WardrikVault.Sealed (wardrik_vault v0.1.0-rc.1)

A credential as the vault writes it. Only a key can unseal it.

Summary

t()

A sealed secret or grant.

Decodes base64 keys. Drops any that don't hold 32 bytes.

generate_key()

Returns a new key, base64-encoded.

Seals value with key. Binds it to path and kind, so it can't be moved or relabelled.

Unseals with the first of keys that opens it.

@type t() :: %WardrikVault.Sealed{
  ciphertext: binary(),
  kind: :secret | :grant,
  nonce: binary(),
  tag: binary(),
  version: pos_integer()
}

A sealed secret or grant.

@spec decode_keys([String.t()]) :: [binary()]

Decodes base64 keys. Drops any that don't hold 32 bytes.

@spec generate_key() :: String.t()

Returns a new key, base64-encoded.

@spec seal(binary(), String.t(), :secret | :grant, binary()) :: t()

Seals value with key. Binds it to path and kind, so it can't be moved or relabelled.

@spec unseal(t(), [binary()], String.t()) :: {:ok, binary()} | {:error, term()}

Unseals with the first of keys that opens it.

Returns {:error, :undecipherable} if none does, and {:error, {:unknown_version, version}} for a version this release can't read.