Documentation
¶
Overview ¶
Package encryptioncontext stores ephemeral private keys generated by the `com.datadoghq.remoteaction.internal.prepareEncryption` action so that a subsequent task on the same runner can retrieve and use them to decrypt per-task secret inputs.
Index ¶
Constants ¶
const DefaultTTL = 5 * time.Minute
DefaultTTL is how long a key remains retrievable after being stored, when using NewStore.
const KeyTypeHPKE = "hpke-p256-hkdf-sha256-aes256gcm"
Variables ¶
This section is empty.
Functions ¶
func Decrypt ¶
func Decrypt(store *Store, encryptionContext EncryptionContext, encryptedInput string) (string, error)
Decrypt opens the base64-encoded, HPKE-sealed encryptedInput using the private key evicted from store for encryptionContext.
func DecryptInto ¶
func DecryptInto[T any](store *Store, encryptionContext EncryptionContext, encryptedInput string) (T, error)
DecryptInto decrypts encryptedInput like Decrypt, then unmarshals the JSON plaintext into T.
Types ¶
type EncryptionContext ¶
type EncryptionContext struct {
KeyType string `json:"keyType"`
EncryptionContextID string `json:"encryptionContextId"`
}
EncryptionContext identifies the key pair an input was sealed with.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store keeps private keys indexed by encryptionContextID, evicted after their TTL elapses or once explicitly deleted.
func NewStoreWithTTL ¶
NewStoreWithTTL returns an in-memory Store. ttl is how long a key remains retrievable after being stored.
func (*Store) GetAndDelete ¶
func (store *Store) GetAndDelete(encryptionContextID string) (hpke.PrivateKey, bool)
GetAndDelete retrieves and evicts the entry for encryptionContextID. Returns (nil, false) if no live entry exists.
func (*Store) Set ¶
func (store *Store) Set(encryptionContextID string, privateKey hpke.PrivateKey)
Set stores privateKey under encryptionContextID, overwriting any existing entry.
Source Files