Struct FieldEncryptor 

pub struct FieldEncryptor { /* private fields */ }

Field-level encryption using AES-256-GCM.

Each encrypted field has the wire format: base64(key_version_1 || nonce_12_bytes || ciphertext_with_tag)

The 1-byte key version prefix enables future key rotation: the decryptor can identify which key was used and select the correct one.

A fresh random nonce is generated for every encrypt_* call, so encrypting the same plaintext twice yields different ciphertext.

Implementations

impl FieldEncryptor

pub fn new(key: &[u8; 32]) -> Self

Create from a raw 32-byte key.

pub fn with_previous_key(self, key: &[u8; 32]) -> Self

Set a previous key for rotation. During decryption, if the current key fails, the previous key is tried. This allows a rolling upgrade window where old data is still readable.

pub fn from_hex_key(hex_key: &str) -> Result<Self, EncryptionError>

Create from a hex-encoded key string (64 hex chars = 32 bytes).

pub fn with_previous_hex_key( self, hex_key: &str, ) -> Result<Self, EncryptionError>

Create from a hex-encoded previous key for rotation support.

pub fn from_env() -> Result<Option<Self>, EncryptionError>

Create from the ARBITER_STORAGE_ENCRYPTION_KEY environment variable.

Returns Ok(None) when the variable is absent or empty (encryption disabled). Returns Err when the variable is present but malformed.

pub fn encrypt_field(&self, plaintext: &str) -> Result<String, EncryptionError>

Encrypt a UTF-8 string field.

Returns a base64-encoded blob containing nonce || ciphertext.

pub fn decrypt_field(&self, encoded: &str) -> Result<String, EncryptionError>

Decrypt a base64-encoded nonce || ciphertext blob back to the original UTF-8 string.

pub fn encrypt_string_vec( &self, values: &[String], ) -> Result<String, EncryptionError>

Encrypt a Vec<String> by JSON-serializing then encrypting.

pub fn decrypt_string_vec( &self, ciphertext: &str, ) -> Result<Vec<String>, EncryptionError>

Decrypt back to Vec<String>.

Trait Implementations

impl Clone for FieldEncryptor

fn clone(&self) -> FieldEncryptor

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.