Mechanism for secrets in plugin configuration

[simonw]

See simonw/datasette-auth-github#1

We need a mechanism where by plugins can tap into "secret" config options without exposing them in the visible metadata.json (where plugin configs currently live, see https://datasette.readthedocs.io/en/stable/plugins.html#plugin-configuration )

[simonw]

Initial syntax suggestion:

{
    "title": "datasette-auth-github demo",
    "plugins": {
        "datasette-auth-github": {
            "client_id": "986f5d837b45e32ee6dd",
            "client_secret": {"$env": "GITHUB_CLIENT_SECRET"}
        }
    }
}

[simonw]

Another useful option is the ability to load secrets from a file. This allows the file to have permissions set on it to only be read by the Datasette user. It also interacts well with the Kubernetes secrets mechanism, which is file-based.

{
    "plugins": {
        "datasette-auth-github": {
            "client_id": "986f5d837b45e32ee6dd",
            "client_secret": {"$file": "/secrets/github-client-secret"}
        }
    }
}

[simonw]

Re-opening this because I messed it up: the secret options are still visible in /-/metadata because I mutate the dictionary in place!

datasette/datasette/app.py

Lines 273 to 279 in a2d4593

	if isinstance(plugin_config, dict):
	for key, value in plugin_config.items():
	if isinstance(value, dict):
	if list(value.keys()) == ["$env"]:
	plugin_config[key] = os.environ.get(list(value.values())[0])
	elif list(value.keys()) == ["$file"]:
	plugin_config[key] = open(list(value.values())[0]).read()