defmodule Towerops.Encrypted.Binary do
  @moduledoc """
  Encrypted binary field using Cloak vault.

  Used for sensitive credentials like MikroTik API passwords.
  Data is encrypted at rest using AES-256-GCM.

  ## Usage

  In your schema:

      field :password, Towerops.Encrypted.Binary

  The field will be automatically encrypted when writing to the database
  and decrypted when reading from the database.

  ## Database Schema

  The database column should be of type `:binary`:

      add :password, :binary

  ## Examples

      # In a changeset
      cast(attrs, [:password])
      # Password is automatically encrypted before database write

      # Reading from database
      user.password  # Automatically decrypted

      # Nil handling
      nil values are preserved (not encrypted)
  """
  use Cloak.Ecto.Binary, vault: Towerops.Vault
end
