feat(canary): envfile bait recipes (aws/stripe/github/db)
Phase 7 first commit. Four recipes for generating realistic-looking
credentials that pass syntactic validation by tools like gitleaks but
are NOT real credentials — they're decoration that makes the env file
look like a legitimate prod config dump. The detection mechanism is
the canary URL embedded by the generator (next commit); the bait keys
themselves don't trigger anything.
Package layout (sub-package under envfile/):
- recipes.go: EnvLine, Recipe interface, internal registry, shared
crypto/rand helpers (RandomAlnumUpper / RandomAlnumMixed /
RandomHexLower / RandomBase64 / RandomChoice). All randomness
uses crypto/rand — no math/rand or gosec G404 fight, matches the
Phase 0 supplement's discipline.
- aws.go: AKIA + 16 [A-Z0-9] body (gitleaks regex
`AKIA[0-9A-Z]{16}`) + 40+ base64-encoded secret + canonical
region (us-east-1 etc.) + stable S3 bucket name
- stripe.go: sk_live_/pk_live_/whsec_ prefixes with 24/24/32-char
[A-Za-z0-9] bodies (matches Stripe's documented live-key format)
- github.go: ghp_ + 36 base62 body + 6 base62 "checksum" = 42 chars
after the prefix (matches gitleaks
`ghp_[0-9a-zA-Z]{36,255}`); plus base64 deploy-key, stable owner +
repo names (acme-corp / internal-platform)
- db.go: postgres://app_writer:<24-char pass>@db.internal:5432/
app_prod?sslmode=require + redis://default:<32-char pass>@
cache-prod.internal:6379/0 — realistic internal-DNS-style
hostnames per spec §9.6 "Bait realism principles"
Public API:
- recipes.Get(key) (Recipe, bool) — registry lookup
- recipes.AvailableKeys() []string — sorted snapshot
- Recipe types (AWS, Stripe, GitHub, DB) exported so callers can
construct them directly if needed (registry is the normal path)
Tests (~30 cases): one test file per recipe plus shared helpers.
- Format-regex assertions: AKIA + base32-upper, sk_live_/pk_live_/
whsec_ + base62, ghp_ + base62, region xx-name-n
- URL parsing for postgres + redis (real net/url validation, not
string matching)
- Distinct-invocations checks (20 calls → near-20 unique secrets)
- Helper coverage: RandomAlnumUpper/Mixed/HexLower/Base64/Choice
length + alphabet + empty-input handling
Recipes package compiles + tests pass in isolation. Generator and
registry wire-up land in next commits.
go test -race -timeout=60s ./internal/token/generators/envfile/recipes/...
passes with 0 lint issues.
003aa9970c