Why StoreEnv encrypts each secret separately

The first design for StoreEnv encrypted each .env file with one key. It is the obvious approach and it works, until someone asks to share two keys out of forty.

Sharing

With one key per file, giving someone two secrets means giving them the key to all forty. With one key per secret, a person holds wrapped keys for exactly what they were granted. Someone without a wrapped key sees nothing, even with a copy of the database.

Revoking

When a person loses access, only the secrets they could read need new keys. For a contractor with three keys, that is three re-encryptions.

Diffs

Each secret is its own immutable record. Two versions hold the same value for a key exactly when they point to the same record, so diffs are exact without decrypting anything on the server.

What it costs

More records and more wrapped keys. For two hundred secrets and five readers that is a thousand small wrapped keys, which is nothing for a database and a fraction of a second for a laptop.