commands

func CloseContainer ¶ added in v0.23.0

func CloseContainer(container *app.Container, logger *slog.Logger)

CloseContainer closes all resources in the container and logs any errors.

func CloseMigrate ¶ added in v0.23.0

func CloseMigrate(migrate *migrate.Migrate, logger *slog.Logger)

CloseMigrate closes the migration instance and logs any errors.

func ExecuteWithContainer ¶ added in v0.23.0

func ExecuteWithContainer(
	ctx context.Context,
	fn func(ctx context.Context, container *app.Container) error,
) error

ExecuteWithContainer encapsulates the standard CLI command execution pattern: loading configuration, initializing the DI container, and ensuring graceful shutdown.

func ParseAlgorithm ¶ added in v0.23.0

func ParseAlgorithm(algorithmStr string) (cryptoDomain.Algorithm, error)

ParseAlgorithm converts algorithm string to cryptoDomain.Algorithm type.

func ParseFormatType ¶ added in v0.23.0

func ParseFormatType(formatType string) (tokenizationDomain.FormatType, error)

ParseFormatType converts format type string to tokenizationDomain.FormatType.

func RunCleanAuditLogs ¶ added in v0.2.0

func RunCleanAuditLogs(
	ctx context.Context,
	auditLogUseCase authUseCase.AuditLogUseCase,
	logger *slog.Logger,
	writer io.Writer,
	days int,
	dryRun bool,
	format string,
) error

RunCleanAuditLogs deletes audit logs older than the specified number of days. Supports dry-run mode and multiple output formats.

func RunCleanExpiredTokens ¶ added in v0.4.0

func RunCleanExpiredTokens(
	ctx context.Context,
	tokenizationUseCase tokenizationUseCase.TokenizationUseCase,
	logger *slog.Logger,
	writer io.Writer,
	days int,
	dryRun bool,
	format string,
) error

RunCleanExpiredTokens deletes expired tokens older than the specified number of days. Supports dry-run mode and multiple output formats.

func RunCreateClient ¶

func RunCreateClient(
	ctx context.Context,
	clientUseCase authUseCase.ClientUseCase,
	logger *slog.Logger,
	name string,
	isActive bool,
	policiesJSON string,
	format string,
	io IOTuple,
) error

RunCreateClient creates a new authentication client with policies. Supports both interactive mode (when policiesJSON is empty) and non-interactive mode (when policiesJSON is provided).

func RunCreateKek ¶

func RunCreateKek(
	ctx context.Context,
	kekUseCase cryptoUseCase.KekUseCase,
	masterKeyChain *cryptoDomain.MasterKeyChain,
	logger *slog.Logger,
	algorithmStr string,
) error

RunCreateKek creates a new Key Encryption Key (KEK) and encrypts it with the master key. The new KEK will be stored in the database and marked as active for its algorithm.

func RunCreateMasterKey ¶

func RunCreateMasterKey(
	ctx context.Context,
	kmsService cryptoDomain.KMSService,
	logger *slog.Logger,
	writer io.Writer,
	keyID string,
	kmsProvider string,
	kmsKeyURI string,
) error

RunCreateMasterKey generates a cryptographically secure 32-byte master key for envelope encryption. Creates the root key used to encrypt all KEKs. Key material is zeroed from memory after encoding. If keyID is empty, generates a default ID in format "master-key-YYYY-MM-DD".

KMS parameters (kmsProvider and kmsKeyURI) are required. The master key is encrypted with KMS before output. For local development, use kmsProvider="localsecrets" with kmsKeyURI="base64key://...".

Output format:

• MASTER_KEYS="<keyID>:<base64-encoded-kms-ciphertext>"
• KMS_PROVIDER="<provider>"
• KMS_KEY_URI="<uri>"

Security: Never use localsecrets provider in production. Use cloud KMS providers (gcpkms, awskms, azurekeyvault).

func RunCreateTokenizationKey ¶ added in v0.4.0

func RunCreateTokenizationKey(
	ctx context.Context,
	tokenizationKeyUseCase tokenizationUseCase.TokenizationKeyUseCase,
	logger *slog.Logger,
	name string,
	formatTypeStr string,
	isDeterministic bool,
	algorithmStr string,
) error

RunCreateTokenizationKey creates a new tokenization key with the specified parameters. Should be run during initial setup or when adding new tokenization formats.

func RunMigrations ¶

func RunMigrations(logger *slog.Logger, dbDriver, dbConnectionString string) error

RunMigrations executes database migrations based on the configured driver. Determines migration path from DBDriver (postgresql or mysql) and applies all pending migrations. Returns nil if no migrations to apply. Logs migration progress and success.

func RunRewrapDeks ¶ added in v0.12.0

func RunRewrapDeks(
	ctx context.Context,
	masterKeyChain *cryptoDomain.MasterKeyChain,
	kekUseCase cryptoUseCase.KekUseCase,
	dekUseCase cryptoUseCase.DekUseCase,
	logger *slog.Logger,
	kekIDStr string,
	batchSize int,
) error

RunRewrapDeks finds all DEKs that are not encrypted with the specified KEK ID and re-encrypts them with the specified KEK in batches.

func RunRotateKek ¶

func RunRotateKek(
	ctx context.Context,
	kekUseCase cryptoUseCase.KekUseCase,
	masterKeyChain *cryptoDomain.MasterKeyChain,
	logger *slog.Logger,
	algorithmStr string,
) error

RunRotateKek rotates the Key Encryption Key (KEK) for a specific algorithm. Generates a new KEK version and marks it as active. Existing secrets encrypted with old KEKs remain valid until rewrapped.

func RunRotateMasterKey ¶ added in v0.6.0

func RunRotateMasterKey(
	ctx context.Context,
	kmsService cryptoDomain.KMSService,
	logger *slog.Logger,
	writer io.Writer,
	keyID, kmsProvider, kmsKeyURI, existingMasterKeys, existingActiveKeyID string,
) error

func RunRotateTokenizationKey ¶ added in v0.4.0

func RunRotateTokenizationKey(
	ctx context.Context,
	tokenizationKeyUseCase tokenizationUseCase.TokenizationKeyUseCase,
	logger *slog.Logger,
	name string,
	formatTypeStr string,
	isDeterministic bool,
	algorithmStr string,
) error

RunRotateTokenizationKey rotates an existing tokenization key to a new version. Updates format and deterministic settings. Existing tokens remain valid until rotated.

func RunServer ¶

func RunServer(ctx context.Context, version string) error

RunServer starts the HTTP server with graceful shutdown support. Loads configuration, initializes the DI container, and starts the Gin HTTP server. Blocks until receiving SIGINT/SIGTERM or encountering a fatal error. On shutdown signal, gracefully stops the server within DBConnMaxLifetime timeout.

func RunUpdateClient ¶

func RunUpdateClient(
	ctx context.Context,
	clientUseCase authUseCase.ClientUseCase,
	logger *slog.Logger,
	io IOTuple,
	clientIDStr string,
	name string,
	isActive bool,
	policiesJSON string,
	format string,
) error

RunUpdateClient updates an existing authentication client's configuration. Supports both interactive mode (when policiesJSON is empty) and non-interactive mode (when policiesJSON is provided).

func RunVerifyAuditLogs ¶ added in v0.9.0

func RunVerifyAuditLogs(
	ctx context.Context,
	auditLogUseCase authUseCase.AuditLogUseCase,
	logger *slog.Logger,
	writer io.Writer,
	startDateStr, endDateStr string,
	format string,
) error

RunVerifyAuditLogs verifies cryptographic integrity of audit logs within a time range.

func WriteOutput ¶ added in v0.23.0

func WriteOutput(writer io.Writer, format string, data Formatter)

WriteOutput writes the formatted data to the provided writer based on the specified format.