encryption

package

v0.4.0 Latest Latest Go to latest Published: Oct 12, 2026 License: MIT Imports: 5 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/Ovi1kanobe/appkit

Links

Open Source Insights

Documentation ¶

Overview ¶

Package encryption encrypts credentials an application stores in its database, such as provider API keys, with the application's master key.

It protects a leaked database file or backup, not a compromised running server. Losing the master key loses every value encrypted with it.

Index ¶

Variables
type Key
- func ParseKey(encoded string) (*Key, error)
- func (key *Key) Decrypt(label string, sealed []byte) (string, error)
- func (key *Key) Encrypt(label, plaintext string) []byte

Constants ¶

This section is empty.

Variables ¶

View Source

var ErrDecrypt = errors.New("encryption: cannot decrypt value")

ErrDecrypt means the value was altered, encrypted under another label, or encrypted with another key.

Functions ¶

This section is empty.

Types ¶

type Key ¶

type Key struct {
	// contains filtered or unexported fields
}

Key encrypts and decrypts values with AES-256-GCM.

func ParseKey ¶

func ParseKey(encoded string) (*Key, error)

ParseKey reads a base64-encoded 32-byte key, as made by `openssl rand -base64 32`.

func (*Key) Decrypt ¶

func (key *Key) Decrypt(label string, sealed []byte) (string, error)

Decrypt opens a value made by Encrypt with the same label.

func (*Key) Encrypt ¶

func (key *Key) Encrypt(label, plaintext string) []byte

Encrypt seals plaintext and binds it to label, which names where the value is stored, such as "billing.stripe_key" plus the row ID. Decrypt needs the same label, so a value copied to another row or field fails to decrypt.

Source Files ¶

View all Source files

encryption.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL