appcore_security/vault.rs
1// =============================================================================
2// #######
3// ### ### F: vault.rs
4// ## ## ## ## P: AppCore-Runtime
5// ## ##
6// C: 2026/05/31 13:38:42 by dnettoRaw
7// ## ## ## ## U: 2026/07/23 23:50:45 by dnettoRaw
8// ########### S: 1.0.1-rc.8
9// =============================================================================
10
11//! Vault contracts for local secret lock/unlock boundaries.
12
13use crate::token::SecurityResult;
14
15/// Vault state contract.
16#[derive(Debug, Clone, Copy, PartialEq, Eq)]
17pub enum VaultState {
18 /// Secret material is unavailable.
19 Locked,
20 /// Secret material may be accessed through the vault implementation.
21 Unlocked,
22}
23
24/// Minimal vault contract. This is not a remote vault protocol.
25pub trait Vault {
26 /// Returns the current vault state.
27 fn state(&self) -> VaultState;
28 /// Removes access to secret material.
29 fn lock(&mut self) -> SecurityResult<()>;
30 /// Unlocks the vault using deployment-supplied key material.
31 fn unlock(&mut self, key_material: &[u8]) -> SecurityResult<()>;
32}
33
34#[cfg(test)]
35#[path = "vault_tests.rs"]
36mod tests;