ClusterCanvas/service/internal/settings/secrets.go

package settings

import (
	"errors"
	"fmt"
	"os"
)

// KeyFromEnv reads and decodes CLUSTERCANVAS_CONFIG_KEY (base64, 16/24/32 bytes).
func KeyFromEnv() ([]byte, error) {
	rawKey := os.Getenv(ConfigKeyEnvVar)
	if rawKey == "" {
		return nil, fmt.Errorf("%s is not set", ConfigKeyEnvVar)
	}
	return decodeKey(rawKey)
}

// LoadSecrets decrypts secrets.enc from dir using key.
func LoadSecrets(dir string, key []byte) (Secrets, error) {
	var secrets Secrets
	if err := loadEncryptedJSON(dir, SecretsFileName, key, &secrets); err != nil {
		return Secrets{}, err
	}
	return secrets, nil
}

// SaveSecrets encrypts secrets and writes secrets.enc to dir with mode 0600.
func SaveSecrets(dir string, secrets Secrets, key []byte) error {
	return saveEncryptedJSON(dir, SecretsFileName, key, secrets)
}

// LoadPasswords decrypts passwords.enc from dir using key.
func LoadPasswords(dir string, key []byte) (PasswordStore, error) {
	var store PasswordStore
	if err := loadEncryptedJSON(dir, PasswordsFileName, key, &store); err != nil {
		return PasswordStore{}, err
	}
	if store.Users == nil {
		store.Users = []UserCredential{}
	}
	return store, nil
}

// LoadPasswordsOrEmpty returns an empty store when passwords.enc is missing.
func LoadPasswordsOrEmpty(dir string, key []byte) (PasswordStore, error) {
	store, err := LoadPasswords(dir, key)
	if err != nil {
		if errors.Is(err, os.ErrNotExist) {
			return PasswordStore{Users: []UserCredential{}}, nil
		}
		return PasswordStore{}, err
	}
	return store, nil
}

// SavePasswords encrypts the password store and writes passwords.enc.
func SavePasswords(dir string, store PasswordStore, key []byte) error {
	if store.Users == nil {
		store.Users = []UserCredential{}
	}
	return saveEncryptedJSON(dir, PasswordsFileName, key, store)
}

// LoadSessions decrypts sessions.enc from dir using key.
func LoadSessions(dir string, key []byte) (SessionStore, error) {
	var store SessionStore
	if err := loadEncryptedJSON(dir, SessionsFileName, key, &store); err != nil {
		return SessionStore{}, err
	}
	if store.Sessions == nil {
		store.Sessions = []SessionRecord{}
	}
	return store, nil
}

// LoadSessionsOrEmpty returns an empty store when sessions.enc is missing.
func LoadSessionsOrEmpty(dir string, key []byte) (SessionStore, error) {
	store, err := LoadSessions(dir, key)
	if err != nil {
		if errors.Is(err, os.ErrNotExist) {
			return SessionStore{Sessions: []SessionRecord{}}, nil
		}
		return SessionStore{}, err
	}
	return store, nil
}

// SaveSessions encrypts the session store and writes sessions.enc.
func SaveSessions(dir string, store SessionStore, key []byte) error {
	if store.Sessions == nil {
		store.Sessions = []SessionRecord{}
	}
	return saveEncryptedJSON(dir, SessionsFileName, key, store)
}