feat(mcporter): SSM-backed SecretResolver #98

New issue

Closed

opened 2026-06-07 04:07:43 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-06-07 04:07:43 +00:00

Owner

Extraction candidate from the coily cmd/coily/ generic-code audit (2026-06-06). Source pinned at coily commit c7c17cb (canonical: forgejo.coilysiren.me/coilyco-bridge/coily). cli-guard is mid-refactor, so the "suggested home" below is the pre-refactor package layout - land this in whatever the post-refactor equivalent is, not necessarily the named package. The durable principle: the classifiers / argv-transforms are generic and move; the policy decisions and message copy stay in coily.

Source: cmd/coily/ssm_resolver.go - getSSMParameter, envFromSSMResolver, ssmPathFromEnvName. Implements mcporter.SecretResolver.

What it does: resolves an env-var name from the parent env, else from AWS SSM get-parameter (env-name -> path: lowercase, _->/, leading slash), with ParameterNotFound soft-fail and a TTL file cache. getSSMParameter/envFromSSMResolver lift as-is.

Consumer seams to parameterize: the cache path ~/.cache/coily/ssm.json (the coily segment) -> caller arg; the env-name->SSM-path convention (ssmPathFromEnvName) -> a func(string) string so a consumer with a different convention adapts. No /coilysiren/ prefix is hardcoded - it is derived from the env name, so the logic is already portable.

Suggested home (pre-refactor): extend mcporter (already home to SecretResolver/WithTTLCache/ResolverFunc); ship an SSM-backed resolver, or a small ssmresolve package.

Done when:

generic logic lives in cli-guard with zero coily/Kai/Forgejo identifiers or defaults
behavior-covered tests (table tests where the source has them)
godoc-current.txt regenerated (scripts/check-godoc-current.sh --update)
coily migrated onto the extracted API, its local copy deleted, make test green both sides
closes this issue

> Extraction candidate from the coily `cmd/coily/` generic-code audit (2026-06-06). Source pinned at coily commit `c7c17cb` (canonical: `forgejo.coilysiren.me/coilyco-bridge/coily`). **cli-guard is mid-refactor**, so the "suggested home" below is the pre-refactor package layout - land this in whatever the post-refactor equivalent is, not necessarily the named package. The durable principle: **the classifiers / argv-transforms are generic and move; the policy decisions and message copy stay in coily.** **Source:** `cmd/coily/ssm_resolver.go` - `getSSMParameter`, `envFromSSMResolver`, `ssmPathFromEnvName`. Implements `mcporter.SecretResolver`. **What it does:** resolves an env-var name from the parent env, else from AWS SSM `get-parameter` (env-name -> path: lowercase, `_`->`/`, leading slash), with `ParameterNotFound` soft-fail and a TTL file cache. `getSSMParameter`/`envFromSSMResolver` lift as-is. **Consumer seams to parameterize:** the cache path `~/.cache/coily/ssm.json` (the `coily` segment) -> caller arg; the env-name->SSM-path convention (`ssmPathFromEnvName`) -> a `func(string) string` so a consumer with a different convention adapts. No `/coilysiren/` prefix is hardcoded - it is derived from the env name, so the logic is already portable. **Suggested home (pre-refactor):** extend `mcporter` (already home to `SecretResolver`/`WithTTLCache`/`ResolverFunc`); ship an SSM-backed resolver, or a small `ssmresolve` package. **Done when:** - [ ] generic logic lives in cli-guard with zero coily/Kai/Forgejo identifiers or defaults - [ ] behavior-covered tests (table tests where the source has them) - [ ] `godoc-current.txt` regenerated (`scripts/check-godoc-current.sh --update`) - [ ] coily migrated onto the extracted API, its local copy deleted, `make test` green both sides - [ ] `closes` this issue

coilysiren added the

label

2026-06-17 07:05:07 +00:00

coilysiren commented

2026-06-17 08:23:21 +00:00

Author

Owner

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: burndown-2026-06.

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: `burndown-2026-06`.

coilysiren

2026-06-17 08:23:22 +00:00