Documentation
¶
Index ¶
- type DXSecureMemory
- type DXSecureMemoryManager
- func (m *DXSecureMemoryManager) Count() int
- func (m *DXSecureMemoryManager) Delete(key string)
- func (m *DXSecureMemoryManager) DestroyAll()
- func (m *DXSecureMemoryManager) Exists(key string) bool
- func (m *DXSecureMemoryManager) Get(key string) ([]byte, error)
- func (m *DXSecureMemoryManager) Keys() []string
- func (m *DXSecureMemoryManager) MustGet(key string) []byte
- func (m *DXSecureMemoryManager) Store(key string, data []byte) error
- func (m *DXSecureMemoryManager) StoreEnclave(key string, data []byte) error
- func (m *DXSecureMemoryManager) StoreEnclaveFromVault(v *vault.DXHashicorpVault, vaultKey string, secureMemoryKey string) error
- func (m *DXSecureMemoryManager) StoreFromVault(v *vault.DXHashicorpVault, vaultKey string, secureMemoryKey string) error
- type DXSecureMemoryType
- type SecureValue
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type DXSecureMemory ¶
type DXSecureMemory struct {
Owner *DXSecureMemoryManager
Key string
StorageType DXSecureMemoryType
LockedBuffer *memguard.LockedBuffer
Enclave *memguard.Enclave
}
DXSecureMemory holds a single secure memory entry
func (*DXSecureMemory) Destroy ¶
func (sm *DXSecureMemory) Destroy()
Destroy securely wipes and releases the memory
func (*DXSecureMemory) Get ¶
func (sm *DXSecureMemory) Get() ([]byte, error)
Get returns a copy of the stored data
type DXSecureMemoryManager ¶
type DXSecureMemoryManager struct {
Memories map[string]*DXSecureMemory
// contains filtered or unexported fields
}
DXSecureMemoryManager manages secure memory entries
var Manager DXSecureMemoryManager
Manager is the global secure memory manager instance
func (*DXSecureMemoryManager) Count ¶
func (m *DXSecureMemoryManager) Count() int
Count returns number of stored entries
func (*DXSecureMemoryManager) Delete ¶
func (m *DXSecureMemoryManager) Delete(key string)
Delete removes and destroys a secure memory entry
func (*DXSecureMemoryManager) DestroyAll ¶
func (m *DXSecureMemoryManager) DestroyAll()
DestroyAll destroys all secure memory entries
func (*DXSecureMemoryManager) Exists ¶
func (m *DXSecureMemoryManager) Exists(key string) bool
Exists checks if a key exists
func (*DXSecureMemoryManager) Get ¶
func (m *DXSecureMemoryManager) Get(key string) ([]byte, error)
Get returns a copy of stored data by key
func (*DXSecureMemoryManager) Keys ¶
func (m *DXSecureMemoryManager) Keys() []string
Keys returns all stored keys
func (*DXSecureMemoryManager) MustGet ¶
func (m *DXSecureMemoryManager) MustGet(key string) []byte
MustGet returns data or panics if not found
func (*DXSecureMemoryManager) Store ¶
func (m *DXSecureMemoryManager) Store(key string, data []byte) error
Store stores data using LockedBuffer (for frequently accessed keys)
func (*DXSecureMemoryManager) StoreEnclave ¶
func (m *DXSecureMemoryManager) StoreEnclave(key string, data []byte) error
StoreEnclave stores data using Enclave (encrypted in memory, for sensitive data)
func (*DXSecureMemoryManager) StoreEnclaveFromVault ¶
func (m *DXSecureMemoryManager) StoreEnclaveFromVault(v *vault.DXHashicorpVault, vaultKey string, secureMemoryKey string) error
StoreEnclaveFromVault gets value from vault and stores using Enclave
func (*DXSecureMemoryManager) StoreFromVault ¶
func (m *DXSecureMemoryManager) StoreFromVault(v *vault.DXHashicorpVault, vaultKey string, secureMemoryKey string) error
StoreFromVault gets value from vault and stores using LockedBuffer
type DXSecureMemoryType ¶
type DXSecureMemoryType int
DXSecureMemoryType defines the storage type
const ( // DXSecureMemoryTypeLockedBuffer - data in plaintext, RAM locked (no swap) // Use for frequently accessed keys (e.g., encryption keys used often) DXSecureMemoryTypeLockedBuffer DXSecureMemoryType = iota // DXSecureMemoryTypeEnclave - data encrypted in memory // Use for sensitive data with less frequent access DXSecureMemoryTypeEnclave )
type SecureValue ¶
type SecureValue struct {
Key string
}
SecureValue is a token stored in configuration maps in place of plaintext secrets. The actual secret is encrypted in a memguard Enclave via the global Manager.
func Secure ¶
func Secure(value string) *SecureValue
Secure stores a plaintext value into the global SecureMemory Manager as an Enclave and returns a *SecureValue token. The original string is no longer referenced by this package.
func (*SecureValue) MarshalJSON ¶
func (sv *SecureValue) MarshalJSON() ([]byte, error)
MarshalJSON ensures that SecureValue never leaks plaintext in JSON output.
func (*SecureValue) Resolve ¶
func (sv *SecureValue) Resolve() (string, error)
Resolve decrypts the secret from the Enclave and returns it as a string.
Source Files