w3-io/W3 PII Envelope Action
Self-hosted donor-PII envelope: in-action DEK, AES-256-GCM, Storj blob, tenant-KEK wrap, deletion-attested gate
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| command | Operation: encrypt-and-store, decrypt-for-read | yes | — |
| tenant-id | Tenant scope; selects the KEK and prefixes the blob key | yes | — |
| user-id | Donor id; blob-key segment / audit scope | yes | — |
| bucket | Storj bucket (e.g. hope-give-pii) | yes | — |
| provider | KEK provider (default: self-hosted) | no | self-hosted |
| kek | Tenant master KEK (secret-backed) | yes | — |
| storj-access-key | Storj access key (secret-backed) | yes | — |
| storj-secret-key | Storj secret key (secret-backed) | yes | — |
| storj-endpoint | Override the Storj S3 gateway endpoint (e.g. MinIO for staging); default https://gateway.storjshare.io | no | — |
| plaintext | PII payload (JSON string) to encrypt | no | — |
| wrapped-dek | KEK-wrapped per-user DEK (from the User row) | no | — |
| pii-blob-key | Storj blob key (from the User row) | no | — |
| deletion-attested | 'true' if a UserDeletion attestation exists (caller reads state); true => ACCESS_DENIED, no plaintext | no | — |
Outputs
| name | description |
|---|---|
| result | JSON result: encrypt-and-store -> { wrapped_dek, pii_blob_key }; decrypt-for-read -> { plaintext } |