promptStringOnce equivalent for retrieving passwords

[tessus]

The documentation gives the following example for .chezmoi.yaml.tmpl:

{{ $email := promptStringOnce . "email" "What is your email address" -}}

data:
    email: {{ $email | quote }}

I would like to do something similar to this:

{{ $some_token := retrievePwdOnce "some_token" (rbw "test-entry").data.password -}}

data:
    some_token: {{ $some_token | quote }}

gh_token would only be retrieved, if it wasn't set in the config file. Or is something like this already supported? The reason for this is simple: I don't want to access my password backend for every single apply.

[halostatue]

Yes. You can use the existing rbw* functions in .chezmoi.$FORMAT.tmpl templates.

You probably shouldn't, though, for security hygiene. If your token is updated you will need to remember to do a chezmoi init before you'll see an update.

You're already using the more secure Bitwarden client that also has support for session tokens, so if you need to run the updates frequently in a row, you won't need to reenter your vault password.

[tessus]

Thanks for the reply. Unfortunately this was not what I asked.
I know that I can do that.

But....

This means, the rbw client is used and queried every time I do a chezmoi apply.

My use case is that I want to get the data from the password backend once, as the promptOnce function does with strings.
It asks you for input, if it is not set.

I even provided a sample pseudo invocation:

{{ $some_token := retrievePwdOnce "some_token" (rbw "test-entry").data.password -}}

So, instead of asking for a manual string input, if it is not set, it rather grabs the string from the password backend.

Re security. It doesn't matter, if I have the clear text passwords only in the config files all over my home dir, or if these passwords are also in the chezmoi config file. The point is, if they are in the config file, I don't need to access the password backend anymore. That is, if something like the retrievePwdOnce function exists.

[halostatue]

I will reiterate that it's a bad idea.

However, you can do something like:

{{ $token := get . "github_token" }}
{{ if not $token }}
{{   $token = /* whatever */ }}
{{ end }}

[data]
github_token = {{ $token | quote }}