entkit

// Service that only needs a password hash column
import (
    "github.com/ubgo/entkit/passwordtype"
    "github.com/ubgo/entkit/ent_passwordtype"
)
// → go.sum carries: ubgo/crypt, golang.org/x/crypto, entgo.io/ent
// → does NOT carry: ubgo/jsontype, ubgo/jsonslice, gqlgen

// schema/user.go
package schema

import (
    "entgo.io/ent"
    "entgo.io/ent/schema/field"

    entencryptedtype "github.com/ubgo/entkit/ent_encryptedtype"
    entjsonmap       "github.com/ubgo/entkit/ent_jsonmap"
    entpasswordtype  "github.com/ubgo/entkit/ent_passwordtype"
)

type User struct{ ent.Schema }

func (User) Fields() []ent.Field {
    return []ent.Field{
        field.String("email").Unique(),

        entjsonmap.Field("metadata"),                // dynamic JSON object
        entpasswordtype.Field("password"),           // argon2id, redacts on output
        entencryptedtype.Field("api_secret").(...),  // AES-256-GCM
    }
}

import "github.com/ubgo/entkit/encryptedtype"

func main() {
    if err := encryptedtype.SetKey([]byte(os.Getenv("ENCRYPTION_KEY"))); err != nil {
        log.Fatal(err)
    }
    // ...
}