Generalize auth/base-url value sources: provider registry replaces hardcoded SSM #150

New issue

Closed

opened 2026-06-17 20:31:35 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-06-17 20:31:35 +00:00

Owner

Replace the hardcoded SSM config hydration with a pluggable value-source mechanism so guardfiles can name other config stores.

Grammar

ssm "/path" becomes value <provider> "<address>" everywhere a secret or host is named (header-token, bearer, query-param param, base-url). A new ValueSource{Provider, Address} type replaces Auth.SSM, QueryAuthParam.SSM, BaseURLSSM.

Engine

TokenResolver becomes a Providers map[string]Provider registry (Provider = func(ctx, address) (string, error)). cli-guard ships no-SDK built-ins (env, file, literal); the consumer registers ssm and tailscale. Build-time fail-closed validation: a value foo whose provider isn't registered is a build error. base-url, auth token, and query-param secrets collapse onto the one resolver, deleting the parallel BaseURLFn/baseURLSSM path.

Codegen

The generated consumer main.go (specgen template) builds a providers map wiring ssm + tailscale, gating the AWS SDK imports on whether any guardfile actually uses ssm. base-url-via-value flows through the same map. This is where the real hardcoded SSM hydration lived.

Motivating non-ssm case

base-url { value tailscale "open-webui" } resolves a tailnet host live via tailscale ip -4, dropping an SSM entry.

v0.x break; ward/coily re-bump along the dependency arrow.

Replace the hardcoded SSM config hydration with a pluggable value-source mechanism so guardfiles can name other config stores. ## Grammar `ssm "/path"` becomes `value <provider> "<address>"` everywhere a secret or host is named (header-token, bearer, query-param param, base-url). A new `ValueSource{Provider, Address}` type replaces `Auth.SSM`, `QueryAuthParam.SSM`, `BaseURLSSM`. ## Engine `TokenResolver` becomes a `Providers map[string]Provider` registry (`Provider = func(ctx, address) (string, error)`). cli-guard ships no-SDK built-ins (env, file, literal); the consumer registers ssm and tailscale. Build-time fail-closed validation: a `value foo` whose provider isn't registered is a build error. base-url, auth token, and query-param secrets collapse onto the one resolver, deleting the parallel BaseURLFn/baseURLSSM path. ## Codegen The generated consumer main.go (specgen template) builds a providers map wiring ssm + tailscale, gating the AWS SDK imports on whether any guardfile actually uses ssm. base-url-via-value flows through the same map. This is where the real hardcoded SSM hydration lived. ## Motivating non-ssm case `base-url { value tailscale "open-webui" }` resolves a tailnet host live via `tailscale ip -4`, dropping an SSM entry. v0.x break; ward/coily re-bump along the dependency arrow.

coilysiren referenced this issue from a commit

2026-06-17 20:55:05 +00:00

feat(specverb): generalize auth/base-url to pluggable value-source providers

coilysiren closed this issue

2026-06-17 20:55:05 +00:00

coilysiren referenced this issue from coilyco-flight-deck/ward

2026-06-17 20:56:25 +00:00

Migrate guardfiles to value-source grammar on next cli-guard bump #115