via-cli 0.2.0

Run commands and API requests with 1Password-backed credentials without exposing secrets to your shell
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97

use std::collections::{BTreeMap, BTreeSet};

use crate::config::{Config, ProviderConfig};
use crate::error::ViaError;
use crate::secrets::SecretValue;

mod onepassword;

pub trait SecretProvider {
    fn resolve(&self, reference: &str) -> Result<SecretValue, ViaError>;
}

pub struct ProviderRegistry {
    providers: BTreeMap<String, Box<dyn SecretProvider>>,
}

impl ProviderRegistry {
    pub fn from_config(config: &Config) -> Result<Self, ViaError> {
        let mut providers: BTreeMap<String, Box<dyn SecretProvider>> = BTreeMap::new();
        for (name, provider) in &config.providers {
            match provider {
                ProviderConfig::OnePassword {
                    account,
                    cache,
                    cache_ttl_seconds,
                } => {
                    providers.insert(
                        name.clone(),
                        Box::new(onepassword::OnePasswordCliProvider::new(
                            account.clone(),
                            *cache,
                            *cache_ttl_seconds,
                            provider_secret_references(config, name),
                        )),
                    );
                }
            }
        }

        Ok(Self { providers })
    }

    pub fn get(&self, name: &str) -> Result<&dyn SecretProvider, ViaError> {
        self.providers
            .get(name)
            .map(|provider| provider.as_ref())
            .ok_or_else(|| ViaError::InvalidConfig(format!("unknown provider `{name}`")))
    }
}

fn provider_secret_references(config: &Config, provider_name: &str) -> Vec<String> {
    config
        .services
        .values()
        .filter(|service| service.provider == provider_name)
        .flat_map(|service| service.secrets.values().cloned())
        .collect::<BTreeSet<_>>()
        .into_iter()
        .collect()
}

#[cfg(test)]
mod tests {
    use super::*;

    fn config() -> Config {
        Config::from_toml_str(
            r#"
version = 1

[providers.onepassword]
type = "1password"
"#,
        )
        .unwrap()
    }

    #[test]
    fn builds_registry_from_config() {
        let registry = ProviderRegistry::from_config(&config()).unwrap();

        assert!(registry.get("onepassword").is_ok());
    }

    #[test]
    fn reports_missing_provider() {
        let registry = ProviderRegistry::from_config(&config()).unwrap();
        let error = match registry.get("missing") {
            Ok(_) => panic!("expected missing provider error"),
            Err(error) => error,
        };

        assert!(
            matches!(error, ViaError::InvalidConfig(message) if message.contains("unknown provider"))
        );
    }
}