Documentation
¶
Overview ¶
Package secretbox is a thin AEAD wrapper used to protect at-rest secrets — currently TOTP secrets, future sprints will reuse it for per-user key material (PATs, deploy keys, etc.).
Construction: chacha20poly1305 (XChaCha20 not used — we mint nonces per-row and store them, so the smaller 12-byte nonce is fine).
Key sourcing: 32-byte key, base64-encoded in config (auth.totp_key_b64 or env SHITHUB_TOTP_KEY). Operators rotate by re-encrypting all rows — a key change without a rotation breaks every existing 2FA login. That procedure is documented in docs/internal/2fa.md.
Index ¶
Constants ¶
const KeySize = chacha20poly1305.KeySize // 32
KeySize is the required key length in bytes.
const NonceSize = chacha20poly1305.NonceSize // 12
NonceSize is the AEAD nonce length, stored alongside the ciphertext.
Variables ¶
This section is empty.
Functions ¶
func EncodeKey ¶
EncodeKey returns the standard-base64 encoding suitable for placing in auth.totp_key_b64.
func GenerateKey ¶
GenerateKey returns a fresh 32-byte key suitable for FromBytes / FromBase64. Used by the test harness and an operator helper.
Types ¶
type Box ¶
type Box struct {
// contains filtered or unexported fields
}
Box wraps a ready-to-use AEAD. Construct with FromBase64 or FromBytes.
func FromBase64 ¶
FromBase64 decodes the supplied base64 key (standard or url alphabet) and returns a Box. Returns an error if the key isn't 32 bytes.
Source Files