EventLogEncryption unstable
Cryptographic service for encrypted event-log replication.
EventLogEncryption turns local journal entries into encrypted remote
payloads and decrypts encrypted changes received from a server. It also
hashes byte data and creates event-log identities, so remote replication can
use storage or transport that should not see plaintext event data.
Constructors
Creates an EventLogEncryption service from the effect/crypto services.
Details
Each identity's AES-256-GCM key is derived from its root secret with
Digest and cached per identity. Batches are encrypted with Aead under a
random 12-byte nonce from SecureRandom, which also generates identities.
A batch that fails authentication, or whose entries do not match its entry
ids, is a defect.
Signature
declare const make: Effect.Effect<EventLogEncryption["Service"], never, Aead.Aead | Digest.Digest | SecureRandom.SecureRandom>Encryption
makeEncryptionSubtle
unstableCreates an EventLogEncryption service on the Web Crypto layers of
Aead, Digest and SecureRandom, using the supplied Crypto object.
Signature
declare function makeEncryptionSubtle(crypto: Crypto): Effect<{ readonly decrypt: (identity: { readonly privateKey: Redacted<Uint8Array<ArrayBuffer>>; readonly publicKey: string; }, storeId: string, batches: readonly Array<EncryptedRemoteBatch>) => Effect<Array<RemoteEntry>>; readonly encrypt: (identity: { readonly privateKey: Redacted<Uint8Array<ArrayBuffer>>; readonly publicKey: string; }, storeId: string, entries: readonly Array<Entry>) => Effect<Array<EncryptedBatch>>; readonly generateIdentity: Effect<{ readonly privateKey: Redacted<Uint8Array<ArrayBuffer>>; readonly publicKey: string; }>; readonly sha256: (data: Uint8Array) => Effect<Uint8Array<ArrayBufferLike>>;}>Layers
Provides EventLogEncryption from the Aead, Digest and SecureRandom
services.
When to use
Use to choose the crypto layers yourself, such as the NodeCrypto layers.
Signature
declare const layer: Layer.Layer<EventLogEncryption, never, Aead.Aead | Digest.Digest | SecureRandom.SecureRandom>layerSubtle
unstableProvides EventLogEncryption on the Web Crypto layers of Aead, Digest
and SecureRandom.
Details
The layers use the Crypto object of the WebCrypto reference, which
defaults to globalThis.crypto.
Signature
declare const layerSubtle: Layer.Layer<EventLogEncryption>Models
EncryptedBatch
unstableSchema for a batch of journal entries encrypted as one AES-GCM message.
Details
entryIds lists the ids of the encrypted entries in order. It is sent in
plaintext so the server can deduplicate batches, and it is authenticated
together with the store id, so a server cannot alter it or move the batch to
another store.
Signature
declare const EncryptedBatch: Struct<{ readonly encryptedBatch: Transferable<instanceOf<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>; readonly entryIds: NonEmptyArray<brand<instanceOf<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, "effect/eventlog/EventJournal/EntryId">>; readonly iv: Transferable<instanceOf<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;}>Type of an encrypted batch.
Signature
interface EncryptedBatch extends Type<typeof EncryptedBatch> {}EncryptedRemoteBatch
unstableSchema for encrypted batches exchanged with a remote event-log server.
Details
The entries of a batch have consecutive remote sequences starting at
sequence.
Signature
declare const EncryptedRemoteBatch: Struct<{ readonly encryptedBatch: Transferable<instanceOf<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>; readonly entryIds: NonEmptyArray<brand<instanceOf<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, "effect/eventlog/EventJournal/EntryId">>; readonly iv: Transferable<instanceOf<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>; readonly sequence: Natural;}>Type of an encrypted batch stored by a remote server, including the remote sequence of its first entry.
Signature
interface EncryptedRemoteBatch extends Type<typeof EncryptedRemoteBatch> {}Services
EventLogEncryption
unstableService that provides identity generation, entry encryption and decryption, and SHA-256 hashing for event-log replication.
When to use
Use to provide cryptographic operations required by encrypted event-log replication.
Signature
declare class EventLogEncryption extends Shape<"effect/eventlog/EventLogEncryption", { readonly decrypt: (identity: { readonly privateKey: Redacted<Uint8Array<ArrayBuffer>>; readonly publicKey: string; }, storeId: string, batches: readonly Array<EncryptedRemoteBatch>) => Effect<Array<RemoteEntry>>; readonly encrypt: (identity: { readonly privateKey: Redacted<Uint8Array<ArrayBuffer>>; readonly publicKey: string; }, storeId: string, entries: readonly Array<Entry>) => Effect<Array<EncryptedBatch>>; readonly generateIdentity: Effect<{ readonly privateKey: Redacted<Uint8Array<ArrayBuffer>>; readonly publicKey: string; }>; readonly sha256: (data: Uint8Array) => Effect<Uint8Array<ArrayBufferLike>>;}, this> { constructor(_: never);}