1:], space)
-		case strings.IndexByte(space, c) >= 0:
-			rest := strings.TrimLeft(line[i:], space)
-			if rest != "" && (rest[0] == '=' || rest[0] == ':') {
-				rest = strings.TrimLeft(rest[1:], space)
-			}
-			return line[:i], rest
-		}
-	}
-	return line, ""
-}
-
-func unescapeProperty(s string) string {
-	if !strings.Contains(s, `\`) {
-		return s
-	}
-	var b strings.Builder
-	for i := 0; i < len(s); i++ {
-		if s[i] != '\\' || i+1 == len(s) {
-			b.WriteByte(s[i])
-			continue
-		}
-		i++
-		switch s[i] {
-		case 't':
-			b.WriteByte('\t')
-		case 'n':
-			b.WriteByte('\n')
-		case 'r':
-			b.WriteByte('\r')
-		case 'f':
-			b.WriteByte('\f')
-		case 'u':
-			if i+5 <= len(s) {
-				if r, err := strconv.ParseUint(s[i+1:i+5], 16, 32); err == nil {
-					b.WriteRune(rune(r))
-					i += 4
-					continue
-				}
-			}
-			b.WriteByte('u')
-		default:
-			b.WriteByte(s[i])
-		}
-	}
-	return b.String()
-}
-
-// springObjects lists the file's secret keys.
-func (p *Provider) springObjects(c provider.Container, b []byte) ([]provider.Object, error) {
-	keys, err := parseSpring(c.ID, b)
-	if err != nil {
-		return nil, fmt.Errorf("%s: %w", c.Name, err)
-	}
-	filter, err := p.springFilterFor(c.Source.ID)
-	if err != nil {
-		return nil, err
-	}
-	format := provider.Attr{Label: "format", Value: "spring " + springFormat(c.ID)}
-	var out []provider.Object
-	for _, k := range keys {
-		if !filter.secret(k) {
-			continue
-		}
-		state, detail := provider.Attr{Label: "encrypted", Value: "no: plain text in the file"}, ""
-		switch {
-		case k.reference():
-			state, detail = provider.Attr{Label: "value", Value: "a reference: the secret is set elsewhere"}, "reference"
-		case k.jasypt():
-			state, detail = provider.Attr{Label: "encrypted", Value: "jasypt"}, "jasypt"
-		}
-		out = append(out, provider.Object{
-			Container: c, Type: provider.TypeSecret, ID: c.ID + "\x00" + k.name, Name: k.name, Detail: detail,
-			Attrs: []provider.Attr{format, state},
-		})
-	}
-	return out, nil
-}
-
-func springValue(file, name string) (provider.SecretValue, error) {
-	k, err := springKeyNamed(file, name)
-	if err != nil {
-		return provider.SecretValue{}, err
-	}
-	return provider.NewSecretValue([]byte(k.value)), nil
-}
-
-func springKeyNamed(file, name string) (springKey, error) {
-	keys, err := readSpring(file)
-	if err != nil {
-		return springKey{}, err
-	}
-	for _, k := range keys {
-		if k.name == name {
-			return k, nil
-		}
-	}
-	return springKey{}, fmt.Errorf("%s isn't in %s", name, filepath.Base(file))
-}
-
-// springDetails says how many of the file's keys aren't listed, and
-// whether any listed one is in plain text.
-func (p *Provider) springDetails(c provider.Container) (attrs []provider.Attr, plain bool) {
-	keys, err := readSpring(c.ID)
-	if err != nil {
-		return []provider.Attr{{Label: "keys", Value: err.Error(), Warn: true}}, false
-	}
-	filter, err := p.springFilterFor(c.Source.ID)
-	if err != nil {
-		return []provider.Attr{{Label: "keys", Value: err.Error(), Warn: true}}, false
-	}
-	secrets, jasypt := 0, 0
-	for _, k := range keys {
-		if filter.secret(k) {
-			secrets++
-			plain = plain || k.plain()
-		}
-		if k.jasypt() {
-			jasypt++
-		}
-	}
-	return []provider.Attr{
-		{Label: "encryption", Value: jasyptShare(jasypt, len(keys))},
-		{Label: "other keys", Value: fmt.Sprintf("%d, not matched by the secret patterns", len(keys)-secrets)},
-	}, plain
-}

internal/provider/repo/spring_test.go

@@ -1,223 +0,0 @@
-package repo
-
-import (
-	"context"
-	"maps"
-	"os"
-	"path/filepath"
-	"slices"
-	"strings"
-	"testing"
-
-	"git.kebcloud.no/keb/lazysecrets/internal/provider"
-)
-
-func TestIsSpring(t *testing.T) {
-	for f, want := range map[string]bool{
-		"src/main/resources/application.yml":        true,
-		"application-prod.properties":               true,
-		"config/application-local.yaml":             true,
-		"bootstrap.yml":                             true,
-		"applicationset/dev/applications.yaml":      false, // Argo CD's
-		"chart/templates/application.yaml":          false, // Helm's
-		"application.yml.example":                   false,
-		"application.json":                          false,
-		"src/main/resources/applicationContext.xml": false,
-	} {
-		if IsSpring(f) != want {
-			t.Errorf("%s: %t", f, !want)
-		}
-	}
-}
-
-func springNames(keys []springKey) map[string]string {
-	out := map[string]string{}
-	for _, k := range keys {
-		out[k.name] = k.value
-	}
-	return out
-}
-
-func TestParseProperties(t *testing.T) {
-	got := springNames(parseProperties([]byte(`# a comment
-! another
-a=1
-b : 2
-c 3
-d\:e=4
-long=one, \
-     two
-unicode=café
-empty=
-#---
-spring.config.activate.on-profile=prod
-a=prod-1
-`)))
-	want := map[string]string{
-		"a": "1", "b": "2", "c": "3", "d:e": "4", "long": "one, two", "unicode": "café", "empty": "",
-		"spring.config.activate.on-profile (prod)": "prod", "a (prod)": "prod-1",
-	}
-	if !maps.Equal(got, want) {
-		t.Errorf("got  %v\nwant %v", got, want)
-	}
-}
-
-func TestParseSpringYAML(t *testing.T) {
-	keys, err := parseSpringYAML([]byte(`info.version: @project.version@
-artifacts:
-  - @project.artifactId@
-spring:
-  datasource:
-    password: ${DB_PASSWORD}
-servers:
-  - name: a
-    secret: x
-logging.level:
-  com.example: DEBUG
----
-spring:
-  config.activate.on-profile: prod
-  datasource:
-    password: hunter2
----
-other: y
-`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	want := map[string]string{
-		"info.version": "@project.version@", "artifacts[0]": "@project.artifactId@",
-		"spring.datasource.password": "${DB_PASSWORD}", "servers[0].name": "a", "servers[0].secret": "x",
-		"logging.level.com.example":                "DEBUG",
-		"spring.config.activate.on-profile (prod)": "prod", "spring.datasource.password (prod)": "hunter2",
-		"other (document 3)": "y",
-	}
-	if got := springNames(keys); !maps.Equal(got, want) {
-		t.Errorf("got  %v\nwant %v", got, want)
-	}
-}
-
-func TestSpringDefaults(t *testing.T) {
-	f, err := compileSpring(SpringPatterns{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for key, value := range map[string]string{
-		"spring.datasource.password":                                 "x",
-		"spring.security.oauth2.client.registration.a.client-secret": "x",
-		"profapp.payment.checkoutKey":                                "x",
-		"app.clients.sgig.sgig-passord":                              "x",
-		"jasypt.encryptor.password":                                  "${JASYPT_ENCRYPTOR_PASSWORD}",
-		"spring.datasource.url":                                      "jdbc:postgresql://app:hunter2@db:5432/app",
-		"app.servicebus.connection":                                  "Endpoint=sb://x/;SharedAccessKeyName=a;SharedAccessKey=b",
-		"app.name":                                                   "ENC(abc==)",
-	} {
-		if !f.secret(springKey{key: key, value: value}) {
-			t.Errorf("%s=%s isn't listed", key, value)
-		}
-	}
-	for key, value := range map[string]string{
-		"spring.security.oauth2.client.provider.a.token-uri":                    "https://idp/token",
-		"spring.security.oauth2.client.registration.a.authorization-grant-type": "client_credentials",
-		"app.frontend.keycloak.url":                                             "https://keycloak",
-		"server.port":                                                           "8080",
-		"spring.datasource.url":                                                 "jdbc:postgresql://db:5432/app",
-	} {
-		if f.secret(springKey{key: key, value: value}) {
-			t.Errorf("%s=%s is listed", key, value)
-		}
-	}
-}
-
-func TestSpringFiles(t *testing.T) {
-	root := gitRepo(t, map[string]string{
-		"src/main/resources/application.yml": `server:
-  port: 8080
-spring:
-  datasource:
-    url: jdbc:postgresql://db/app
-    password: ${DB_PASSWORD}
-jasypt:
-  encryptor:
-    password: ${JASYPT_ENCRYPTOR_PASSWORD}
-app:
-  api-key: ENC(5IQUKT4B7j38TnZJ+BlWqo/zSkKHTjl4XRJyaQEHgkCy4r00avLt4dWqFB74X0Zw)
-`,
-		"src/main/resources/application-local.properties": "server.port=8081\nspring.datasource.password=hunter2\n",
-		"applicationset/applications.yaml":                "kind: ApplicationSet\n",
-	})
-	ctx := context.Background()
-	details := func(p *Provider, c provider.Container) map[string]provider.Attr {
-		attrs, err := p.Details(ctx, c)
-		if err != nil {
-			t.Fatal(err)
-		}
-		out := map[string]provider.Attr{}
-		for _, a := range attrs {
-			out[a.Label] = a
-		}
-		return out
-	}
-
-	p := New(Settings{Dir: root})
-	srcs, _ := p.Sources(ctx)
-	cs, err := p.Containers(ctx, srcs[0])
-	if err != nil {
-		t.Fatal(err)
-	}
-	var files []string
-	for _, c := range cs {
-		files = append(files, c.Name+" · "+c.Detail)
-	}
-	if want := []string{
-		"src/main/resources/application-local.properties · spring · properties",
-		"src/main/resources/application.yml · spring · yaml",
-	}; !slices.Equal(files, want) {
-		t.Fatalf("files %v\nwant  %v", files, want)
-	}
-	local, yml := cs[0], cs[1]
-
-	keys, _ := p.Objects(ctx, yml, provider.TypeSecret)
-	var names []string
-	for _, k := range keys {
-		names = append(names, strings.TrimSpace(k.Name+" "+k.Detail))
-	}
-	if want := []string{"spring.datasource.password reference", "jasypt.encryptor.password reference", "app.api-key jasypt"}; !slices.Equal(names, want) {
-		t.Errorf("keys %v, want %v", names, want)
-	}
-	t.Setenv("JASYPT_ENCRYPTOR_PASSWORD", "test-password")
-	if v, err := p.Value(ctx, keys[2]); err != nil || v.Reveal() != "hunter2" {
-		t.Errorf("value: %q %v", v.Reveal(), err)
-	}
-	link := provider.Object{Container: provider.Container{Source: srcs[0], Name: "src/main/resources/application.yml"}, Name: "spring.datasource.password"}
-	if v, err := p.Value(ctx, link); err != nil || v.Reveal() != "${DB_PASSWORD}" {
-		t.Errorf("from a link: %q %v", v.Reveal(), err)
-	}
-	if f, _ := p.File(yml, &keys[1]); f.Line != 9 || f.Sops != "" {
-		t.Errorf("file: %+v", f)
-	}
-
-	// References and Jasypt aren't plain text in git; a password is.
-	if d := details(p, yml); d["other keys"].Value != "2, not matched by the secret patterns" || d["git"].Warn || d["encryption"].Value != "jasypt: 1 of 5 values" {
-		t.Errorf("yml: %+v", d)
-	}
-	if d := details(p, local); !d["git"].Warn {
-		t.Errorf("local: %+v", d)
-	}
-
-	// The config's patterns, and the repo's over them.
-	all := []string{".*"}
-	p = New(Settings{Dir: root, Spring: SpringPatterns{Keys: &all}})
-	if keys, _ := p.Objects(ctx, yml, provider.TypeSecret); len(keys) != 5 {
-		t.Errorf("every key: %d", len(keys))
-	}
-	lazysecrets := filepath.Join(root, ".lazysecrets.yaml")
-	os.WriteFile(lazysecrets, []byte("spring:\n  keys: [\"url$\"]\n  values: []\n"), 0o644)
-	if keys, _ := p.Objects(ctx, yml, provider.TypeSecret); len(keys) != 1 || keys[0].Name != "spring.datasource.url" {
-		t.Errorf("repo's patterns: %v", keys)
-	}
-	os.WriteFile(lazysecrets, []byte("spring:\n  keys: [\"(\"]\n"), 0o644)
-	if _, err := p.Objects(ctx, yml, provider.TypeSecret); err == nil || !strings.Contains(err.Error(), ".lazysecrets.yaml: spring.keys[0]") {
-		t.Errorf("bad pattern: %v", err)
-	}
-}

internal/ui/app/favourites.go

@@ -101,14 +101,11 @@ func (m Model) containerRender(withSource bool) func(styles.Styles, provider.Con
 		n := st.Node(storeKey(c))
 		line := c.Name
 		if c.Source.Kind == provider.KindRepo {
-			// A secret file: a lock for an encrypted one, a leaf
-			// for Spring config, a file in the warning colour for plain
-			// text, and its type after it ("sops · age", "env · plain text").
+			// A secret file: a lock for an encrypted one, a file in the
+			// warning colour for plain text, and its type after it
+			// ("sops · age", "env · plain text").
 			icon, style := iconSet.Encrypted, sty.KindRepo
-			switch {
-			case strings.HasPrefix(c.Detail, "spring"):
-				icon, style = iconSet.Spring, sty.Spring
-			case !strings.HasPrefix(c.Detail, "sops"):
+			if !strings.HasPrefix(c.Detail, "sops") {
 				icon, style = iconSet.PlainFile, sty.Warning
 			}
 			if icon != "" {
@@ -137,9 +134,6 @@ func (m Model) objectRender() func(styles.Styles, provider.Object, int) string {
 			line = sty.Muted.Render(o.Name + " (disabled)")
 		}
 		line = marks(sty, n, o.Container.Source.Provider, m.recentIcon, m.now()) + line
-		if o.Detail != "" {
-			line += sty.Muted.Render("  " + o.Detail)
-		}
 		switch state, left := m.expiry(o); state {
 		case expiry.Expired:
 			line += " " + sty.Error.Render("✗ expired")

internal/ui/app/jump.go

@@ -38,13 +38,11 @@ func (m *Model) storeEntries() (favs, recent []option) {
 			return nil
 		}
 		var out []entry
-		detail := m.objectDetail(key)
 		add := func(path []string, acct string, depth int, run func(*Model) tea.Cmd) {
 			account := ""
 			if p, ok := m.byID[acct]; ok {
 				account = accountOf(provider.Source{Kind: p.Kind(), ProviderLabel: p.Label()})
 			}
-			account = strings.Trim(detail+" · "+account, " ·")
 			sort := strings.ToLower(strings.Join(path, "/")) + " " + account
 			out = append(out, entry{depth, sort, option{
 				label: m.pathLabel(r.Kind, path, account), note: n.Note, mark: " ",
@@ -159,19 +157,6 @@ func (m Model) inPlainEnv(r ref.Ref) bool {
 	return false
 }
 
-// objectDetail is the Detail of the secret with the store key key, as far
-// as the lists loaded tell.
-func (m Model) objectDetail(key string) string {
-	for _, e := range m.cache.objects {
-		for _, o := range e.value {
-			if o.Detail != "" && objectKey(o) == key {
-				return o.Detail
-			}
-		}
-	}
-	return ""
-}
-
 // repoLabel draws a repo, or a file in it, as everywhere else: the repo
 // icon and colour, "app / apps/api/.env".
 func (m Model) repoLabel(repo string, file ...string) string {

internal/ui/app/search.go

@@ -90,7 +90,7 @@ func (m *Model) searchEntries() (sources, items []option) {
 						if err != nil {
 							continue
 						}
-						suffix := strings.Trim(o.Detail+" · "+accountOf(src), " ·")
+						suffix := accountOf(src)
 						if t != provider.TypeSecret {
 							typ := strings.TrimSuffix(strings.ToLower(pluralLabels[t]), "s") // "key"
 							suffix = strings.Trim(typ+" · "+suffix, " ·")

internal/ui/icons/icons.go

@@ -11,7 +11,6 @@ type Set struct {
 	Repo       string
 	Encrypted  string // an encrypted file (SOPS)
 	PlainFile  string // a plain text secrets file (.env)
-	Spring     string // a Spring Boot config file
 	Note       string // has a note (lazysecrets list)
 }
 
@@ -26,7 +25,6 @@ var NerdFont = Set{
 	Repo:       "\U000F02A2", // md-git
 	Encrypted:  "\U000F033E", // md-lock
 	PlainFile:  "\U000F0214", // md-file
-	Spring:     "\U000F032A", // md-leaf
 	Note:       "\U000F09ED",
 }
 

internal/ui/styles/styles.go

@@ -34,7 +34,6 @@ type Styles struct {
 	KindAzure      lipgloss.Style
 	KindDatabricks lipgloss.Style
 	KindRepo       lipgloss.Style
-	Spring         lipgloss.Style // Spring Boot config files
 
 	// themed marks the selection colours as set by the theme, so
 	// OnBackground leaves them.
@@ -71,7 +70,6 @@ func Default() Styles {
 		KindAzure:      lipgloss.NewStyle().Foreground(lipgloss.Blue),
 		KindDatabricks: lipgloss.NewStyle().Foreground(lipgloss.Red),
 		KindRepo:       lipgloss.NewStyle().Foreground(lipgloss.Magenta),
-		Spring:         lipgloss.NewStyle().Foreground(lipgloss.Green),
 	}
 }
 

internal/ui/styles/theme.go

@@ -42,7 +42,6 @@ var Roles = map[string]string{
 	"azureColor":                      "Azure sources and vaults",
 	"databricksColor":                 "Databricks workspaces and scopes",
 	"repoColor":                       "repos and their secret files (SOPS)",
-	"springColor":                     "Spring Boot config files",
 }
 
 // FromTheme returns the default styles with the theme's roles applied, and
@@ -100,8 +99,6 @@ func FromTheme(theme map[string][]string) (Styles, color.Color, error) {
 			st.KindDatabricks = v.fg(lipgloss.NewStyle())
 		case "repoColor":
 			st.KindRepo = v.fg(lipgloss.NewStyle())
-		case "springColor":
-			st.Spring = v.fg(lipgloss.NewStyle())
 		}
 	}
 	return st, fg, nil