Struct EncryptingUserStore 

pub struct EncryptingUserStore { /* private fields */ }

A UserStore decorator that keeps email/phone encrypted at rest while preserving equality lookup via a keyed blind index (HMAC-SHA256).

The wrapped store never sees plaintext PII: on write, the real address is AES-encrypted into the identity’s attributes and the indexed email field is replaced by its blind index; on read, the plaintext is transparently restored. find_by_email hashes the query with the same key, so exact-match lookup still works without exposing PII — closing the “plaintext PII in the store” gap while remaining GDPR-shreddable (drop the subject’s key in the vault and the ciphertext is unrecoverable).

Storing the index in the email field is intrinsic to decorating an opaque UserStore (whose find_by_email matches on that field). To make the value unmistakably not a plaintext address — for anyone inspecting the backing store — the blind index is prefixed with BLIND_INDEX_PREFIX ("bi$"), which no real email can contain in that position.

Implementations

impl EncryptingUserStore

pub fn new( inner: Arc<dyn UserStore>, cipher: Arc<dyn PiiCipher>, index_key: impl Into<Vec<u8>>, ) -> Self

Trait Implementations

impl UserStore for EncryptingUserStore

fn find_by_id<'life0, 'life1, 'async_trait>( &'life0 self, id: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<Option<Identity>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn find_by_email<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, tenant: Option<&'life1 str>, email: &'life2 str, ) -> Pin<Box<dyn Future<Output = Result<Option<Identity>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

fn insert<'life0, 'life1, 'async_trait>( &'life0 self, identity: &'life1 Identity, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Insert a new identity. Must return IdentityError::AlreadyExists on a tenant+email collision.

fn update<'life0, 'life1, 'async_trait>( &'life0 self, identity: &'life1 Identity, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Overwrite an existing identity (profile edits, status transitions, verification flags, MFA state).

fn set_status<'life0, 'life1, 'async_trait>( &'life0 self, id: &'life1 str, status: AccountStatus, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Set only the account status (lock / suspend / activate).

fn set_mfa<'life0, 'life1, 'async_trait>( &'life0 self, id: &'life1 str, mfa: MfaState, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Update just the MFA enrolment summary (called after TOTP/passkey changes).