Documentation
¶
Index ¶
- Constants
- func Decrypt(ciphertextHex string, key []byte) ([]byte, error)
- func Encrypt(plaintext []byte, key []byte) (string, error)
- func GenerateAPIKey() (string, error)
- func GenerateAPIKeyWithID() (string, string, error)
- func HashAPIKey(key string, secret []byte) string
- func HashPassword(password string) (string, error)
- func LoadOrCreateAPIKeyHashKey(db *sql.DB, masterKey []byte) ([]byte, error)
- func VerifyAPIKey(storedHash, key string, secret []byte) bool
- func VerifyPassword(hash, password string) bool
- type RotateResult
Constants ¶
const APIKeyHashSecretName = "api_key_hmac"
APIKeyHashSecretName is the server_secrets row holding the API-key HMAC key.
Variables ¶
This section is empty.
Functions ¶
func GenerateAPIKey ¶
GenerateAPIKey generates a random 64-char hex API key secret.
func GenerateAPIKeyWithID ¶
GenerateAPIKeyWithID generates an API key secret and a unique key ID. Returns (secret, keyID, error). The caller combines them as "keyID.secret" in the token given to the user, enabling O(1) lookup by key ID.
func HashAPIKey ¶
HashAPIKey produces a fast, constant-time-comparable hash for API key verification. Uses HMAC-SHA256 with a server secret to prevent offline brute-force if DB is leaked.
func HashPassword ¶
func LoadOrCreateAPIKeyHashKey ¶
LoadOrCreateAPIKeyHashKey returns the HMAC key used to hash API keys. It is stored encrypted under masterKey in server_secrets so master key rotation can re-encrypt it without changing existing key hashes. On first use the key is the master key itself, because that is what pre-existing hashes were computed with.
func VerifyAPIKey ¶
VerifyAPIKey compares an API key against a stored HMAC hash in constant time.
func VerifyPassword ¶
Types ¶
type RotateResult ¶
type RotateResult struct {
ServiceEnvVars int // rows re-encrypted in service_env
DatabasePasswords int // rows re-encrypted in databases.password_encrypted
DatabaseConnStrs int // rows re-encrypted in databases.connection_string_encrypted
KanbanTokens int // rows re-encrypted in kanbans.admin_token_encrypted
SnapshotEnvs int // rows re-encrypted in snapshots.env_encrypted
HashKeys int // server_secrets rows re-encrypted (API-key HMAC key)
Errors int // individual field decryption/encryption failures (should be 0)
}
RotateResult summarizes what a key rotation did (or would do in dry-run mode).
func RotateKeys ¶
RotateKeys re-encrypts every encrypted field in the database from oldKey to newKey. The entire operation runs inside a single SQLite transaction for atomicity: either every field is re-encrypted or none are.
This is an OFFLINE operation — the server must be stopped before running it. Key material is never logged or included in error messages.
func (RotateResult) Total ¶
func (r RotateResult) Total() int
Total returns the total number of fields that were (or would be) re-encrypted.
Source Files