Documentation
¶
Index ¶
- Variables
- func ExecuteJavaScriptSimulation(code string, params map[string]interface{}) (interface{}, error)
- type AuditEntry
- type BasicMemoryLimiter
- type EncryptedSecret
- type EnhancedSecretStore
- func (s *EnhancedSecretStore) DeleteSecret(ctx context.Context, userID int, name string) error
- func (s *EnhancedSecretStore) ExportSecrets(ctx context.Context, userID int) ([]byte, error)
- func (s *EnhancedSecretStore) GetAuditLog(ctx context.Context, userID int, limit int) ([]AuditEntry, error)
- func (s *EnhancedSecretStore) GetInternalSecretsForTesting() map[int]map[string]EncryptedSecret
- func (s *EnhancedSecretStore) GetSecret(ctx context.Context, userID int, name string) (string, error)
- func (s *EnhancedSecretStore) GetSecretMetadata(ctx context.Context, userID int, name string) (*SecretMetadata, error)
- func (s *EnhancedSecretStore) ImportSecrets(ctx context.Context, userID int, data []byte) error
- func (s *EnhancedSecretStore) ListSecrets(ctx context.Context, userID int) ([]string, error)
- func (s *EnhancedSecretStore) SetKeyRotationInterval(interval time.Duration)
- func (s *EnhancedSecretStore) SetSecret(ctx context.Context, userID int, name, value string) error
- func (s *EnhancedSecretStore) UpdateSecretTags(ctx context.Context, userID int, name string, tags []string) error
- type EnhancedSecretStoreInterface
- type FunctionExecutionContext
- type InterruptHandler
- func (h *InterruptHandler) CreateTimeoutDetails() *TimeoutDetails
- func (h *InterruptHandler) GetLoopCount() int64
- func (h *InterruptHandler) Reset()
- func (h *InterruptHandler) Setup()
- func (h *InterruptHandler) StartInterruptChecker(ctx context.Context)
- func (h *InterruptHandler) StopInterruptChecker()
- type IsolationManager
- func (im *IsolationManager) CleanupAfterExecution(ctx context.Context)
- func (im *IsolationManager) CreateExecutionContextObject() *goja.Object
- func (im *IsolationManager) GetExecutionContext() *FunctionExecutionContext
- func (im *IsolationManager) ResetState()
- func (im *IsolationManager) SetExecutionContext(functionID string, userID int, executionID string)
- func (im *IsolationManager) Setup() error
- type JSRuntime
- type Manager
- func (m *Manager) Close() error
- func (m *Manager) DeleteSecret(ctx context.Context, userID int, secretName string) error
- func (m *Manager) ExecuteFunction(ctx context.Context, function *models.Function, params map[string]interface{}, ...) (*models.ExecutionResult, error)
- func (m *Manager) ExecuteSecureFunction(ctx context.Context, code string, params map[string]interface{}) (interface{}, error)
- func (m *Manager) GetAttestation(ctx context.Context) ([]byte, error)
- func (m *Manager) GetAttestationReport() (string, error)
- func (m *Manager) GetSecret(ctx context.Context, userID int, secretName string) (string, error)
- func (m *Manager) IsEnabled() bool
- func (m *Manager) StoreSecret(ctx context.Context, secret *models.Secret) error
- func (m *Manager) VerifyAttestationReport(report string) (bool, error)
- type MemoryLimitedArrayBufferAllocator
- type MemoryLimiter
- type ObjectSizeTracker
- type Provider
- type SecretMetadata
- type SecretStore
- type TimeoutDetails
Constants ¶
This section is empty.
Variables ¶
var ( ErrTEENotEnabled = errors.New("TEE is not enabled") ErrInvalidAttestationReport = errors.New("invalid attestation report") ErrSecureExecutionFailed = errors.New("secure execution failed") ErrMemoryLimitExceeded = errors.New("memory limit exceeded") ErrExecutionTimeout = errors.New("execution timeout") )
Common errors
Functions ¶
func ExecuteJavaScriptSimulation ¶
ExecuteJavaScriptSimulation simulates JS execution for testing
Types ¶
type AuditEntry ¶
type AuditEntry struct { Timestamp time.Time `json:"timestamp"` UserID int `json:"user_id"` SecretName string `json:"secret_name"` Action string `json:"action"` // "create", "read", "update", "delete" Success bool `json:"success"` }
AuditEntry represents an audit log entry for secret access
type BasicMemoryLimiter ¶
type BasicMemoryLimiter struct {
// contains filtered or unexported fields
}
BasicMemoryLimiter implements the MemoryLimiter interface
func NewBasicMemoryLimiter ¶
func NewBasicMemoryLimiter(limitMB int64) *BasicMemoryLimiter
NewBasicMemoryLimiter creates a new memory limiter with the specified limit in MB
func (*BasicMemoryLimiter) Allocate ¶
func (l *BasicMemoryLimiter) Allocate(size int) error
Allocate checks if the allocation would exceed the limit
func (*BasicMemoryLimiter) CurrentUsage ¶
func (l *BasicMemoryLimiter) CurrentUsage() int64
CurrentUsage returns the current memory usage
func (*BasicMemoryLimiter) Limit ¶
func (l *BasicMemoryLimiter) Limit() int64
Limit returns the memory limit
func (*BasicMemoryLimiter) Release ¶
func (l *BasicMemoryLimiter) Release(size int)
Release decrements the allocated memory counter
func (*BasicMemoryLimiter) Reset ¶
func (l *BasicMemoryLimiter) Reset()
Reset resets the memory usage counter
type EncryptedSecret ¶
type EncryptedSecret struct { EncryptedData []byte `json:"encrypted_data"` IV []byte `json:"iv"` KeyID string `json:"key_id"` Metadata SecretMetadata `json:"metadata"` }
EncryptedSecret represents an encrypted secret with metadata
type EnhancedSecretStore ¶
type EnhancedSecretStore struct {
// contains filtered or unexported fields
}
EnhancedSecretStore provides a secure secret store with encryption
func NewEnhancedSecretStore ¶
func NewEnhancedSecretStore(masterKeyBase64 string) (*EnhancedSecretStore, error)
NewEnhancedSecretStore creates a new enhanced secret store
func (*EnhancedSecretStore) DeleteSecret ¶
DeleteSecret deletes a secret for a user
func (*EnhancedSecretStore) ExportSecrets ¶
ExportSecrets exports all secrets for a user
func (*EnhancedSecretStore) GetAuditLog ¶
func (s *EnhancedSecretStore) GetAuditLog(ctx context.Context, userID int, limit int) ([]AuditEntry, error)
GetAuditLog gets the audit log for a user
func (*EnhancedSecretStore) GetInternalSecretsForTesting ¶
func (s *EnhancedSecretStore) GetInternalSecretsForTesting() map[int]map[string]EncryptedSecret
GetInternalSecretsForTesting returns the internal secrets map for testing
func (*EnhancedSecretStore) GetSecret ¶
func (s *EnhancedSecretStore) GetSecret(ctx context.Context, userID int, name string) (string, error)
GetSecret retrieves a secret for a user
func (*EnhancedSecretStore) GetSecretMetadata ¶
func (s *EnhancedSecretStore) GetSecretMetadata(ctx context.Context, userID int, name string) (*SecretMetadata, error)
GetSecretMetadata gets metadata for a secret
func (*EnhancedSecretStore) ImportSecrets ¶
ImportSecrets imports secrets for a user
func (*EnhancedSecretStore) ListSecrets ¶
ListSecrets lists all secrets for a user
func (*EnhancedSecretStore) SetKeyRotationInterval ¶
func (s *EnhancedSecretStore) SetKeyRotationInterval(interval time.Duration)
SetKeyRotationInterval sets the key rotation interval for testing
func (*EnhancedSecretStore) UpdateSecretTags ¶
func (s *EnhancedSecretStore) UpdateSecretTags(ctx context.Context, userID int, name string, tags []string) error
UpdateSecretTags updates tags for a secret
type EnhancedSecretStoreInterface ¶
type EnhancedSecretStoreInterface interface { SecretStore // Embed the basic SecretStore interface // Additional methods for enhanced secret store DeleteSecret(ctx context.Context, userID int, name string) error ListSecrets(ctx context.Context, userID int) ([]string, error) GetSecretMetadata(ctx context.Context, userID int, name string) (*SecretMetadata, error) UpdateSecretTags(ctx context.Context, userID int, name string, tags []string) error GetAuditLog(ctx context.Context, userID int, limit int) ([]AuditEntry, error) ExportSecrets(ctx context.Context, userID int) ([]byte, error) ImportSecrets(ctx context.Context, userID int, data []byte) error SetSecret(ctx context.Context, userID int, name, value string) error }
EnhancedSecretStore provides advanced secret management capabilities
type FunctionExecutionContext ¶
FunctionExecutionContext contains context information for a function execution
type InterruptHandler ¶
type InterruptHandler struct {
// contains filtered or unexported fields
}
InterruptHandler handles the interruption of JavaScript execution
func NewInterruptHandler ¶
func NewInterruptHandler(runtime *JSRuntime) *InterruptHandler
NewInterruptHandler creates a new interrupt handler
func (*InterruptHandler) CreateTimeoutDetails ¶
func (h *InterruptHandler) CreateTimeoutDetails() *TimeoutDetails
CreateTimeoutDetails creates a new timeout details object
func (*InterruptHandler) GetLoopCount ¶
func (h *InterruptHandler) GetLoopCount() int64
GetLoopCount returns the current loop count
func (*InterruptHandler) Reset ¶
func (h *InterruptHandler) Reset()
Reset resets the interrupt handler state
func (*InterruptHandler) Setup ¶
func (h *InterruptHandler) Setup()
Setup initializes the interrupt handler
func (*InterruptHandler) StartInterruptChecker ¶
func (h *InterruptHandler) StartInterruptChecker(ctx context.Context)
StartInterruptChecker starts a goroutine to check for timeouts
func (*InterruptHandler) StopInterruptChecker ¶
func (h *InterruptHandler) StopInterruptChecker()
StopInterruptChecker stops the interrupt checker and cleans up
type IsolationManager ¶
type IsolationManager struct {
// contains filtered or unexported fields
}
IsolationManager handles function isolation between executions
func NewIsolationManager ¶
func NewIsolationManager(runtime *JSRuntime) *IsolationManager
NewIsolationManager creates a new isolation manager
func (*IsolationManager) CleanupAfterExecution ¶
func (im *IsolationManager) CleanupAfterExecution(ctx context.Context)
CleanupAfterExecution performs cleanup after function execution
func (*IsolationManager) CreateExecutionContextObject ¶
func (im *IsolationManager) CreateExecutionContextObject() *goja.Object
CreateExecutionContextObject creates a JavaScript object with execution context
func (*IsolationManager) GetExecutionContext ¶
func (im *IsolationManager) GetExecutionContext() *FunctionExecutionContext
GetExecutionContext gets the current execution context
func (*IsolationManager) ResetState ¶
func (im *IsolationManager) ResetState()
ResetState resets the isolation manager state between executions
func (*IsolationManager) SetExecutionContext ¶
func (im *IsolationManager) SetExecutionContext(functionID string, userID int, executionID string)
SetExecutionContext sets the current execution context
func (*IsolationManager) Setup ¶
func (im *IsolationManager) Setup() error
Setup initializes the isolation manager
type JSRuntime ¶
type JSRuntime struct {
// contains filtered or unexported fields
}
JSRuntime provides a JavaScript runtime environment within the TEE
func NewJSRuntime ¶
func NewJSRuntime(memoryLimit int64, timeoutLimit int, secretStore SecretStore) *JSRuntime
NewJSRuntime creates a new JavaScript runtime
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager manages the TEE environment
func NewManager ¶
NewManager creates a new TEE manager
func (*Manager) DeleteSecret ¶
DeleteSecret deletes a secret from the TEE
func (*Manager) ExecuteFunction ¶
func (m *Manager) ExecuteFunction(ctx context.Context, function *models.Function, params map[string]interface{}, secretNames []string) (*models.ExecutionResult, error)
ExecuteFunction executes a JavaScript function in the TEE
func (*Manager) ExecuteSecureFunction ¶
func (m *Manager) ExecuteSecureFunction(ctx context.Context, code string, params map[string]interface{}) (interface{}, error)
ExecuteSecureFunction executes a function in a secure TEE environment
func (*Manager) GetAttestation ¶
GetAttestation gets an attestation report from the TEE
func (*Manager) GetAttestationReport ¶
GetAttestationReport generates an attestation report for the TEE environment
func (*Manager) IsEnabled ¶
func (m *Manager) IsEnabled() bool
IsEnabled returns whether TEE is enabled
func (*Manager) StoreSecret ¶
StoreSecret securely stores a secret in the TEE
func (*Manager) VerifyAttestationReport ¶
VerifyAttestationReport verifies an attestation report
type MemoryLimitedArrayBufferAllocator ¶
type MemoryLimitedArrayBufferAllocator struct {
// contains filtered or unexported fields
}
MemoryLimitedArrayBufferAllocator implements Goja's ArrayBufferAllocator interface
func NewMemoryLimitedArrayBufferAllocator ¶
func NewMemoryLimitedArrayBufferAllocator(limiter MemoryLimiter) *MemoryLimitedArrayBufferAllocator
NewMemoryLimitedArrayBufferAllocator creates a new array buffer allocator with memory limits
func (*MemoryLimitedArrayBufferAllocator) Allocate ¶
func (a *MemoryLimitedArrayBufferAllocator) Allocate(size int) ([]byte, error)
Allocate attempts to allocate memory, checking against the limit
func (*MemoryLimitedArrayBufferAllocator) Free ¶
func (a *MemoryLimitedArrayBufferAllocator) Free(buf []byte)
Free releases allocated memory
type MemoryLimiter ¶
type MemoryLimiter interface { // Allocate requests memory allocation and returns error if limit exceeded Allocate(size int) error // Release notifies the limiter that memory has been freed Release(size int) // CurrentUsage returns the current memory usage in bytes CurrentUsage() int64 // Limit returns the maximum allowed memory usage in bytes Limit() int64 // Reset resets the memory usage counter Reset() }
MemoryLimiter provides an interface for tracking and limiting memory usage
type ObjectSizeTracker ¶
type ObjectSizeTracker struct {
// contains filtered or unexported fields
}
ObjectSizeTracker tracks object allocations and applies memory limits
func NewObjectSizeTracker ¶
func NewObjectSizeTracker(runtime *JSRuntime) *ObjectSizeTracker
NewObjectSizeTracker creates a new object size tracker
func (*ObjectSizeTracker) Setup ¶
func (t *ObjectSizeTracker) Setup() error
Setup initializes object tracking hooks
type Provider ¶
type Provider interface { // Initialize initializes the TEE provider Initialize() error // ExecuteFunction executes a JavaScript function in the TEE ExecuteFunction(ctx context.Context, function *models.Function, params map[string]interface{}, secrets map[string]string) (*models.ExecutionResult, error) // StoreSecret securely stores a secret in the TEE StoreSecret(ctx context.Context, secret *models.Secret) error // GetSecret retrieves a secret from the TEE GetSecret(ctx context.Context, userID int, secretName string) (string, error) // DeleteSecret deletes a secret from the TEE DeleteSecret(ctx context.Context, userID int, secretName string) error // GetAttestation gets an attestation report from the TEE GetAttestation(ctx context.Context) ([]byte, error) // Close closes the TEE provider Close() error }
Provider defines the interface for TEE providers
type SecretMetadata ¶
type SecretMetadata struct { CreatedAt time.Time `json:"created_at"` UpdatedAt time.Time `json:"updated_at"` AccessedAt time.Time `json:"accessed_at"` Version int `json:"version"` Tags []string `json:"tags"` }
SecretMetadata contains metadata about a secret
type SecretStore ¶
type SecretStore interface {
GetSecret(ctx context.Context, userID int, name string) (string, error)
}
SecretStore provides the interface for accessing secrets
type TimeoutDetails ¶
type TimeoutDetails struct { TimeoutLimit int `json:"timeout_limit_seconds"` LoopCount int64 `json:"loop_count"` Context string `json:"context,omitempty"` }
TimeoutDetails contains additional information about a timeout