module

Vault

Constants

CIPHER_KEY_SIZE = 32
ENCRYPTED_PREFIX = "encrypted:"
HMAC_KEY_SIZE = 32
IV_SIZE = 16
Log = ::Log.for(self)
PBKDF2_ITERATIONS = 600000
SALT_SIZE = 16

Class methods

decrypt_file(content : String, password : String) : String

Decrypt all encrypted values in a dotenv file content string.

Source
decrypt_hash(vars : Hash(String, String), password : String) : Hash(String, String)

Decrypt encrypted values in a loaded hash (from Dotenv.load).

Source
decrypt_value(value : String, password : String) : String

Decrypt an "encrypted:..." value with a password. Raises Vault::Error on wrong password or tampered data.

Source
encrypt_file(content : String, password : String) : Tuple(String, Array(String))

Encrypt all plaintext values in a dotenv file content string. Returns {encrypted_content, skipped_keys}.

Source
encrypt_value(plaintext : String, password : String) : String

Encrypt a plaintext value with a password. Uses AES-256-CBC + HMAC-SHA256 (Encrypt-then-MAC). Returns "encrypted:" + Base64(salt[16] + iv[16] + hmac[32] + ciphertext[N])

Source
encrypted?(value : String) : Bool

Check if a value is encrypted.

Source
has_encrypted?(vars : Hash(String, String)) : Bool

Check if any values in a hash are encrypted.

Source
load_dotenv_files(files : Enumerable(String), passwords : Array(ObfuscatedPassword) = [] of ObfuscatedPassword) : Tuple(Hash(String, String), Array(ObfuscatedPassword))

Load dotenv files, decrypting each file with its own password. Tries previously entered passwords first before prompting. Passwords are stored obfuscated (XOR'd with random pad) in memory. Returns merged vars and updated password cache.

Source
prompt_password(confirm : Bool = false, prompt : String = "Password: ") : String

Prompt for password on STDERR (hidden input).

Source
wipe(bytes : Bytes) : Nil

Zero out a Bytes buffer to remove sensitive data from memory.

Source
wipe(str : String) : Nil

Zero out a String's backing memory to remove sensitive data. Safe with Boehm GC (non-moving collector).

Source
wipe_passwords(passwords : Array(ObfuscatedPassword)) : Nil

Wipe all cached obfuscated passwords.

Source

Nested types