sealx

Documentation

Overview

Package sealx seals tenant credentials at rest with AES-256-GCM (authenticate-then-store; the sealed form carries an authenticated timestamp blob, base64-encoded under the SealedPrefix).

Key format — three layers, read before the first "invalid key" error

• New / NewSecrets take 32 RAW bytes (AES-256 key, not hex, not base64 — the []byte IS the key material).
• NewSecretsFromEnv reads PLOYKIT_SEAL_KEY and expects that value to be base64 (StdEncoding) of the 32 raw bytes — i.e. the direct output of `openssl rand -base64 32` works as-is.
• DeriveKey(base, domain) produces 32 raw bytes from a configured master secret (HMAC-SHA256, domain-separated) — its output feeds New/NewSecrets directly with no encoding step.

Failure posture (deliberate, see AGENTS.md): no key configured = new sealed writes are rejected and unsealed reads of legacy plaintext error out — there is no plaintext fallback; such credentials must be reconfigured.

Index

• Constants
• Variables
• func DeriveKey(base, domain string) []byte
• type Sealer
  • func New(key []byte) (*Sealer, error)
  • func (s *Sealer) Decrypt(blob []byte) (string, error)
  • func (s *Sealer) Encrypt(plaintext string) ([]byte, error)
• type Secrets
  • func NewSecrets(key []byte) (*Secrets, error)
  • func NewSecretsFromEnv() (*Secrets, error)
  • func (s *Secrets) Seal(plain string) (string, error)
  • func (s *Secrets) Unseal(stored string) (string, error)

Constants

const EnvKey = "PLOYKIT_SEAL_KEY"

const SealedPrefix = "sealed:v1:"

Variables

var ErrNoKey = errors.New("sealx: seal key not configured (set " + EnvKey + "); refusing to store plaintext")

var ErrPlaintext = errors.New("sealx: value is not sealed (no " + SealedPrefix + " prefix); legacy plaintext support removed 2026-10-07 — reconfigure the credential")

Functions

func DeriveKey

func DeriveKey(base, domain string) []byte

DeriveKey derives a 32-byte, domain-separated key from a base secret via HMAC-SHA256. Use it to derive per-purpose keys (e.g. credential sealing, IP-hash salt) from a single configured master secret; the output length matches New/NewSecrets requirements.

Types

type Sealer

type Sealer struct {
	// contains filtered or unexported fields
}

func New

func New(key []byte) (*Sealer, error)

func (*Sealer) Decrypt

func (s *Sealer) Decrypt(blob []byte) (string, error)

func (*Sealer) Encrypt

func (s *Sealer) Encrypt(plaintext string) ([]byte, error)

type Secrets

type Secrets struct {
	// contains filtered or unexported fields
}

func NewSecrets

func NewSecrets(key []byte) (*Secrets, error)

func NewSecretsFromEnv

func NewSecretsFromEnv() (*Secrets, error)

func (*Secrets) Seal

func (s *Secrets) Seal(plain string) (string, error)

func (*Secrets) Unseal

func (s *Secrets) Unseal(stored string) (string, error)