Struct FieldEncryptor 

pub struct FieldEncryptor { /* private fields */ }

Field-level encryption using AES-256-GCM.

Each encrypted field has the wire format: base64(nonce_12_bytes || ciphertext_with_tag)

A fresh random nonce is generated for every encrypt_* call, so encrypting the same plaintext twice yields different ciphertext.

Implementations

impl FieldEncryptor

pub fn new(key: &[u8; 32]) -> Self

Create from a raw 32-byte key.

pub fn from_hex_key(hex_key: &str) -> Result<Self, EncryptionError>

Create from a hex-encoded key string (64 hex chars = 32 bytes).

pub fn from_env() -> Result<Option<Self>, EncryptionError>

Create from the ARBITER_STORAGE_ENCRYPTION_KEY environment variable.

Returns Ok(None) when the variable is absent or empty (encryption disabled). Returns Err when the variable is present but malformed.

pub fn encrypt_field(&self, plaintext: &str) -> Result<String, EncryptionError>

Encrypt a UTF-8 string field.

Returns a base64-encoded blob containing nonce || ciphertext.

pub fn decrypt_field(&self, encoded: &str) -> Result<String, EncryptionError>

Decrypt a base64-encoded nonce || ciphertext blob back to the original UTF-8 string.

pub fn encrypt_string_vec( &self, values: &[String], ) -> Result<String, EncryptionError>

Encrypt a Vec<String> by JSON-serializing then encrypting.

pub fn decrypt_string_vec( &self, ciphertext: &str, ) -> Result<Vec<String>, EncryptionError>

Decrypt back to Vec<String>.

Trait Implementations

impl Clone for FieldEncryptor

fn clone(&self) -> FieldEncryptor

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.