Documentation
¶
Overview ¶
Package secrets provides a forward-compatible interface for secret storage.
All API keys, OAuth tokens, webhook secrets, and other credential material flows through Store. The current implementation (LocalStore) wraps the in-process AES-256-GCM crypto package and stores ciphertext inline in resource columns. A future enterprise build can swap in a Vault-backed implementation without touching call sites.
The ref argument on every method names the secret with a path-like identifier — e.g. "connection/<id>/access_token". LocalStore ignores it (the ciphertext is self-contained), but call sites should pass a stable, unique ref so a future remote store can route to the correct location.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type LocalStore ¶
type LocalStore struct {
// contains filtered or unexported fields
}
LocalStore implements Store using AES-256-GCM with versioned keys. ref is accepted for API symmetry but ignored — the ciphertext blob is self-contained.
func NewLocal ¶
func NewLocal(enc *crypto.Encryptor) *LocalStore
NewLocal wraps a crypto.Encryptor as a Store. enc must be non-nil.
type Store ¶
type Store interface {
// Put encrypts plaintext and returns a value the caller persists
// alongside the owning resource row. The returned value is opaque to
// callers — its format depends on the implementation.
Put(ctx context.Context, ref, plaintext string) (string, error)
// Get returns the plaintext given a value previously returned by Put.
Get(ctx context.Context, ref, stored string) (string, error)
}
Store is the interface for storing and retrieving secret material.
Source Files