SecretFiles

THE FILES OF A HOUSE THAT HOLD SECRETS — a secret has one place to live. A reading operation of this package returns a slice of a file inside the app root; the files where the house keeps a secret — its environment file and the family beside it (`.env`, `.env.local`, `.env.production`…), the envelope a declared key is written to, and Composer's credentials — are not handed back, nor a copy a trial or a boot candidate kept. The rule that NAMES those files is milpa/app-runtime's: a `.env*` basename (bar the committed templates) at any depth, and `.milpa/secrets.json` / `auth.json` at any depth, compared case-insensitively — this package keeps the same rule so the two never disagree on WHICH files are secret. {@see holds()} asks that rule about the file each path resolves to, and ADDS a device+inode check so an operator hardlink to a secret under an innocent name is caught too. It never NARROWS the rule: a directory that cannot be listed fails CLOSED (the file is withheld).

public static function isSecret(string $relative): bool

Whether a path from the root of a house NAMES a file the house keeps a secret in — the `.env` family (bar the templates) and the envelope / Composer credentials, at ANY depth, case-insensitively. This is the rule milpa/app-runtime keeps; {@see holds()} asks it about the file a path resolves to.

Parameters

public static function holds(string $file, string $root): bool

Whether a file already admitted by {@see SourcePath::inside()} is one the house keeps a secret in. The union of three legs, so none NARROWS the published rule (greenhouse decisions/0618): - the published name rule over the caller's path exactly — the FLOOR: whatever 0.44.2 refused by name, at any depth, is refused; - the same name rule over the file each path resolves to (its stored-name path), so two spellings of one file get one answer; - the file's device+inode against the house's real root/copy-root secret files — adds a hardlink under an innocent name, and a root/copy-root secret the name rule does not otherwise recognise. A path whose directory cannot be listed is withheld (fail closed).

Parameters

public static function identityInSet(array $inodes, int $dev, int $ino): bool

Whether ($dev, $ino) is in the set — both numbers compared, so a file on another device with the same inode NUMBER as a secret is not mistaken for it. The one place that comparison lives, so a test pins it.

Parameters