securebody

Documentation

Overview

Package securebody encrypts sensitive Fort record bodies before they enter the cloud ledger. Routing metadata remains separate and plaintext.

Index

• Constants
• Variables
• type Envelope
• type KeyRing
  • func (ring KeyRing) Decrypt(scope Scope, envelope Envelope) ([]byte, error)
  • func (ring KeyRing) Encrypt(scope Scope, plaintext []byte) (Envelope, error)
• type Scope

Constants

const (
	EnvelopeVersion            = 1
	MaximumPlaintextChunkBytes = 2 << 20
	// AEADOverheadBytes is the fixed authentication-tag overhead of the
	// AES-256-GCM envelope used by Fort. It lets the server derive artifact
	// manifest lengths without disclosing a data-encryption key to a worker.
	AEADOverheadBytes = 16
)

Variables

var (
	ErrInvalid        = errors.New("secure body envelope invalid")
	ErrKeyUnavailable = errors.New("secure body key unavailable")
	ErrAuthentication = errors.New("secure body authentication failed")
	ErrPayloadLimit   = errors.New("secure body payload limit exceeded")
	ErrVersion        = errors.New("secure body envelope version unsupported")
)

Types

type Envelope

type Envelope struct {
	Version    int    `json:"version"`
	KeyID      string `json:"key_id"`
	Nonce      string `json:"nonce"`
	Ciphertext string `json:"ciphertext"`
}

Envelope is the versioned value stored in the ledger. The referenced key is held outside Supabase.

type KeyRing

type KeyRing struct {
	ActiveKeyID string
	Keys        map[string][]byte
	Random      io.Reader
}

KeyRing retains every decryption key still referenced by durable ciphertext and uses ActiveKeyID only for new writes.

func (KeyRing) Decrypt

func (ring KeyRing) Decrypt(scope Scope, envelope Envelope) ([]byte, error)

func (KeyRing) Encrypt

func (ring KeyRing) Encrypt(scope Scope, plaintext []byte) (Envelope, error)

type Scope

type Scope struct {
	AccountID  string `json:"account_id"`
	RecordType string `json:"record_type"`
	RecordID   string `json:"record_id"`
}

Scope is authenticated but not encrypted. It prevents ciphertext from one account or durable record from being replayed as another.