crypto

const (
	ScopeABEntryPassword              = "ab_entry.password"
	ScopeABEntryHash                  = "ab_entry.hash"
	ScopeAddressBookDefaultPassword   = "address_book.password"
	ScopeIdentityProviderClientSecret = "identity_provider.client_secret"
	ScopeShareLinkPassword            = "share_link.password"
	ScopeServerShareLinkToken         = "server_share_link.token"
	ScopeOAuthStatePKCEVerifier       = "oauth_state.pkce_verifier"
	ScopeTOTPSecret                   = "totp"
)

Associated-data (AD) conventions for AEAD-encrypted columns.

Every *_enc column is sealed with AD "<scope>:<row id>", which binds the ciphertext to one column of one row: copying it into another row or column makes Open fail. The scope strings below are part of the on-disk format and MUST NOT change; every writer (client API, admin API, legacy importer) and reader uses these helpers instead of formatting AD strings by hand.

column                                   AD
address_book_entries.password_enc        "ab_entry.password:<entry id>"
address_book_entries.hash_enc            "ab_entry.hash:<entry id>"
address_books.default_password_enc       "address_book.password:<book id>"
identity_providers.client_secret_enc     "identity_provider.client_secret:<provider id>"
share_links.password_enc                 "share_link.password:<link id>"
server_share_links.token_enc             "server_share_link.token:<link id>"
oauth_states.pkce_verifier_enc           "oauth_state.pkce_verifier:<state id>"
totp_secrets.secret_enc                  "totp:<user id>"
settings["mail.smtp"].password_enc       "settings.smtp_password:0"
settings["client.options"].ice_servers_enc "settings.ice_servers:0"
settings["federation.peer.<id>.token"].token_enc "settings.federation_peer_token:<peer id>"

Because the AD contains the row id, a row must be inserted first (to learn its id) and the ciphertext written afterwards, or the id must be known in advance (preserved legacy ids).

const KeySize = chacha20poly1305.KeySize

KeySize is the AEAD key length in bytes.

const MinSecretLen = 16

MinSecretLen is the shortest secret LoadOrCreateHexSecret accepts from an existing file.

const ScopeFederationPeerToken = "settings.federation_peer_token"

ScopeFederationPeerToken seals the token this panel presents to a federation peer, stored in the panel settings (key "federation.peer.<peer id>.token"; the id is the federation_peers row).

const ScopeICEServers = "settings.ice_servers"

ScopeICEServers seals the client ICE server list (TURN credentials) stored in the panel settings (settings key "client.options"; a single value, id 0).

const ScopeLDAPBindPassword = "settings.ldap_bind_password"

ScopeLDAPBindPassword seals the LDAP bind password stored in ldap_settings (a single value, id 0).

const ScopeSMTPPassword = "settings.smtp_password"

ScopeSMTPPassword seals the SMTP password stored in the panel settings (settings key "mail.smtp"; a single value, so the id is always 0).