An extension for encrypting attributes of a resource.
See the getting started guide for more information.
cloak
Encrypt attributes of a resource
Options
| Name | Type | Default | Docs |
|---|---|---|---|
vault | module | (any, any -> any) | mfa | The vault to use to encrypt & decrypt the value. Accepts a module implementing Cloak.Vault, a fun/2 of the form (resource_module, context) -> vault_module, or an MFA tuple. When a function or MFA is given, it is called at every encrypt and decrypt operation and its return value is used as the vault module. | |
attributes | atom | list(atom) | [] | The attribute or attributes to encrypt. The attribute will be renamed to encrypted_{attribute}, and a calculation with the same name will be added. |
decrypt_by_default | atom | list(atom) | [] | A list of attributes that should be decrypted (their calculation should be loaded) by default. |
on_decrypt | (any, any, any, any -> any) | mfa | A function to call when decrypting any value. Takes the resource, field, records, and calculation context. Must return :ok or {:error, error} | |
encrypt_nil? | boolean | true | When false, a nil value for an encrypted attribute is stored as SQL NULL in the backing encrypted_* column instead of being encrypted. This keeps IS NOT NULL queries meaningful for nullable attributes. Defaults to true, which encrypts nil and stores a non-null ciphertext, preserving the original behavior. |