Function Decrypt

pkg/utils/crypto.go:148–183

Decrypt decrypts a prefixed base64 string back to plaintext.

(encrypted string, key []byte)

// Decrypt decrypts a prefixed base64 string back to plaintext.
func Decrypt(encrypted string, key []byte) (string, error) {
	if encrypted == "" {
		return "", nil
	}
	if !IsEncrypted(encrypted) {
		return encrypted, nil
	}

	data, err := base64.StdEncoding.DecodeString(encrypted[len(encryptedPrefix):])
	if err != nil {
		return "", fmt.Errorf("failed to decode encrypted value: %w", err)
	}

	block, err := aes.NewCipher(key)
	if err != nil {
		return "", err
	}

	aesGCM, err := cipher.NewGCM(block)
	if err != nil {
		return "", err
	}

	nonceSize := aesGCM.NonceSize()
	if len(data) < nonceSize {
		return "", fmt.Errorf("ciphertext too short")
	}

	nonce, ciphertext := data[:nonceSize], data[nonceSize:]
	plaintext, err := aesGCM.Open(nil, nonce, ciphertext, nil)
	if err != nil {
		return "", fmt.Errorf("decryption failed: %w", err)
	}

	return string(plaintext), nil
}

// IsEncrypted checks if a value has the encrypted prefix.
func IsEncrypted(s string) bool {