Encrypting the columns that deserve it

security/encryption encrypts and decrypts payloads with a key, using authenticated secretbox construction. It is the piece an application reaches for when a column holds something that should be unreadable in a backup.

Most data in an application does not need this. Names, orders, invoice lines: those live behind authentication, and encrypting them buys little while costing every query that would have filtered on them. The columns that do need it are narrower and easy to name: a third party's API token, a stored credential, a message body, a document a customer uploaded expecting privacy.

The construction is authenticated, which is the part that matters and the part hand-rolled encryption usually skips. Ciphertext that cannot be verified can be tampered with, and decryption that succeeds on modified input is worse than no encryption at all, because it produces plausible wrong data instead of an error.

Key handling stays outside the resource, in data/creds.ini with the rest of the secrets, which keeps one answer to the question of where secrets live on a Phlo node.

It pairs with the connector token store, which persists OAuth tokens at mode 0600 and locks the refresh cycle. Between them, the two categories of secret an application ends up holding, its own and somebody else's, each have a place to go.

Engine 1.0. See encrypt in the manual.