Documentation
¶
Overview ¶
Package encrypted provides model field types that are stored as authenticated encryption envelopes, like Laravel's encrypted casts. Generated models encrypt assigned values with the database's key ring inside the write and decrypt them while hydrating, so application code reads and assigns plaintext. Each value is bound to its table, column and row primary key: a ciphertext copied to another row, column or table does not decrypt. Values never appear in formatting, JSON, logs or audit records, and encrypted columns cannot be compared or ordered in queries because every write uses a fresh random nonce.
Index ¶
- Constants
- func Binding(table, column string, key driver.Value) (encryption.Context, error)
- func JSONCodec[T any]() codec.Codec[JSON[T]]
- func TextCodec() codec.Codec[Text]
- type JSON
- func (j JSON[T]) Decode() (T, error)
- func (j JSON[T]) Equal(other JSON[T]) bool
- func (JSON[T]) Format(s fmt.State, _ rune)
- func (j JSON[T]) GoString() string
- func (j JSON[T]) IsZero() bool
- func (JSON[T]) LogValue() slog.Value
- func (JSON[T]) MarshalJSON() ([]byte, error)
- func (JSON[T]) MarshalText() ([]byte, error)
- func (j JSON[T]) Open(ctx context.Context, keys *encryption.Keyring, binding encryption.Context) (JSON[T], error)
- func (j JSON[T]) Seal(ctx context.Context, keys *encryption.Keyring, binding encryption.Context) (JSON[T], error)
- type Text
- func (t Text) Equal(other Text) bool
- func (Text) Format(s fmt.State, _ rune)
- func (t Text) GoString() string
- func (t Text) IsZero() bool
- func (Text) LogValue() slog.Value
- func (Text) MarshalJSON() ([]byte, error)
- func (Text) MarshalText() ([]byte, error)
- func (t Text) Open(ctx context.Context, keys *encryption.Keyring, binding encryption.Context) (Text, error)
- func (t Text) Reveal() string
- func (t Text) Seal(ctx context.Context, keys *encryption.Keyring, binding encryption.Context) (Text, error)
- type Value
Constants ¶
const Purpose encryption.Purpose = "foundry.model.field.v1"
Purpose is the encryption purpose of every encrypted model field.
Variables ¶
This section is empty.
Functions ¶
func Binding ¶
Binding is the authenticated context of one stored value: its table, column and row primary key, never stored in the envelope. The key is the primary key's bound SQL value, so an application-assigned key is required.
Types ¶
type JSON ¶
type JSON[T any] struct { // contains filtered or unexported fields }
JSON is an encrypted typed JSON field (Laravel's encrypted:array and encrypted:json casts). The plaintext is the canonical JSON of T.
func (JSON[T]) Decode ¶
Decode returns a fresh T from the plaintext JSON with value.ParseJSON's strict shape checks.
func (JSON[T]) Equal ¶
Equal compares plaintexts when both values are open, otherwise matching nonzero envelopes.
func (JSON[T]) Format ¶
Format writes the redaction marker without exposing plaintext or ciphertext.
func (JSON[T]) MarshalJSON ¶
MarshalJSON encodes the redaction marker as a JSON string.
func (JSON[T]) MarshalText ¶
MarshalText returns the redaction marker.
type Text ¶
type Text struct {
// contains filtered or unexported fields
}
Text is an encrypted string field (Laravel's encrypted cast). Assign NewText and read Reveal. The zero value has no plaintext and cannot be stored.
func (Text) Equal ¶
Equal compares plaintexts when both values are open, otherwise matching nonzero envelopes.
func (Text) MarshalJSON ¶
MarshalJSON encodes the redaction marker as a JSON string.
func (Text) MarshalText ¶
MarshalText returns the redaction marker.
func (Text) Open ¶
func (t Text) Open(ctx context.Context, keys *encryption.Keyring, binding encryption.Context) (Text, error)
Open returns a copy with plaintext decrypted from the stored envelope for binding. A nil key ring returns fault.Missing; a missing envelope returns fault.Invalid.
type Value ¶
type Value[V any] interface { // Seal encrypts assigned plaintext for the supplied record binding. Seal(context.Context, *encryption.Keyring, encryption.Context) (V, error) // Open decrypts a stored envelope for the supplied record binding. Open(context.Context, *encryption.Keyring, encryption.Context) (V, error) // Equal compares values for stored-change detection. Equal(V) bool }
Value is implemented by encrypted field types. Seal encrypts an assigned plaintext for one record; Open decrypts a stored envelope for one record; Equal compares plaintexts for change detection. Generated code calls these; applications assign and read plaintext through each type's own methods.
Source Files