Store Last.fm API key with encrypted secret

lib/music_library/application.ex

@@ -9,6 +9,7 @@ defmodule MusicLibrary.Application do
   def start(_type, _args) do
     children = [
       MusicLibraryWeb.Telemetry,
+      MusicLibrary.Vault,
       MusicLibrary.Repo,
       MusicLibrary.ErrorRepo,
       MusicLibrary.BackgroundRepo,

lib/music_library/encrypted/binary.ex

@@ -0,0 +1,3 @@
+defmodule MusicLibrary.Encrypted.Binary do
+  use Cloak.Ecto.Binary, vault: MusicLibrary.Vault
+end

lib/music_library/secrets.ex

@@ -0,0 +1,14 @@
+defmodule MusicLibrary.Secrets do
+  alias MusicLibrary.Repo
+  alias MusicLibrary.Secrets.Secret
+
+  def store(name, value) do
+    %Secret{}
+    |> Secret.changeset(%{name: name, value: value})
+    |> Repo.insert(on_conflict: :replace_all)
+  end
+
+  def get!(name) do
+    Repo.get!(Secret, name)
+  end
+end

lib/music_library/secrets/secret.ex

@@ -0,0 +1,17 @@
+defmodule MusicLibrary.Secrets.Secret do
+  use Ecto.Schema
+  import Ecto.Changeset
+
+  @primary_key {:name, :string, autogenerate: false}
+  schema "secrets" do
+    field :value, MusicLibrary.Encrypted.Binary
+
+    timestamps(type: :utc_datetime)
+  end
+
+  def changeset(secret, attrs) do
+    secret
+    |> cast(attrs, [:name, :value])
+    |> validate_required([:name, :value])
+  end
+end

lib/music_library/vault.ex

@@ -0,0 +1,3 @@
+defmodule MusicLibrary.Vault do
+  use Cloak.Vault, otp_app: :music_library
+end

lib/music_library_web/controllers/last_fm_controller.ex

@@ -1,18 +1,18 @@
 defmodule MusicLibraryWeb.LastFmController do
   use MusicLibraryWeb, :controller
 
-  def callback(conn, %{"token" => token}) do
-    case LastFm.get_session(token) do
-      {:ok, session} ->
-        conn
-        |> put_session(:last_fm_user, session.name)
-        |> put_session(:last_fm_key, session.key)
-        |> put_flash(:info, "Successfully authenticated with Last.fm.")
-        |> redirect(to: ~p"/")
+  alias MusicLibrary.Secrets
 
+  def callback(conn, %{"token" => token}) do
+    with {:ok, session} <- LastFm.get_session(token),
+         {:ok, _secret} <- Secrets.store("last_fm_key", session.key) do
+      conn
+      |> put_flash(:info, gettext("Successfully connected your Last.fm account"))
+      |> redirect(to: ~p"/")
+    else
       {:error, reason} ->
         conn
-        |> put_flash(:error, "Failed to authenticate with Last.fm: #{reason}")
+        |> put_flash(:error, "Failed to connect your Last.fm account: #{reason}")
         |> redirect(to: ~p"/")
     end
   end