1// Package secrets implements secret provider adapters.
2package secrets
3
4import (
5 "context"
6 "fmt"
7 "os/exec"
8 "regexp"
9 "strings"
10 "time"
11
12 "github.com/bnema/zerowrap"
13
14 "github.com/bnema/gordon/internal/domain"
15)
16
17// passPathRegex validates pass paths.
18// Allows alphanumeric characters, forward slashes, underscores, dots, and hyphens.
19// This prevents command injection via shell metacharacters.
20var passPathRegex = regexp.MustCompile(`^[a-zA-Z0-9/_.-]+$`)
21
22// PassProvider implements the SecretProvider interface using the pass password manager.
23type PassProvider struct {
24 timeout time.Duration
25 log zerowrap.Logger
26}
27
28// NewPassProvider creates a new pass provider.
29func NewPassProvider(log zerowrap.Logger) *PassProvider {
30 return &PassProvider{
31 timeout: 10 * time.Second,
32 log: log,
33 }
34}
35
36// Name returns the provider name.
37func (p *PassProvider) Name() string {
38 return "pass"
39}
40
41// ValidatePath validates a pass path to prevent command injection and path traversal.
42// Returns an error if the path is invalid.
43func ValidatePath(path string) error {
44 if path == "" {
45 return fmt.Errorf("path cannot be empty")
46 }
47
48 // SECURITY: Validate path format to prevent command injection
49 if !passPathRegex.MatchString(path) {
50 return fmt.Errorf("invalid path: must contain only alphanumeric characters, /, _, ., -")
51 }
52
53 // SECURITY: Prevent path traversal
54 if strings.Contains(path, "..") {
55 return domain.ErrPathTraversal
56 }
57
58 // SECURITY: Reject absolute paths
59 if strings.HasPrefix(path, "/") {
60 return fmt.Errorf("invalid path: absolute paths not allowed")
61 }
62
63 return nil
64}
65
66// GetSecret retrieves a secret from pass by path.
67func (p *PassProvider) GetSecret(ctx context.Context, path string) (string, error) {
68 // SECURITY: Validate path before executing command
69 if err := ValidatePath(path); err != nil {
70 p.log.Warn().
71 Str(zerowrap.FieldLayer, "adapter").
72 Str(zerowrap.FieldAdapter, "secrets").
73 Str("provider", "pass").
74 Str("path", path).
75 Err(err).
76 Msg("rejected invalid pass path")
77 return "", err
78 }
79
80 ctx, cancel := context.WithTimeout(ctx, p.timeout)
81 defer cancel()
82
83 cmd := exec.CommandContext(ctx, "pass", "show", path) //nolint:gosec // binary is constant ("pass"); arguments are validated secret paths
84 output, err := cmd.Output()
85 if err != nil {
86 if exitError, ok := err.(*exec.ExitError); ok {
87 return "", fmt.Errorf("pass command failed: %s", string(exitError.Stderr))
88 }
89 return "", fmt.Errorf("failed to execute pass command: %w", err)
90 }
91
92 secret := strings.TrimSpace(string(output))
93 if secret == "" {
94 return "", fmt.Errorf("empty secret returned from pass for path: %s", path)
95 }
96
97 p.log.Debug().
98 Str(zerowrap.FieldLayer, "adapter").
99 Str(zerowrap.FieldAdapter, "secrets").
100 Str("provider", "pass").
101 Str("path", path).
102 Msg("successfully retrieved secret from pass")
103
104 return secret, nil
105}
106
107// IsAvailable checks if pass is available in the system.
108// Uses a short timeout so a stalled GPG agent does not hang the caller.
109func (p *PassProvider) IsAvailable() bool {
110 ctx, cancel := context.WithTimeout(context.Background(), p.timeout)
111 defer cancel()
112 cmd := exec.CommandContext(ctx, "pass", "version") //nolint:gosec // binary is a constant ("pass"), no user input
113 return cmd.Run() == nil
114}