encrypt

package

v0.2.0 Latest Latest Go to latest Published: Nov 7, 2026 License: MIT Imports: 2 Imported by: 0

Details

Package encrypt provides a DI-friendly AES-256-GCM string encryption service.

View Source

const KeySize = 32

KeySize is the required key length in bytes (AES-256).

View Source

var ErrInvalidKeySize = errors.New("encrypt: key must be 32 bytes (AES-256)")

ErrInvalidKeySize is returned when EncryptConfig.Key is not exactly KeySize bytes.

This section is empty.

type EncryptConfig struct {
	// Key is the raw AES-256 key; it must be exactly 32 bytes.
	Key string
}

EncryptConfig holds AES-256-GCM encryption settings.

type EncryptService struct {
	Key string
}

EncryptService performs AES-256-GCM encrypt/decrypt with an injected key. Ciphertext strings are base64(nonce || ciphertext || tag).

func NewEncryptService(e *EncryptService) *EncryptService

NewEncryptService copies the key from an existing service.

func NewEncryptServiceFromConfig(cfg EncryptConfig) (*EncryptService, error)

NewEncryptServiceFromConfig constructs a service from config (Wire / tests). It returns ErrInvalidKeySize when the key is not 32 bytes.

func (e *EncryptService) Decrypt(cipherText string) (string, error)

Decrypt reverses Encrypt and verifies authenticity; empty input yields empty output.

func (e *EncryptService) Encrypt(plainText string) (string, error)

Encrypt returns base64(nonce || ciphertext || tag); empty input yields empty output.