Documentation
¶
Overview ¶
Package customprotect demonstrates an application-owned protect.Protector adapter. It adds policy/audit behavior around Human's reviewed local AEAD implementation instead of implementing cryptography itself.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Borrow ¶
func Borrow( ctx context.Context, next protect.Protector, audit AuditFunc, ) (protect.Resource, error)
Borrow decorates a host-owned Protector. Releasing the returned Resource is a no-op; the host must keep next alive until the Human runtime reaches Done.
func OpenLocal ¶
func OpenLocal( ctx context.Context, config protectaead.Config, audit AuditFunc, ) (protect.Resource, error)
OpenLocal opens the official AES-256-GCM keyring, decorates it, and returns one owned Resource. Releasing the decorator releases and wipes the keyring's copied key material exactly once.
Types ¶
type AuditEvent ¶
type AuditEvent struct {
Operation string
Component string
Purpose string
RecordType string
Field string
Succeeded bool
}
AuditEvent contains intentionally low-cardinality, non-secret metadata. It excludes authority, namespace, record ID, key identity, plaintext, and ciphertext so an audit sink cannot accidentally become another payload store.
type AuditFunc ¶
type AuditFunc func(AuditEvent)
AuditFunc must be concurrency-safe, bounded, and must not panic. Production adapters commonly enqueue this metadata into an application-owned audit pipeline rather than performing remote I/O inline.
Source Files