LemonCore.Secrets.Crypto (lemon_core v0.1.0)

Cryptographic helpers for encrypted secret storage.

This module encrypts secret values with AES-256-GCM and derives per-secret keys using HKDF-SHA256 from the configured master key and a random salt.

Summary

version()

@type encrypted_secret() :: %{
  ciphertext: String.t(),
  nonce: String.t(),
  salt: String.t(),
  version: String.t()
}

@spec decrypt(map(), binary()) :: {:ok, String.t()} | {:error, atom()}

@spec encrypt(String.t(), binary()) :: {:ok, encrypted_secret()} | {:error, atom()}

@spec version() :: String.t()