feat: support Pass-Secrets mapped names - #148
Conversation
![forkline-dev[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
|
✅ Fix pushed: The fix was already applied and pushed in commit |
|
Fixed both compilation errors: replaced |
|
Fixed compilation error: |
Replace stdlib runCatching with explicit try-catch for IOException to satisfy slack-lint DenyListedApi rule that flags runCatching in coroutine contexts due to CancellationException handling.
The aliases List<String> comparison in areContentsTheSame is safe because Kotlin's List implements equals() with element-wise comparison.
…Service Satisfies slack-lint ExceptionMessage rule requiring lazyMessage param.
Satisfies slack-lint ExceptionMessage rule requiring lazyMessage param.
|
❌ CI Fix Failed I was unable to automatically fix the CI failure. Please review the CI logs and fix the issue manually. Runner: 9b2b |
1 similar comment
|
❌ CI Fix Failed I was unable to automatically fix the CI failure. Please review the CI logs and fix the issue manually. Runner: 9b2b |
These strings were used by the old moveFile function which was replaced by the PassSecrets-aware move implementation.
|
❌ CI Fix Failed I was unable to automatically fix the CI failure. Please review the CI logs and fix the issue manually. Runner: 9b2b |
|
❌ CI Fix Failed I was unable to automatically fix the CI failure. Please review the CI logs and fix the issue manually. Runner: 9b2b |
|
Removed 3 unused string resources ( |
|
Removed unused string resource |
1 participant
Summary
Implements automatic, lazy read-path support for Pass-Secrets (
.secrets.gpg) identity maps..secrets.gpgautomatically at the nearest.gpg-idboundary; no setting or repository migration is required.gpg-idboundary.secrets.gpgand.mask.gpgfrom password listings even when hidden contents are enabledActivation / UX
Support is capability-detected from the repository structure. Entering an identity that contains both
.gpg-idand.secrets.gpgclaims that map for lazy unlock. If the user cancels or it cannot be decrypted, APS falls back to the physical codenames and does not repeatedly prompt for the same map version.Nested identities remain independent trust boundaries. A child
.gpg-idwithout its own.secrets.gpgnever falls back to its parent's map.Tests
Adds coverage for:
.gpg-idbut no.secrets.gpg=in descriptionsThe existing full unit-test suite and passkey compatibility suite also exercise the changed model/search code paths.
Scope
This PR is intentionally read-path focused. It does not make mutations (create/rename/move/delete) update
.secrets.gpg, and it does not index.mask.gpgaliases yet. Those should be follow-ups rather than mixing map-aware CRUD into the initial compatibility layer.For repositories with multiple independently protected identity maps, logical-name search can only use mappings that are unlocked in the current process; APS deliberately does not trigger a chain of authentication prompts for every nested identity merely to perform a global search.
Closes #145