keymanager

func ResolveEncryptionKey ¶

func ResolveEncryptionKey(envKey string, logger log.Logger) (string, error)

ResolveEncryptionKey determines the encryption key to use.

Resolution logic:

1. No env var + no stored key → generate, store, and return
2. No env var + stored key → load and return
3. Env var + no stored key → store env value and return
4. Env var matches stored → return
5. Env var mismatches stored → return error with instructions