This lesson's interactive features are locked, please to keep using them

Encrypted Files

Imagine a payroll service that stores employee tax documents as ordinary files. If an attacker copies its disk, backup, or storage snapshot, they get every document in plaintext.

If you're storing sensitive documents, encrypt them at rest.

Encrypt Before Writing

The safest way to handle the storage sequence is:

Validate the plaintext file while it is still in memory.
Encrypt its bytes with the active key from the keyring.
Serialize the key version, nonce, authentication tag, and ciphertext.
Write only that serialized encrypted payload to storage.

In other words, the plaintext bytes never touch the disk, only memory. Downloads reverse the transform only after the existing authorization or signed-link checks succeed.

Give the encrypted file a random name, like a UUID with an .enc extension. Map that value back to the original filename in the database so the stored path doesn't reveal or trust a user-supplied name.

Archive imports need the same boundary. Validate each entry in memory and encrypt its contents before writing it; never extract a plaintext copy first.

Existing Documents

Changing the write path protects new uploads, but not documents already on disk. Bearly Secure's startup migration sends those files through the same storage transform before accepting requests. Once that transform encrypts documents, the migration updates each stored path and removes the runtime plaintext.

Seed fixtures are course inputs rather than runtime uploads. Keep the sample PDF in data/fixtures and copy that directory into the container so migration can initialize the seeded document without making the fixture look like live plaintext storage.

Assignment

The upload flow, archive imports, authorized downloads, and automatic migration are already wired together. Complete the two byte transforms in internal/uploads/documents.go, then move the sample fixture out of runtime storage.

Implement encryptDocument with the shared keyring. Return its serialized payload and mark the result as encrypted so storage uses an .enc filename and owner-only permissions.
Implement decryptDocument with the shared keyring so authorized downloads return the original document bytes and reject invalid encrypted payloads.
Move data/uploads/mystery-shack-tax-exemption.pdf to data/fixtures.
Remove the PDF's exceptions from .gitignore and .dockerignore.
Update Dockerfile to copy data/fixtures into the container image.
Start the app.

With Bearly Secure still running, run and submit the CLI tests from the project root.