siphon-secrets 0.1.1

Secret management with multiple backend support for Siphon
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

//! 1Password CLI backend
//!
//! Uses the `op` CLI tool to read secrets.
//! Requires 1Password CLI to be installed and authenticated.
//!
//! See: https://developer.1password.com/docs/cli

use std::process::Command;

use crate::error::SecretError;

/// Resolve a secret from 1Password using the CLI
pub fn resolve(vault: &str, item: &str, field: &str) -> Result<String, SecretError> {
    let uri = format!("op://{}/{}/{}", vault, item, field);

    let output = Command::new("op")
        .args(["read", &uri])
        .output()
        .map_err(|e| {
            if e.kind() == std::io::ErrorKind::NotFound {
                SecretError::backend(
                    "1password",
                    "1Password CLI ('op') not found. Install from https://1password.com/downloads/command-line/",
                )
            } else {
                SecretError::backend("1password", format!("Failed to execute 'op' CLI: {}", e))
            }
        })?;

    if !output.status.success() {
        let stderr = String::from_utf8_lossy(&output.stderr);
        let error_msg = stderr.trim();

        // Provide helpful error messages for common issues
        if error_msg.contains("not signed in") || error_msg.contains("session expired") {
            return Err(SecretError::backend(
                "1password",
                "Not signed in to 1Password CLI. Run 'op signin' or 'eval $(op signin)'",
            ));
        }

        if error_msg.contains("isn't a vault") || error_msg.contains("vault") {
            return Err(SecretError::NotFound(format!(
                "1Password vault '{}' not found",
                vault
            )));
        }

        if error_msg.contains("isn't an item") || error_msg.contains("item") {
            return Err(SecretError::NotFound(format!(
                "1Password item '{}/{}' not found",
                vault, item
            )));
        }

        if error_msg.contains("isn't a field") || error_msg.contains("field") {
            return Err(SecretError::NotFound(format!(
                "1Password field '{}/{}/{}' not found",
                vault, item, field
            )));
        }

        return Err(SecretError::backend("1password", error_msg));
    }

    let value = String::from_utf8_lossy(&output.stdout).trim().to_string();

    if value.is_empty() {
        return Err(SecretError::NotFound(format!(
            "1Password field '{}/{}/{}' is empty",
            vault, item, field
        )));
    }

    Ok(value)
}