encryption

Documentation

Index

• type Builder
  • func NewBuilder() Builder
  • func (b Builder) Build(ctx context.Context, provider api.KeyStoreProvider) (api.DataEncryptor, error)
  • func (b Builder) WithKMSURI(kmsURI optional.Option[string]) Builder
• type KMSEncryptor
  • func NewKMSEncryptorWithKMS(uri string, v1client *kms.KMS, encryptedKeyset []byte) (*KMSEncryptor, error)
  • func (k *KMSEncryptor) Decrypt(encrypted api.Encrypted) ([]byte, error)
  • func (k *KMSEncryptor) Encrypt(cleartext []byte, dest api.Encrypted) error
  • func (k *KMSEncryptor) GetEncryptedKeyset() []byte
• type NoOpEncryptor
  • func NewNoOpEncryptor() NoOpEncryptor
  • func (n NoOpEncryptor) Decrypt(encrypted api.Encrypted) ([]byte, error)
  • func (n NoOpEncryptor) Encrypt(cleartext []byte, dest api.Encrypted) error
• type Service
  • func New(ctx context.Context, conn libdal.Connection, encryptionBuilder Builder) (*Service, error)
  • func (s *Service) AEAD() (tink.AEAD, error)
  • func (s *Service) Decrypt(encrypted api.Encrypted) ([]byte, error)
  • func (s *Service) DecryptJSON(encrypted api.Encrypted, v any) error
  • func (s *Service) Encrypt(cleartext []byte, dest api.Encrypted) error
  • func (s *Service) EncryptJSON(v any, dest api.Encrypted) error

Types

type Builder

type Builder struct {
	// contains filtered or unexported fields
}

Builder constructs a DataEncryptor when used with a provider. Use a chain of With* methods to configure the builder.

func NewBuilder

func NewBuilder() Builder

func (Builder) Build

func (b Builder) Build(ctx context.Context, provider api.KeyStoreProvider) (api.DataEncryptor, error)

func (Builder) WithKMSURI

func (b Builder) WithKMSURI(kmsURI optional.Option[string]) Builder

WithKMSURI sets the URI for the KMS key to use. Omitting this call or using None will create a NoOpEncryptor.

type KMSEncryptor

type KMSEncryptor struct {
	// contains filtered or unexported fields
}

KMSEncryptor encrypts and decrypts using a KMS key via tink.

func NewKMSEncryptorWithKMS

func NewKMSEncryptorWithKMS(uri string, v1client *kms.KMS, encryptedKeyset []byte) (*KMSEncryptor, error)

func (*KMSEncryptor) Decrypt

func (k *KMSEncryptor) Decrypt(encrypted api.Encrypted) ([]byte, error)

func (*KMSEncryptor) Encrypt

func (k *KMSEncryptor) Encrypt(cleartext []byte, dest api.Encrypted) error

func (*KMSEncryptor) GetEncryptedKeyset

func (k *KMSEncryptor) GetEncryptedKeyset() []byte

type NoOpEncryptor

type NoOpEncryptor struct{}

NoOpEncryptor does not encrypt and just passes the input as is.

func NewNoOpEncryptor

func NewNoOpEncryptor() NoOpEncryptor

func (NoOpEncryptor) Decrypt

func (n NoOpEncryptor) Decrypt(encrypted api.Encrypted) ([]byte, error)

func (NoOpEncryptor) Encrypt

func (n NoOpEncryptor) Encrypt(cleartext []byte, dest api.Encrypted) error

type Service

type Service struct {
	// contains filtered or unexported fields
}

func New

func New(ctx context.Context, conn libdal.Connection, encryptionBuilder Builder) (*Service, error)

func (*Service) AEAD

func (s *Service) AEAD() (tink.AEAD, error)

AEAD returns the AEAD instance used by the encryptor. TODO: Remove this method once we have a better way to handle this.

func (*Service) Decrypt

func (s *Service) Decrypt(encrypted api.Encrypted) ([]byte, error)

func (*Service) DecryptJSON

func (s *Service) DecryptJSON(encrypted api.Encrypted, v any) error

DecryptJSON decrypts the given encrypted object and stores it in the provided destination.

func (*Service) Encrypt

func (s *Service) Encrypt(cleartext []byte, dest api.Encrypted) error

func (*Service) EncryptJSON

func (s *Service) EncryptJSON(v any, dest api.Encrypted) error

EncryptJSON encrypts the given JSON object and stores it in the provided destination.