The library documents itself · Security & governance
stzSecretStore
20 own methods · 1 forms written with extensions, listed under their method
the source: base/security/stzSecretStore.ring(opens in a new tab) · All classes · The area reference: Security & governance
Under each method, its extensions (Q CS XT Z ZZ IB W U): bold and ticked, it exists; struck, it does not. The extensions and what they mean
No method of this class is run on this page: the class reaches files, the network, processes, the clock, chance or sound, and an example run here would only be an example of its effects. Each method carries the explanation the library gives of itself.
Method
Explanation, as the source carries it
init
(no comment in the source: the name reads as a sentence) initno extension
Name
(no comment in the source: the name reads as a sentence) nameno extension
Register
the registry ----------------------------------------------------- register a secret under its own Name(). Registering a name that exists REPLACES it -- that is rotation (RotateQ is the explicit alias).no extension
Rotate
rotate a secret: replace whatever is registered under poNewSecret's name.QCSXTZZZIBWU
RotateToFresh
ROTATE IN PLACE, to a fresh random value -- containment's :RotateSecret. Only a secret whose value THIS store holds (a :literal) can be regenerated here: a key it issues, a token it signs with. A secret that lives in an environment variable, a file or a vault is not this store's to change -- that REFUSES loudly, naming where to rotate it, rather than pretending. Creating a credential is an effect, so poActor passes the same gate as a reveal. The new value is 32 random bytes as 64 hex characters; kind and name are kept (a token's expiry is cleared -- a new value is a new credential). Returns This.no extension
Revoke
revoke (remove) a secret by name.no extension
Has
safe reads (never leak a value)no extension
NumberOfSecrets
(no comment in the source: the name reads as a sentence) number of secretsno extension
Names
the project's whole credential surface, by name -- safe to show/log.no extension
Secret
the secret OBJECT (still self-redacting -- holding it does not reveal it).no extension
DescriptorOf
the redacted descriptor of a registered secret (never its value).no extension
Reveal
the ONE governed door to a value (gate + audit) ----------------- reveal a secret's plaintext -- GATED (only an effectful, non-sandboxed actor) and AUDITED (the access is recorded either way). This is the only path a value leaves the store, so the log is complete.no extension
RevealVia
reveal through a vault RESOLVER (for a :vault-sourced secret), still gated and AUDITED by the store. For a non-vault secret the resolver is ignored, so this is a safe superset of Reveal.no extension
IsRevealableBy
may this actor reveal this secret? (no side effect, no audit entry.)no extension
SaveSealedTo
Write the whole store to pcPath as ONE authenticated-encryption blob (XChaCha20-Poly1305), keyed by poKeySecret -- itself a stzSecret, whose 64-hex value comes from wherever secrets come from (an environment variable, a file, a vault). Literal values are sealed; env / file / vault secrets are saved as their POINTER only -- the plaintext never leaves its source. The store's name is bound as the aad, so one store's file cannot be passed off as another's. Sealing reads every literal value, so poActor passes the same gate as a reveal.no extension
SaveSealedToVia
As SaveSealedTo, with the KEY fetched through a vault resolver (R4).no extension
AccessLog
(no comment in the source: the name reads as a sentence) access logno extension
NumberOfAccesses
(no comment in the source: the name reads as a sentence) number of accessesno extension
RefusedAccesses
refused reveals -- a misuse signal worth watching.no extension
Show
(no comment in the source: the name reads as a sentence) showno extension