Module encryption 

Versioned XChaCha20-Poly1305 persistence encryption for OAuth tokens.

When AccountConfig::encrypt_oauth_tokens is true, access tokens, refresh tokens, and ID tokens are encrypted before being persisted and decrypted transparently on read.

Structs

EncryptedTokenSet

A set of OAuth tokens (access, refresh, id) after conditional encryption.

Functions

decrypt_token

Decrypt a token with a single persistence key, passing through plaintext.

decrypt_token_with_config

Source recognizes even-length hexadecimal (and versioned $ba$ envelopes) as ciphertext. Other strings, including old plaintext tokens, pass through.

encrypt_token

Encrypt a plaintext string with a single persistence key.

encrypt_token_set

Read encrypt_oauth_tokens and secret from the auth context and conditionally encrypt a full set of OAuth tokens in one call.

encrypt_token_with_config

Encrypt a plaintext string with the current configured persistence key.

maybe_decrypt

Conditionally decrypt a token with a single persistence key.

maybe_decrypt_with_config

Conditionally decrypt a token value. Returns the original value when encryption is disabled, or the decrypted value when enabled.

maybe_encrypt

Conditionally encrypt a token with a single persistence key.

maybe_encrypt_with_config

Conditionally encrypt a token value. Returns the original value when encryption is disabled, or the encrypted value when enabled.