Documentation
¶
Overview ¶
Package codec converts Temporal payloads on their way to and from an upstream.
Encryptor seals payloads with envelope encryption through a Cipher and opens them again. A sealed payload is self-describing: the ciphertext travels with the ID of the key that wrapped its DEK and the wrapped DEK itself, so opening one needs nothing but the payload and a Cipher that can reach that key.
NewChain assembles the codecs its options enable into a single Chain in the order they have to be applied, so callers say what they want enabled rather than what order it happens in.
A Chain satisfies the Temporal SDK's converter.PayloadCodec, so it can be handed to converter.NewCodecDataConverter for an SDK client or to converter.NewPayloadCodecHTTPHandler for a codec server, with the SDK imported at the call site rather than here.
Index ¶
Constants ¶
const ( // MetadataEncoding is the payload metadata key holding the encoding name. MetadataEncoding = "encoding" // MetadataEncryptionKeyID is the payload metadata key holding the ID of the // KEK that wrapped the DEK. MetadataEncryptionKeyID = "encryption-key-id" // MetadataEncryptionDEK is the payload metadata key holding the wrapped DEK. MetadataEncryptionDEK = "encryption-dek" // EncryptionEncoding is the encoding a sealed payload is marked with. EncryptionEncoding = "binary/encrypted" )
These keys form the on-the-wire contract for a sealed payload: the encoding marker lets Decode recognize its own output, and the key-ID and wrapped-DEK entries carry the material needed to open it.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Chain ¶
type Chain struct {
// contains filtered or unexported fields
}
Chain applies a set of codecs as one. Encode runs them in the order the chain holds them and Decode runs them in reverse, so a payload is compressed before it is sealed and unsealed before it is decompressed. Note that this is the opposite of the SDK's own convention, where a multi-codec list encodes last to first; a Chain is handed to the SDK whole, as a single codec, so its order stays its own concern.
func NewChain ¶
NewChain returns the Chain implied by opts, holding every codec they enable in the order it has to be applied. A Chain with no codecs is a no-op.
func (Chain) Decode ¶
Decode reverses Chain.Encode, running payloads back through every codec in reverse order.
type Cipher ¶
type Cipher interface {
Encrypt([]byte) (*crypto.Message, error)
Decrypt(*crypto.Message) ([]byte, error)
}
Cipher encrypts and decrypts bytes. It is the subset of a key-management backend, typically a crypto.Vault, that Encryptor depends on.
type Codec ¶
type Codec interface {
Encode([]*common.Payload) ([]*common.Payload, error)
Decode([]*common.Payload) ([]*common.Payload, error)
}
Codec transforms payloads on their way to an upstream and back. The method set matches the Temporal SDK's converter.PayloadCodec, so an implementation satisfies both without this package depending on the SDK.
type Encryptor ¶
type Encryptor struct {
// contains filtered or unexported fields
}
Encryptor seals payloads with envelope encryption and opens them again.
func NewEncryptor ¶
NewEncryptor returns an Encryptor that seals and opens payloads through c.
func (*Encryptor) Decode ¶
Decode reverses Encryptor.Encode: a payload carrying the full sealed-payload contract, the EncryptionEncoding marker plus both key-material entries, is opened and restored to its original form. Anything else passes through unchanged so payloads produced elsewhere survive the round trip, including ones that use the same encoding name without our key material.
func (*Encryptor) Encode ¶
Encode seals every payload in payloads, returning payloads whose data is the ciphertext and whose metadata carries the wrapped DEK needed to open it. Each original payload is sealed whole, metadata included, so Encryptor.Decode restores it exactly.
Source Files