Repository navigation
TIGER-291: Tiger_Secret — provider-neutral secrets / key-store (public core module) - #337
Merged
Merged
Conversation
…GER-291) A public core feature module that resolves secrets through a config-selected backend, so WHERE a secret lives is a config choice and the caller never cares — the same pattern as Tiger_Location / Tiger_Mail / the auth credential provider. AWS SSM is an adapter, never the interface. - library/Tiger/Secret.php — the facade: resolve() (scheme ref -> fetch; else plaintext passthrough — the one-line swap at every *_enc call site), get(), register(), put(); lazy self-wiring from tiger.secret.* so it is correct with no Bootstrap (web/CLI/tests) and never depends on module activation. - Adapters: Local (Tiger_Crypto enc:, the default), Env, File, Chain — all dependency-free, in core; Ssm + SecretsManager capability-gated on the AWS SDK (shipped by tiger-sdk-aws, never vendored) with an injectable client, dormant and null-resolving without it. Writer interface (put/delete) for ops tooling. - modules/secret — manifest + Bootstrap (eager-wires configured backends) + AGENTS.md + docs/en. - Default driver is `local` = today's behavior, so shared-hosting installs are unaffected and need no SDK. On the fleet, driver=ssm authenticates with the EC2 instance role (nothing baked, nothing in user-data) — which also breaks the bootstrap chicken-and-egg: crypto.key can come from SSM because SSM trusts the role, not the key. - 52 unit tests (facade + every adapter; cloud via a stubbed client); full unit suite green (1083). CAPABILITIES.md regenerated. Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01ASauLLscjqdsNqBNsx2Typ
Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01ASauLLscjqdsNqBNsx2Typ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A public core feature module that resolves secrets and sensitive config values through a config-selected backend — so where a secret lives is a configuration choice and the calling code never cares. Same pattern as
Tiger_Location/Tiger_Mail/ the auth credential provider: AWS SSM is an adapter, never the interface.Parallel to
Tiger_Message/modules/message: the facade + adapters live inlibrary/Tiger/Secret/, the module (modules/secret) is the documented home + Bootstrap wiring + docs.The contract
A secret reference is
scheme:path(ssm:/tiger/prod/node/crypto_key,env:OPENSRS_KEY,file:/run/secrets/x,enc:<blob>).Tiger_Secret::resolve($value)fetches a recognized reference and passes anything else through as plaintext — the one-line swap at every existing*_enccall site.Why it's not AWS-specific
local= today's behavior (an inlineTiger_Cryptovalue). A shared-hosting install withtiger.secret.driverunset is unaffected and needs no cloud SDK — the layer is invisible.driver=ssmauthenticates with the EC2 instance IAM role (default AWS chain), so nothing is baked into a golden image and nothing rides in user-data.tiger.crypto.keycan come from SSM because SSM trusts the role, not the key. Root of trust becomes the instance role + KMS, not a pre-shared secret.Adapters
enc/local(default)Tiger_CryptoenvfilechainssmsecretsmanagerCloud adapters reference
Aws\…\…Clientonly behindclass_exists(or an injected client), so core vendors no AWS SDK and they're dormant/null-resolving without it — same posture asHosting_Lib_Provisioner_Tigerden. ATiger_Secret_Writer_Interface(put/delete) supports ops/provisioning tooling (never the request path).Robustness
tiger.secret.*, so it's correct in web / CLI / tests and never depends on the module being active; the Bootstrap only eager-wires forschemes()visibility + early error surfacing.available()is capability-detection;get()returns null for missing/unavailable; the facade guards every call. A missing SDK is a null, never a 500. Secrets are never logged.Tests
52 unit tests (facade + every adapter; cloud adapters via a stubbed client — no SDK, no network). Full unit suite green: 1083 tests, 17,830 assertions.
CAPABILITIES.mdregenerated.Consumers (separate tickets, blocked on this)
blowfish_secret.ssm:refs on the three_encpoints; drop the baked AWS provisioner key.🤖 Generated with Claude Code
https://claude.ai/code/session_01ASauLLscjqdsNqBNsx2Typ