secrets

package

v0.4.2 Latest Latest Go to latest Published: Oct 30, 2026 License: Apache-2.0 Imports: 15 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/KarakoramDev/Karakoram

Links

Open Source Insights

Documentation ¶

Index ¶

func Hash(token string) string
func KeyedHash(key, value []byte) string
func Keyfile() (string, error)
func Password() (string, error)
func RandomString(length int) (string, error)
func SCRAMVerifier(password string) (string, error)
func Token() (string, error)
type Sealer
- func FromEnv() (*Sealer, error)
- func New(masterKey string) (*Sealer, error)

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func Hash ¶

func Hash(token string) string

Hash returns the hexadecimal SHA-256 digest used for token lookup.

func KeyedHash ¶ added in v0.2.0

func KeyedHash(key, value []byte) string

KeyedHash returns a versioned HMAC-SHA256 receipt. Callers must use a secret high-entropy key and domain-separate values when sharing a credential key.

func Keyfile ¶

func Keyfile() (string, error)

Keyfile generates exactly 756 base64 characters for MongoDB internal authentication.

func Password ¶

func Password() (string, error)

Password generates a cryptographically random 40-character password.

func RandomString ¶

func RandomString(length int) (string, error)

RandomString generates unbiased alphanumeric characters using crypto/rand.

func SCRAMVerifier ¶ added in v0.2.0

func SCRAMVerifier(password string) (string, error)

SCRAMVerifier derives a PostgreSQL verifier so plaintext passwords never enter SQL.

func Token ¶

func Token() (string, error)

Token generates a cryptographically random kk_-prefixed API token.

Types ¶

type Sealer ¶

type Sealer struct {
	// contains filtered or unexported fields
}

Sealer encrypts secrets and authenticates idempotency digests with separate master-key-derived keys.

func FromEnv ¶

func FromEnv() (*Sealer, error)

FromEnv loads the encryption master key from KARAKORAM_MASTER_KEY.

func New ¶

func New(masterKey string) (*Sealer, error)

New derives a sealer from a master key of at least 32 characters.

func (*Sealer) Fingerprint ¶ added in v0.4.0

func (s *Sealer) Fingerprint() string

Fingerprint identifies a master key without exposing encryption key material.

func (*Sealer) IdempotencyBodyHash ¶

func (s *Sealer) IdempotencyBodyHash(body []byte) string

IdempotencyBodyHash prevents offline guessing of password-bearing JSON bodies from a database copy without the installation's master key.

func (*Sealer) IdempotencyIdentityHash ¶

func (s *Sealer) IdempotencyIdentityHash(scope []byte) string

IdempotencyIdentityHash hides caller-provided retry keys using a separate key.

func (*Sealer) MCPConfirmationHash ¶ added in v0.3.0

func (s *Sealer) MCPConfirmationHash(value []byte) string

MCPConfirmationHash authenticates MCP confirmation state with a dedicated key.

func (*Sealer) MCPIdempotencyHash ¶ added in v0.3.0

func (s *Sealer) MCPIdempotencyHash(value []byte) string

MCPIdempotencyHash derives retry identities independently of confirmation state.

func (*Sealer) Open ¶

func (s *Sealer) Open(value string) ([]byte, error)

Open authenticates and decrypts a versioned secret.

func (*Sealer) OpenFor ¶

func (s *Sealer) OpenFor(identity, value string) ([]byte, error)

OpenFor decrypts a secret only for its bound storage identity.

func (*Sealer) Seal ¶

func (s *Sealer) Seal(plaintext []byte) (string, error)

Seal encrypts a secret without an additional storage identity.

func (*Sealer) SealFor ¶

func (s *Sealer) SealFor(identity string, plaintext []byte) (string, error)

SealFor binds a ciphertext to its storage identity to prevent substitution.

Source Files ¶

View all Source files

secrets.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL