crypto

type CacheEvent struct {
	// Size is the number of entries in the DEK cache after the access.
	Size int
}

type DEK struct {
	// contains filtered or unexported fields
}

type DEKMaterial struct {
	Version      byte
	KEKID        string // The ID/URI of the KEK the encrypted the DEK.
	EncryptedDEK string // The base64-encoded encrypted DEK.
}

type KEK interface {
	io.Closer

	// ID returns a unique ID for this KEK, e.g. a KMS ARN.
	ID() string
	// Encrypt encrypts a DEK, returning the ciphertext.
	Encrypt(context.Context, []byte) ([]byte, error)
	// Decrypt decrypts a DEK previously produced by Encrypt.
	Decrypt(context.Context, []byte) ([]byte, error)
}

type KEKRegistry struct {
	// contains filtered or unexported fields
}

type KEKRegistryOption interface {
	// contains filtered or unexported methods
}

type KeyConfig struct {
	// Duration is how long a DEK is valid before it must be rotated.
	Duration time.Duration
	// RenewBefore causes a DEK to be treated as expired this long before
	// Duration elapses, so it can be rotated ahead of its actual expiry.
	RenewBefore time.Duration
}

type Message struct {
	Ciphertext  []byte
	KeyMaterial *DEKMaterial
}

type NamespacedVault struct {
	// contains filtered or unexported fields
}

type Observer interface {
	CacheHit(CacheEvent)
	CacheMiss(CacheEvent)
}

type Vault struct {
	// contains filtered or unexported fields
}

type VaultOption func(*vaultOptions)