sneak
397011a592
All checks were successful
check / check (push) Successful in 2m0s
- Replace .golangci.yml with the canonical strict config (all linters enabled except the standard disable list; lll 88, funlen 80/50, cyclop 15, dupl 100; test files now linted) - Pin the Dockerfile lint stage to golangci/golangci-lint:v2.12.2 by tag and digest (Debian-based) - Fix all ~1550 findings surfaced by the new config: line wrapping, wsl_v5/nlreturn blank lines, noinlineerr splits, err113 sentinel errors, perfsprint/modernize rewrites, goconst constants, thelper, testifylint, noctx CommandContext, testpackage conversions, t.Parallel() where safe, and complexity/dupl helper extraction - Record the change and follow-up items in TODO.md User-visible strings -------------------- No user-visible string changes remain. Every error message this branch composes is byte-identical to the one main composes. The err113 sentinels are shaped so that fmt.Errorf reassembles the original text around them: a sentinel carries the fixed words of the message and the caller supplies the interpolated value in the position it has always occupied. Where the value sits in the middle of the sentence the sentinel therefore holds only a fragment (for example vault.ErrVaultNotFound is "does not exist", composed by its caller as "vault <name> does not exist"); each such sentinel documents the message it participates in. Verified mechanically rather than by inspection: every fmt.Errorf and errors.New call site in both trees was parsed, the Error() text of any sentinel passed to %w substituted in, and the resulting sets of composed message templates compared. All 350 templates main produces are still produced, character for character; the set of messages lost or altered is empty. unlocker list ------------- findUnlockerIDByMetadata now returns (string, error) instead of signalling failure with an empty ID. An unreadable unlockers.d is no longer indistinguishable from "no matching entry", so UnlockersList skips the entry with a warning naming the directory, as it did before the scan was extracted into a helper, rather than emitting a row under a synthesized fallback ID that no unlocker remove or unlocker select can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by tests in internal/cli/unlockers_list_test.go.
123 lines
2.9 KiB
Go
123 lines
2.9 KiB
Go
package cli
|
|
|
|
import (
|
|
"path/filepath"
|
|
"time"
|
|
|
|
"git.eeqj.de/sneak/secret/internal/secret"
|
|
"github.com/spf13/afero"
|
|
)
|
|
|
|
// vaultStats accumulates statistics while walking vault directories
|
|
type vaultStats struct {
|
|
totalSecrets int
|
|
totalSize int64
|
|
oldestTime time.Time
|
|
latestTime time.Time
|
|
}
|
|
|
|
// addVersion accumulates size and timestamp info for one version directory
|
|
func (s *vaultStats) addVersion(fs afero.Fs, versionPath string) {
|
|
// Add size of encrypted data
|
|
dataPath := filepath.Join(versionPath, "data.age")
|
|
|
|
stat, err := fs.Stat(dataPath)
|
|
if err == nil {
|
|
s.totalSize += stat.Size()
|
|
}
|
|
|
|
// Add size of metadata
|
|
metaPath := filepath.Join(versionPath, "metadata.age")
|
|
|
|
stat, err = fs.Stat(metaPath)
|
|
if err == nil {
|
|
s.totalSize += stat.Size()
|
|
}
|
|
|
|
// Track timestamps
|
|
stat, err = fs.Stat(versionPath)
|
|
if err == nil {
|
|
modTime := stat.ModTime()
|
|
if s.oldestTime.IsZero() || modTime.Before(s.oldestTime) {
|
|
s.oldestTime = modTime
|
|
}
|
|
|
|
if s.latestTime.IsZero() || modTime.After(s.latestTime) {
|
|
s.latestTime = modTime
|
|
}
|
|
}
|
|
}
|
|
|
|
// addSecret accumulates stats for one secret directory
|
|
func (s *vaultStats) addSecret(fs afero.Fs, secretsPath, secretName string) {
|
|
s.totalSecrets++
|
|
secretPath := filepath.Join(secretsPath, secretName)
|
|
|
|
// Get size and timestamps from all versions
|
|
versionsPath := filepath.Join(secretPath, "versions")
|
|
|
|
versionEntries, err := afero.ReadDir(fs, versionsPath)
|
|
if err != nil {
|
|
secret.Warn("Could not read versions directory for secret",
|
|
"secret", secretName, "error", err)
|
|
|
|
return
|
|
}
|
|
|
|
for _, versionEntry := range versionEntries {
|
|
if !versionEntry.IsDir() {
|
|
continue
|
|
}
|
|
|
|
s.addVersion(fs, filepath.Join(versionsPath, versionEntry.Name()))
|
|
}
|
|
}
|
|
|
|
// addVault accumulates stats for one vault directory
|
|
func (s *vaultStats) addVault(fs afero.Fs, vaultsDir, vaultName string) {
|
|
vaultPath := filepath.Join(vaultsDir, vaultName)
|
|
secretsPath := filepath.Join(vaultPath, "secrets.d")
|
|
|
|
// Count secrets in this vault
|
|
secretEntries, err := afero.ReadDir(fs, secretsPath)
|
|
if err != nil {
|
|
secret.Warn("Could not read secrets directory for vault",
|
|
"vault", vaultName, "error", err)
|
|
|
|
return
|
|
}
|
|
|
|
for _, secretEntry := range secretEntries {
|
|
if !secretEntry.IsDir() {
|
|
continue
|
|
}
|
|
|
|
s.addSecret(fs, secretsPath, secretEntry.Name())
|
|
}
|
|
}
|
|
|
|
// gatherVaultStats collects statistics from all vaults, returning the
|
|
// total secret count, total size, and oldest/latest secret timestamps
|
|
func gatherVaultStats(
|
|
fs afero.Fs,
|
|
vaultsDir string,
|
|
) (int, int64, time.Time, time.Time, error) {
|
|
vaultEntries, err := afero.ReadDir(fs, vaultsDir)
|
|
if err != nil {
|
|
return 0, 0, time.Time{}, time.Time{}, err
|
|
}
|
|
|
|
var stats vaultStats
|
|
|
|
for _, vaultEntry := range vaultEntries {
|
|
if !vaultEntry.IsDir() {
|
|
continue
|
|
}
|
|
|
|
stats.addVault(fs, vaultsDir, vaultEntry.Name())
|
|
}
|
|
|
|
return stats.totalSecrets, stats.totalSize,
|
|
stats.oldestTime, stats.latestTime, nil
|
|
}
|