EncryptField encrypts a sensitive field value using age encryption. Returns the encrypted value with the encryption prefix, or an error.
(value string)
| 123 | // EncryptField encrypts a sensitive field value using age encryption. |
| 124 | // Returns the encrypted value with the encryption prefix, or an error. |
| 125 | func EncryptField(value string) (string, error) { |
| 126 | if value == "" { |
| 127 | return "", nil |
| 128 | } |
| 129 | |
| 130 | if isEncrypted(value) { |
| 131 | // Already encrypted, return as-is |
| 132 | return value, nil |
| 133 | } |
| 134 | |
| 135 | _, recipient, err := getOrCreateAgeIdentity() |
| 136 | if err != nil { |
| 137 | return "", fmt.Errorf("get age identity: %w", err) |
| 138 | } |
| 139 | |
| 140 | // Encrypt the value |
| 141 | var encrypted bytes.Buffer |
| 142 | |
| 143 | encryptWriter, err := age.Encrypt(&encrypted, recipient) |
| 144 | if err != nil { |
| 145 | return "", fmt.Errorf("create encrypt writer: %w", err) |
| 146 | } |
| 147 | |
| 148 | if _, err := encryptWriter.Write([]byte(value)); err != nil { |
| 149 | return "", fmt.Errorf("write to encrypt: %w", err) |
| 150 | } |
| 151 | |
| 152 | if err := encryptWriter.Close(); err != nil { |
| 153 | return "", fmt.Errorf("close encrypt writer: %w", err) |
| 154 | } |
| 155 | |
| 156 | // Base64 encode the encrypted data for safe YAML storage |
| 157 | encryptedData := base64.StdEncoding.EncodeToString(encrypted.Bytes()) |
| 158 | return encryptionPrefix + encryptedData, nil |
| 159 | } |
| 160 | |
| 161 | // DecryptField decrypts an encrypted field value. |
| 162 | // Returns the decrypted value, or the original value if not encrypted. |