Method Open

server/usersecrets/crypto.go:76–89

Open decrypts a stored secret statement from the (org, user, name) row.

(orgID, username, secretName string, ciphertext []byte)

// Open decrypts a stored secret statement from the (org, user, name) row.
func (c *Cipher) Open(orgID, username, secretName string, ciphertext []byte) (string, error) {
	if len(ciphertext) < 1+c.aead.NonceSize() {
		return "", fmt.Errorf("ciphertext too short")
	}
	if ciphertext[0] != ciphertextVersion {
		return "", fmt.Errorf("unknown ciphertext version %d", ciphertext[0])
	}
	nonce := ciphertext[1 : 1+c.aead.NonceSize()]
	plain, err := c.aead.Open(nil, nonce, ciphertext[1+c.aead.NonceSize():], rowAAD(orgID, username, secretName))
	if err != nil {
		return "", fmt.Errorf("decrypt user secret: %w", err)
	}
	return string(plain), nil
}