Documentation
¶
Overview ¶
Package secret holds the two secrecy primitives the whole binary depends on: the Redacted type (a value that refuses to serialize itself in the clear) and the AES-256-GCM Cipher used for secrets at rest (plan §5.5).
Custom lint rule (CONTRIBUTING / plan §15): any type that holds a secret must have String()/MarshalJSON that return the redaction marker. Redacted is the canonical implementation; reach for it instead of a bare string.
Index ¶
- Constants
- Variables
- type Cipher
- type Redacted
- func (r Redacted) Equal(candidate string) bool
- func (r Redacted) Format(f fmt.State, verb rune)
- func (r Redacted) GoString() string
- func (r Redacted) IsZero() bool
- func (r Redacted) MarshalJSON() ([]byte, error)
- func (r Redacted) MarshalText() ([]byte, error)
- func (r Redacted) Reveal() string
- func (r Redacted) String() string
Constants ¶
const Marker = "••••" // ••••
Marker is what a redacted value renders as anywhere it might be logged.
Variables ¶
var ( // ErrDecrypt is returned for any open failure. It is intentionally opaque so // it cannot become a decryption oracle. ErrDecrypt = errors.New("secret: decryption failed") // ErrKeyLen is returned when a key is not exactly 32 bytes. ErrKeyLen = errors.New("secret: key must be 32 bytes (AES-256)") )
Functions ¶
This section is empty.
Types ¶
type Cipher ¶
type Cipher struct {
// contains filtered or unexported fields
}
Cipher seals/opens blobs with AES-256-GCM. It optionally holds a previous key so a rotation (encryption_key_previous, plan §5.5) can still open old rows; Seal always uses the current key.
func NewCipher ¶
NewCipher builds a Cipher from the current key and an optional previous key (pass nil/empty when not rotating).
type Redacted ¶
type Redacted struct {
// contains filtered or unexported fields
}
Redacted wraps a secret string. Its String/MarshalJSON/MarshalText/GoString all return the redaction marker, so a secret can never leak into a log line, an error, a JSON response, %v/%+v/%#v formatting, or a template by accident. Reveal() is the single, greppable place the plaintext escapes.
func (Redacted) Format ¶
Format implements fmt.Formatter so EVERY verb — including numeric/other verbs like %d/%x/%g that fmt would otherwise satisfy via reflection over the unexported field — routes through the redaction marker. Without this, a wrong-verb format string (e.g. `%d`) would print the plaintext (review #5).
func (Redacted) MarshalJSON ¶
MarshalJSON ensures encoding/json never emits the plaintext.
func (Redacted) MarshalText ¶
MarshalText covers encoders that prefer TextMarshaler (incl. some YAML paths).
Source Files