1package secrets
2
3import (
4 "context"
5 "fmt"
6 "os/exec"
7 "path/filepath"
8 "regexp"
9 "strings"
10 "time"
11
12 "github.com/bnema/zerowrap"
13)
14
15// sopsKeyPathRegex validates sops key paths (alphanumeric, dots, underscores, hyphens, brackets).
16var sopsKeyPathRegex = regexp.MustCompile(`^[a-zA-Z0-9._\-\[\]]+$`)
17
18// convertToSopsExtractPath converts dot notation (app.database.password) to
19// sops --extract Python dictionary syntax (["app"]["database"]["password"]).
20// Array indices like [0] are preserved as-is.
21func convertToSopsExtractPath(keyPath string) string {
22 if keyPath == "" {
23 return ""
24 }
25
26 var result strings.Builder
27 parts := strings.Split(keyPath, ".")
28
29 for _, part := range parts {
30 if part == "" {
31 continue
32 }
33 // Check if the part already contains array access like "items[0]"
34 // Split on '[' to handle cases like "items[0]" -> ["items"] + [0]
35 if idx := strings.Index(part, "["); idx > 0 {
36 // Has both key and array index, e.g., "items[0]"
37 key := part[:idx]
38 arrayPart := part[idx:] // includes "[0]" or "[0][1]" etc.
39 result.WriteString(`["`)
40 result.WriteString(key)
41 result.WriteString(`"]`)
42 result.WriteString(arrayPart)
43 } else if strings.HasPrefix(part, "[") {
44 // Pure array index like "[0]"
45 result.WriteString(part)
46 } else {
47 // Regular key
48 result.WriteString(`["`)
49 result.WriteString(part)
50 result.WriteString(`"]`)
51 }
52 }
53
54 return result.String()
55}
56
57// SopsProvider implements the SecretProvider interface using sops.
58type SopsProvider struct {
59 timeout time.Duration
60 log zerowrap.Logger
61}
62
63// NewSopsProvider creates a new sops provider.
64func NewSopsProvider(log zerowrap.Logger) *SopsProvider {
65 return &SopsProvider{
66 timeout: 10 * time.Second,
67 log: log,
68 }
69}
70
71// Name returns the provider name.
72func (s *SopsProvider) Name() string {
73 return "sops"
74}
75
76// GetSecret retrieves a secret from a sops-encrypted file.
77// The path format is "file.yaml:key.nested.path".
78func (s *SopsProvider) GetSecret(ctx context.Context, path string) (string, error) {
79 ctx, cancel := context.WithTimeout(ctx, s.timeout)
80 defer cancel()
81
82 // Extract key from path format: file.yaml:key.nested.path
83 parts := strings.SplitN(path, ":", 2)
84 if len(parts) != 2 {
85 return "", fmt.Errorf("sops path must be in format 'file:key', got: %s", path)
86 }
87
88 filePath := parts[0]
89 keyPath := parts[1]
90
91 // Validate file path to prevent command injection and path traversal
92 cleanPath := filepath.Clean(filePath)
93 if strings.Contains(cleanPath, "..") {
94 return "", fmt.Errorf("invalid file path: path traversal not allowed")
95 }
96 // SECURITY: Reject absolute paths to prevent reading arbitrary files on the system.
97 if filepath.IsAbs(cleanPath) {
98 return "", fmt.Errorf("invalid file path: absolute paths not allowed")
99 }
100
101 // Validate key path to prevent command injection
102 if !sopsKeyPathRegex.MatchString(keyPath) {
103 return "", fmt.Errorf("invalid key path: must contain only alphanumeric characters, dots, underscores, hyphens, and brackets")
104 }
105
106 // Convert dot notation to sops --extract Python dictionary syntax
107 extractPath := convertToSopsExtractPath(keyPath)
108
109 // Use sops -d --extract to get specific key
110 // #nosec G204 - filePath and keyPath are validated above
111 cmd := exec.CommandContext(ctx, "sops", "-d", "--extract", extractPath, cleanPath)
112 output, err := cmd.Output()
113 if err != nil {
114 if exitError, ok := err.(*exec.ExitError); ok {
115 return "", fmt.Errorf("sops command failed: %s", string(exitError.Stderr))
116 }
117 return "", fmt.Errorf("failed to execute sops command: %w", err)
118 }
119
120 secret := strings.TrimSpace(string(output))
121 if secret == "" {
122 return "", fmt.Errorf("empty secret returned from sops for path: %s", path)
123 }
124
125 s.log.Debug().
126 Str(zerowrap.FieldLayer, "adapter").
127 Str(zerowrap.FieldAdapter, "secrets").
128 Str("provider", "sops").
129 Str("path", path).
130 Msg("successfully retrieved secret from sops")
131
132 return secret, nil
133}
134
135// IsAvailable checks if sops is available in the system.
136func (s *SopsProvider) IsAvailable() bool {
137 cmd := exec.Command("sops", "--version")
138 err := cmd.Run()
139 return err == nil
140}