secretspec 0.17.0

use std::path::PathBuf;

pub struct FieldSpec<T> {
    pub env_key: &'static str,
    pub field: fn(&super::SopsConfig) -> &Option<T>,
    pub field_mut: fn(&mut super::SopsConfig) -> &mut Option<T>,
    pub url_key: &'static str,
}

pub struct CredentialSpec {
    pub name: &'static str,
    pub env_key: &'static str,
}

pub const AGE_KEY: &str = "age_key";
pub const AWS_SECRET_ACCESS_KEY: &str = "aws_secret_access_key";
pub const AZURE_CLIENT_SECRET: &str = "azure_client_secret";
pub const HC_VAULT_TOKEN: &str = "hc_vault_token";
pub const HUAWEI_SDK_AK: &str = "huawei_sdk_ak";
pub const HUAWEI_SDK_SK: &str = "huawei_sdk_sk";
pub const GOOGLE_OAUTH_ACCESS_TOKEN: &str = "google_oauth_access_token";

/// Secret values accepted through a provider alias's `credentials` map.
///
/// The SOPS process inherits the matching environment variables when no
/// provider credential is supplied. Injected credentials override that
/// ambient fallback for this child process only.
pub static CREDENTIAL_FIELDS: &[CredentialSpec] = &[
    CredentialSpec {
        name: AGE_KEY,
        env_key: "SOPS_AGE_KEY",
    },
    CredentialSpec {
        name: AWS_SECRET_ACCESS_KEY,
        env_key: "AWS_SECRET_ACCESS_KEY",
    },
    CredentialSpec {
        name: AZURE_CLIENT_SECRET,
        env_key: "AZURE_CLIENT_SECRET",
    },
    CredentialSpec {
        name: HC_VAULT_TOKEN,
        env_key: "VAULT_TOKEN",
    },
    CredentialSpec {
        name: HUAWEI_SDK_AK,
        env_key: "HUAWEICLOUD_SDK_AK",
    },
    CredentialSpec {
        name: HUAWEI_SDK_SK,
        env_key: "HUAWEICLOUD_SDK_SK",
    },
    CredentialSpec {
        name: GOOGLE_OAUTH_ACCESS_TOKEN,
        env_key: "GOOGLE_OAUTH_ACCESS_TOKEN",
    },
];

/// Non-secret SOPS settings which may be carried by the provider URI and are
/// translated to the environment variables understood by the SOPS CLI.
pub static STRING_FIELDS: &[FieldSpec<String>] = &[
    FieldSpec {
        field: |c| &c.age_key_cmd,
        field_mut: |c| &mut c.age_key_cmd,
        url_key: "age_key_cmd",
        env_key: "SOPS_AGE_KEY_CMD",
    },
    FieldSpec {
        field: |c| &c.age_recipients,
        field_mut: |c| &mut c.age_recipients,
        url_key: "age_recipients",
        env_key: "SOPS_AGE_RECIPIENTS",
    },
    FieldSpec {
        field: |c| &c.age_ssh_private_key_cmd,
        field_mut: |c| &mut c.age_ssh_private_key_cmd,
        url_key: "age_ssh_private_key_cmd",
        env_key: "SOPS_AGE_SSH_PRIVATE_KEY_CMD",
    },
    FieldSpec {
        field: |c| &c.kms_arn,
        field_mut: |c| &mut c.kms_arn,
        url_key: "kms_arn",
        env_key: "SOPS_KMS_ARN",
    },
    FieldSpec {
        field: |c| &c.aws_profile,
        field_mut: |c| &mut c.aws_profile,
        url_key: "aws_profile",
        env_key: "AWS_PROFILE",
    },
    FieldSpec {
        field: |c| &c.aws_access_key_id,
        field_mut: |c| &mut c.aws_access_key_id,
        url_key: "aws_access_key_id",
        env_key: "AWS_ACCESS_KEY_ID",
    },
    FieldSpec {
        field: |c| &c.aws_region,
        field_mut: |c| &mut c.aws_region,
        url_key: "aws_region",
        env_key: "AWS_REGION",
    },
    FieldSpec {
        field: |c| &c.azure_client_id,
        field_mut: |c| &mut c.azure_client_id,
        url_key: "azure_client_id",
        env_key: "AZURE_CLIENT_ID",
    },
    FieldSpec {
        field: |c| &c.azure_tenant_id,
        field_mut: |c| &mut c.azure_tenant_id,
        url_key: "azure_tenant_id",
        env_key: "AZURE_TENANT_ID",
    },
    FieldSpec {
        field: |c| &c.azure_keyvault_urls,
        field_mut: |c| &mut c.azure_keyvault_urls,
        url_key: "azure_keyvault_urls",
        env_key: "SOPS_AZURE_KEYVAULT_URLS",
    },
    FieldSpec {
        field: |c| &c.gcp_kms_client_type,
        field_mut: |c| &mut c.gcp_kms_client_type,
        url_key: "gcp_kms_client_type",
        env_key: "SOPS_GCP_KMS_CLIENT_TYPE",
    },
    FieldSpec {
        field: |c| &c.gcp_kms_endpoint,
        field_mut: |c| &mut c.gcp_kms_endpoint,
        url_key: "gcp_kms_endpoint",
        env_key: "SOPS_GCP_KMS_ENDPOINT",
    },
    FieldSpec {
        field: |c| &c.gcp_kms_ids,
        field_mut: |c| &mut c.gcp_kms_ids,
        url_key: "gcp_kms_ids",
        env_key: "SOPS_GCP_KMS_IDS",
    },
    FieldSpec {
        field: |c| &c.gcp_kms_universe_domain,
        field_mut: |c| &mut c.gcp_kms_universe_domain,
        url_key: "gcp_kms_universe_domain",
        env_key: "SOPS_GCP_KMS_UNIVERSE_DOMAIN",
    },
    FieldSpec {
        field: |c| &c.pgp_fp,
        field_mut: |c| &mut c.pgp_fp,
        url_key: "pgp_fp",
        env_key: "SOPS_PGP_FP",
    },
    FieldSpec {
        field: |c| &c.gpg_exec,
        field_mut: |c| &mut c.gpg_exec,
        url_key: "gpg_exec",
        env_key: "SOPS_GPG_EXEC",
    },
    FieldSpec {
        field: |c| &c.hc_vault_addr,
        field_mut: |c| &mut c.hc_vault_addr,
        url_key: "hc_vault_addr",
        env_key: "VAULT_ADDR",
    },
    FieldSpec {
        field: |c| &c.hc_vault_allowlist,
        field_mut: |c| &mut c.hc_vault_allowlist,
        url_key: "hc_vault_allowlist",
        env_key: "SOPS_HC_VAULT_ALLOWLIST",
    },
    FieldSpec {
        field: |c| &c.huawei_sdk_project_id,
        field_mut: |c| &mut c.huawei_sdk_project_id,
        url_key: "huawei_sdk_project_id",
        env_key: "HUAWEICLOUD_SDK_PROJECT_ID",
    },
    FieldSpec {
        field: |c| &c.huawei_kms_ids,
        field_mut: |c| &mut c.huawei_kms_ids,
        url_key: "huawei_kms_ids",
        env_key: "SOPS_HUAWEICLOUD_KMS_IDS",
    },
    FieldSpec {
        field: |c| &c.sops_decryption_order,
        field_mut: |c| &mut c.sops_decryption_order,
        url_key: "sops_decryption_order",
        env_key: "SOPS_DECRYPTION_ORDER",
    },
    FieldSpec {
        field: |c| &c.sops_editor,
        field_mut: |c| &mut c.sops_editor,
        url_key: "sops_editor",
        env_key: "SOPS_EDITOR",
    },
    FieldSpec {
        field: |c| &c.sops_enable_local_keyservice,
        field_mut: |c| &mut c.sops_enable_local_keyservice,
        url_key: "sops_enable_local_keyservice",
        env_key: "SOPS_ENABLE_LOCAL_KEYSERVICE",
    },
    FieldSpec {
        field: |c| &c.sops_keyservice,
        field_mut: |c| &mut c.sops_keyservice,
        url_key: "sops_keyservice",
        env_key: "SOPS_KEYSERVICE",
    },
];

pub static PATHBUF_FIELDS: &[FieldSpec<PathBuf>] = &[
    FieldSpec {
        field: |c| &c.age_key_file,
        field_mut: |c| &mut c.age_key_file,
        url_key: "age_key_file",
        env_key: "SOPS_AGE_KEY_FILE",
    },
    FieldSpec {
        field: |c| &c.age_ssh_private_key_file,
        field_mut: |c| &mut c.age_ssh_private_key_file,
        url_key: "age_ssh_private_key_file",
        env_key: "SOPS_AGE_SSH_PRIVATE_KEY_FILE",
    },
    FieldSpec {
        field: |c| &c.sops_config,
        field_mut: |c| &mut c.sops_config,
        url_key: "sops_config",
        env_key: "SOPS_CONFIG",
    },
];