encryption

Documentation

Index

• type AsyncSubKey
  • func (AsyncSubKey) SubKey() string
• type Builder
  • func NewBuilder() Builder
  • func (b Builder) Build(ctx context.Context, provider KeyStoreProvider) (DataEncryptor, error)
  • func (b Builder) WithKMSURI(kmsURI optional.Option[string]) Builder
• type DataEncryptor
• type Encrypted
• type EncryptedAsyncColumn
• type EncryptedColumn
  • func (e *EncryptedColumn[SK]) Bytes() []byte
  • func (e *EncryptedColumn[SK]) Scan(src interface{}) error
  • func (e *EncryptedColumn[SK]) Set(b []byte)
  • func (e *EncryptedColumn[SK]) SubKey() string
  • func (e *EncryptedColumn[SK]) Value() (driver.Value, error)
• type EncryptedTimelineColumn
• type KMSEncryptor
  • func NewKMSEncryptorWithKMS(uri string, v1client *awsv1kms.KMS, encryptedKeyset []byte) (*KMSEncryptor, error)
  • func (k *KMSEncryptor) Decrypt(encrypted Encrypted) ([]byte, error)
  • func (k *KMSEncryptor) Encrypt(cleartext []byte, dest Encrypted) error
  • func (k *KMSEncryptor) GetEncryptedKeyset() []byte
• type KeyStoreProvider
• type NoOpEncryptor
  • func NewNoOpEncryptor() NoOpEncryptor
  • func (n NoOpEncryptor) Decrypt(encrypted Encrypted) ([]byte, error)
  • func (n NoOpEncryptor) Encrypt(cleartext []byte, dest Encrypted) error
• type OptionalEncryptedAsyncColumn
• type OptionalEncryptedTimelineColumn
• type SubKey
• type TimelineSubKey
  • func (TimelineSubKey) SubKey() string

Types

type AsyncSubKey

type AsyncSubKey struct{}

AsyncSubKey is a type that represents the subkey for async.

func (AsyncSubKey) SubKey

func (AsyncSubKey) SubKey() string

type Builder

type Builder struct {
	// contains filtered or unexported fields
}

Builder constructs a DataEncryptor when used with a provider. Use a chain of With* methods to configure the builder.

func NewBuilder

func NewBuilder() Builder

func (Builder) Build

func (b Builder) Build(ctx context.Context, provider KeyStoreProvider) (DataEncryptor, error)

func (Builder) WithKMSURI

func (b Builder) WithKMSURI(kmsURI optional.Option[string]) Builder

WithKMSURI sets the URI for the KMS key to use. Omitting this call or using None will create a NoOpEncryptor.

type DataEncryptor

type DataEncryptor interface {
	Encrypt(cleartext []byte, dest Encrypted) error
	Decrypt(encrypted Encrypted) ([]byte, error)
}

type Encrypted

type Encrypted interface {
	SubKey() string
	Bytes() []byte
	Set(data []byte)
}

Encrypted is an interface for values that contain encrypted data.

type EncryptedAsyncColumn

type EncryptedAsyncColumn = EncryptedColumn[AsyncSubKey]

type EncryptedColumn

type EncryptedColumn[SK SubKey] []byte

EncryptedColumn is a type that represents an encrypted column.

It can be used by sqlc to map to/from a bytea column in the database.

func (*EncryptedColumn[SK]) Bytes

func (e *EncryptedColumn[SK]) Bytes() []byte

func (*EncryptedColumn[SK]) Scan

func (e *EncryptedColumn[SK]) Scan(src interface{}) error

func (*EncryptedColumn[SK]) Set

func (e *EncryptedColumn[SK]) Set(b []byte)

func (*EncryptedColumn[SK]) SubKey

func (e *EncryptedColumn[SK]) SubKey() string

func (*EncryptedColumn[SK]) Value

func (e *EncryptedColumn[SK]) Value() (driver.Value, error)

type EncryptedTimelineColumn

type EncryptedTimelineColumn = EncryptedColumn[TimelineSubKey]

type KMSEncryptor

type KMSEncryptor struct {
	// contains filtered or unexported fields
}

KMSEncryptor encrypts and decrypts using a KMS key via tink.

func NewKMSEncryptorWithKMS

func NewKMSEncryptorWithKMS(uri string, v1client *awsv1kms.KMS, encryptedKeyset []byte) (*KMSEncryptor, error)

func (*KMSEncryptor) Decrypt

func (k *KMSEncryptor) Decrypt(encrypted Encrypted) ([]byte, error)

func (*KMSEncryptor) Encrypt

func (k *KMSEncryptor) Encrypt(cleartext []byte, dest Encrypted) error

func (*KMSEncryptor) GetEncryptedKeyset

func (k *KMSEncryptor) GetEncryptedKeyset() []byte

type KeyStoreProvider

type KeyStoreProvider interface {
	// EnsureKey asks a provider to check for an encrypted key.
	// If not available, call the generateKey function to create a new key.
	// The provider should handle transactions around checking and setting the key, to prevent race conditions.
	EnsureKey(ctx context.Context, generateKey func() ([]byte, error)) ([]byte, error)
}

type NoOpEncryptor

type NoOpEncryptor struct{}

NoOpEncryptor does not encrypt and just passes the input as is.

func NewNoOpEncryptor

func NewNoOpEncryptor() NoOpEncryptor

func (NoOpEncryptor) Decrypt

func (n NoOpEncryptor) Decrypt(encrypted Encrypted) ([]byte, error)

func (NoOpEncryptor) Encrypt

func (n NoOpEncryptor) Encrypt(cleartext []byte, dest Encrypted) error

type OptionalEncryptedAsyncColumn

type OptionalEncryptedAsyncColumn = optional.Option[EncryptedAsyncColumn]

type OptionalEncryptedTimelineColumn

type OptionalEncryptedTimelineColumn = optional.Option[EncryptedTimelineColumn]

type SubKey

type SubKey interface{ SubKey() string }

SubKey is an interface for types that specify their own encryption subkey.

type TimelineSubKey

type TimelineSubKey struct{}

TimelineSubKey is a type that represents the subkey for logs.

func (TimelineSubKey) SubKey

func (TimelineSubKey) SubKey() string