fix: restrict secretFile path

cmd/layotto/main.go

@@ -34,6 +34,7 @@ import (
 
 	"mosn.io/layotto/pkg/grpc/default_api"
 	secretstores_loader "mosn.io/layotto/pkg/runtime/secretstores"
+	secretstores_local "mosn.io/layotto/pkg/runtime/secretstores/local"
 
 	"mosn.io/layotto/components/file/local"
 	"mosn.io/layotto/components/file/s3/alicloud"
@@ -440,12 +441,13 @@ func NewRuntimeGrpcServer(data json.RawMessage, opts ...grpc.ServerOption) (mgrp
 				return gcp_secretmanager.NewSecreteManager(loggerForDaprComp)
 			}),
 			secretstores_loader.NewFactory("local.file", func() secretstores.SecretStore {
-				return secretstore_file.NewLocalSecretStore(loggerForDaprComp)
+				return secretstores_local.Wrap(secretstore_file.NewLocalSecretStore(loggerForDaprComp))
 			}),
 			secretstores_loader.NewFactory("local.env", func() secretstores.SecretStore {
 				return secretstore_env.NewEnvSecretStore(loggerForDaprComp)
 			}),
-		))
+		),
+	)
 	return server, err
 }
 

cmd/layotto_multiple_api/main.go

@@ -22,6 +22,8 @@ import (
 	"strconv"
 	"time"
 
+	secretstores_local "mosn.io/layotto/pkg/runtime/secretstores/local"
+
 	"github.com/dapr/components-contrib/secretstores"
 	"github.com/dapr/components-contrib/secretstores/aws/parameterstore"
 	"github.com/dapr/components-contrib/secretstores/aws/secretmanager"
@@ -429,7 +431,7 @@ func NewRuntimeGrpcServer(data json.RawMessage, opts ...grpc.ServerOption) (mgrp
 				return gcp_secretmanager.NewSecreteManager(loggerForDaprComp)
 			}),
 			secretstores_loader.NewFactory("local.file", func() secretstores.SecretStore {
-				return secretstore_file.NewLocalSecretStore(loggerForDaprComp)
+				return secretstores_local.Wrap(secretstore_file.NewLocalSecretStore(loggerForDaprComp))
 			}),
 			secretstores_loader.NewFactory("local.env", func() secretstores.SecretStore {
 				return secretstore_env.NewEnvSecretStore(loggerForDaprComp)

configs/config.json

@@ -57,8 +57,9 @@
                       },
                       "secret_store": {
                         "secret_demo": {
-                          "type": "local.env",
+                          "type": "local.file",
                           "metadata": {
+                            "secretsFile": "secret_local_file.json"
                           }
                         }
                       },

configs/config_standalone.json

@@ -59,7 +59,7 @@
                         "secret_demo": {
                           "type": "local.file",
                           "metadata": {
-                            "secretsFile": "../../configs/secret/config_secret_local_file.json"
+                            "secretsFile": "secret_local_file.json"
                           }
                         },
                         "secret_demo1": {

docs/en/component_specs/secret/common.md

@@ -30,7 +30,7 @@ Configuration examples of local file keys, local environment variables, and k8s
                         "secret_demo": {
                           "type": "local.file",
                           "metadata": {
-                            "secretsFile": "../../configs/config_secret_local_file.json"
+                            "secretsFile": "secret_local_file.json"
                           }
                         },
                         "secret_demo1": {

docs/en/operation/README.md

@@ -22,7 +22,7 @@ You can run Layotto using the official Docker images.Currently include:
 It does not contain a `config.json` configuration file in the image, you can mount your own configuration file into the `/runtime/configs/` directory of the image. For example.
 
 ```shell
-docker run -v "$(pwd)/configs/config.json:/runtime/configs/config.json" -d  -p 34904:34904 --name layotto layotto/layotto start
+docker run -v "$(pwd)/configs/:/runtime/configs/" -d  -p 34904:34904 --name layotto layotto/layotto start
 ```
 
 Of course, you can also run Layotto and other systems (such as Redis) at the same time via docker-compose. Refer to the [Quick start](en/start/state/start?id=step-1-deploy-redis-and-layotto)

docs/en/start/secret/start.md

@@ -1,4 +1,4 @@
-# use Secret API to obtain secret
+# use Secret API to query secrets
 ## What is Secret API
 The secret API is used to obtain secret from file, env, k8s, etc
 

docs/zh/component_specs/secret/common.md

@@ -31,7 +31,7 @@ json配置文件有如下结构：
                         "secret_demo": {
                           "type": "local.file",
                           "metadata": {
-                            "secretsFile": "../../configs/config_secret_local_file.json"
+                            "secretsFile": "secret_local_file.json"
                           }
                         },
                         "secret_demo1": {

docs/zh/operation/README.md

@@ -17,7 +17,15 @@ Layotto 提供了官方 Docker 镜像，包括：
 镜像内不包含 `config.json` 配置文件，您可以将自己的配置文件挂载进镜像的`/runtime/configs/config.json`目录, 然后启动镜像。例如：
 
 ```shell
-docker run -v "$(pwd)/configs/config.json:/runtime/configs/config.json" -d  -p 34904:34904 --name layotto layotto/layotto start
+docker run -v "$(pwd)/configs/:/runtime/configs/" -d  -p 34904:34904 --name layotto layotto/layotto start
+```
+
+可以运行 demo 测试效果:
+
+```shell
+ cd demo/sequencer/common/
+ go build -o client
+ ./client -s "sequencer_demo"
 ```
 
 您也可以通过 docker-compose 同时启动 Layotto 和 其他系统（比如 Redis)，参考[快速开始](zh/start/state/start?id=step-1-%e5%90%af%e5%8a%a8-redis-%e5%92%8c-layotto)

etc/script/test-quickstart.sh

@@ -39,6 +39,7 @@ quickstarts_in_default="docs/en/start/configuration/start.md
   docs/zh/start/wasm/start.md
   docs/en/start/secret/start.md
   docs/zh/start/secret/start.md
+  docs/zh/operation/README.md
 "
 
 # In advance mod, we test these docs with golang 1.17

pkg/runtime/secretstores/local/wrapper.go

@@ -0,0 +1,65 @@
+/*
+ * Copyright 2021 Layotto Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package secret
+
+import (
+	"os"
+	"strings"
+
+	"github.com/dapr/components-contrib/secretstores"
+)
+
+type wrapper struct {
+	prefix string
+	comp   secretstores.SecretStore
+}
+
+func (w *wrapper) Init(metadata secretstores.Metadata) error {
+	if metadata.Properties != nil {
+		metadata.Properties["secretsFile"] = w.prefix + metadata.Properties["secretsFile"]
+	}
+	return w.comp.Init(metadata)
+}
+
+func (w *wrapper) GetSecret(req secretstores.GetSecretRequest) (secretstores.GetSecretResponse, error) {
+	return w.comp.GetSecret(req)
+}
+
+func (w *wrapper) BulkGetSecret(req secretstores.BulkGetSecretRequest) (secretstores.BulkGetSecretResponse, error) {
+	return w.comp.BulkGetSecret(req)
+}
+
+func Wrap(component secretstores.SecretStore) secretstores.SecretStore {
+	return &wrapper{
+		comp:   component,
+		prefix: getPrefixConfigFilePath(),
+	}
+}
+
+func getPrefixConfigFilePath() string {
+	prefix := ""
+	for i, str := range os.Args {
+		if str == "-c" || str == "-config" {
+			strs := strings.Split(os.Args[i+1], string(os.PathSeparator))
+			for _, s := range strs[:len(strs)-1] {
+				prefix = prefix + s + string(os.PathSeparator)
+			}
+			break
+		}
+	}
+	return prefix
+}