1 files changed, 32 insertions, 0 deletions

diff --git a/secrets/vault_client.go b/secrets/vault_client.go
index b84b344..9d4b772 100644
--- a/secrets/vault_client.go
+++ b/secrets/vault_client.go
@@ -3,6 +3,7 @@ package secrets
 import (
         "container/heap"
         "context"
+        "encoding/base64"
         "encoding/json"
         "errors"
         "fmt"
@@ -436,6 +437,37 @@ func (c *VaultClient) WriteSecret(ctx context.Context, suffix string, in any) er
         return nil
 }
 
+func (c *VaultClient) Encrypt(ctx context.Context, suffix string, data []byte) (string, error) {
+        s, err := c.logical.WriteWithContext(
+                ctx,
+                path.Join("transit/encrypt", suffix),
+                map[string]any{"plaintext": base64.StdEncoding.EncodeToString(data)},
+        )
+        if err != nil {
+                return "", fmt.Errorf("Encrypt: unable to write to vault: %w", err)
+        }
+
+        return s.Data["ciphertext"].(string), nil
+}
+
+func (c *VaultClient) Decrypt(ctx context.Context, suffix, data string) ([]byte, error) {
+        s, err := c.logical.WriteWithContext(
+                ctx,
+                path.Join("transit/decrypt", suffix),
+                map[string]any{"ciphertext": data},
+        )
+        if err != nil {
+                return nil, fmt.Errorf("Decrypt: unable to write to vault: %w", err)
+        }
+
+        d, err := base64.StdEncoding.DecodeString(s.Data["plaintext"].(string))
+        if err != nil {
+                return nil, fmt.Errorf("Decrypt: unable to base64 decode plaintext: %w", err)
+        }
+
+        return d, nil
+}
+
 func (c *VaultClient) Destroy(h Handle) error {
         c.Lock()
         defer c.Unlock()