Delete the value for a specified key in the keystore.
Recursively walks the stored (unresolved) structure for key and deletes every OS-native
secret referenced - at any depth - via SecretService, before removing the key itself.
Write any pending changes to storage now and mark them clean, so they are not written again unless further changes are made.
Get the value for a specified key in the keystore.
Recursively resolves any string leaf - at any depth within the stored value - which is a secret sentinel, retrieving its actual value via SecretService. This covers both values written via set using a nested Secret, and secret references a user hand-embeds directly (nested arbitrarily deep) in the CLI's JSON config file.
Check if a value for a specified key exists in the keystore.
Set a value for a specified key in the keystore.
Any node within value wrapped in Secret - at any depth - is serialized as JSON and
stored as an OS-native secret via SecretService, with a sentinel reference kept in
its place in the stored structure. All other data is stored as plain (unencrypted) config
data. Storing a secret requires that the service was constructed with secret support
enabled.
Service providing keystore functionality for the CLI. The keystore data is scoped to the service or Command instances accessing this service via Context.getServiceById.
Values are arbitrary JSON-serializable data (see ValueNode) - not limited to strings - and may be deep objects or arrays.
Any node within a value passed to set can be wrapped in Secret to have that node - and only that node - stored as an OS-native secret via SecretService, with a sentinel reference (prefixed with
__SECRET__:) kept in its place in the stored structure. Everything else in the value is stored as plain (unencrypted) config data. This is symmetric with get, which resolves sentinel references found at any depth.