secrets

Documentation

Overview

Package secrets provides authenticated encryption (AES-256-GCM) for user-scoped secrets stored in the database — here, each user's GitLab personal access token. The master key (KEK) lives only in the server config/env (secrets.key), never in the database or git.

Index

• Variables
• type SealedValue
• type Sealer
  • func NewSealer(keyB64 string) (*Sealer, error)
  • func (s *Sealer) Open(v SealedValue) (string, error)
  • func (s *Sealer) Seal(plaintext string) (SealedValue, error)

Variables

var ErrNoKey = errors.New("no encryption key configured (set secrets.key)")

ErrNoKey is returned when a seal/open is attempted without a configured KEK.

Types

type SealedValue

type SealedValue struct {
	KeyVersion int    `bson:"keyVersion" json:"keyVersion"`
	Nonce      []byte `bson:"nonce" json:"nonce"`
	Ciphertext []byte `bson:"ciphertext" json:"ciphertext"`
}

SealedValue is an encrypted secret as stored in MongoDB. It carries everything needed to decrypt except the key: the key version, the per-value random nonce and the GCM ciphertext (which already includes the authentication tag).

type Sealer

type Sealer struct {
	// contains filtered or unexported fields
}

Sealer seals and opens secrets with a fixed KEK. A nil *Sealer means "no key configured" and every operation fails closed with ErrNoKey.

func NewSealer

func NewSealer(keyB64 string) (*Sealer, error)

NewSealer builds a Sealer from a base64-encoded 32-byte (AES-256) key. An empty key returns (nil, nil): the caller treats "no KEK configured" as a soft state and fails closed only when a secret operation is actually attempted. A malformed key is an error.

func (*Sealer) Open

func (s *Sealer) Open(v SealedValue) (string, error)

Open decrypts a SealedValue back to plaintext. It fails when the key is wrong or the data was tampered with (GCM authentication) — there is no plaintext fallback.

func (*Sealer) Seal

func (s *Sealer) Seal(plaintext string) (SealedValue, error)

Seal encrypts plaintext with a fresh random nonce.