Struct VaultTransit 

pub struct VaultTransit { /* private fields */ }

Vault’s transit engine, reached over HTTP.

Debug derives safely because the only credential — the Vault token — is a Secret, which redacts itself and zeroizes on drop. A bare String here would print verbatim, and VaultTransit is reachable through the derived Debug of Runtime, StepCtx and RuntimeBuilder, so one tracing::debug! would put the token in a log — the exact hole every other credential holder in this crate hand-redacts against.

Implementations

impl VaultTransit

pub fn new( address: impl Into<String>, mount: impl Into<String>, token: impl Into<String>, ) -> Result<Self, KeyError>

Point at a Vault, with a token that may use the transit mount.

Errors

If an HTTP client cannot be built.

pub fn key_name(scope: &str) -> String

The transit key that holds scope: ap- and the hex SHA-256 of it.

Public so an operator provisioning keys — deletion_allowed is set per key — can name the one a scope maps to.

Trait Implementations

impl Clone for VaultTransit

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VaultTransit

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl KeyRing for VaultTransit

fn destroy<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, scope: &'life1 str, _at: Timestamp, _reason: &'life2 str, ) -> Pin<Box<dyn Future<Output = Result<(), KeyError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Deletes the transit key. at and reason are not sent: transit keeps no record of why a key went, so they live in the erasure record the caller wrote before calling this (CaseStore::begin_erasure for a case).

fn data_key<'life0, 'life1, 'async_trait>( &'life0 self, scope: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<(DataKey, WrappedKey), KeyError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Mint a fresh data key, wrapped under the scope’s key.

fn open<'life0, 'life1, 'async_trait>( &'life0 self, wrapped: &'life1 WrappedKey, ) -> Pin<Box<dyn Future<Output = Result<DataKey, KeyError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Open a wrapped data key.