Struct EncryptedFileStorage 

pub struct EncryptedFileStorage { /* private fields */ }

Encrypted file storage for headless Linux environments.

Stores keys in an encrypted JSON file at ~/.auths/keys.enc. Uses Argon2id for password-based key derivation and XChaCha20-Poly1305 for encryption.

Implementations

impl EncryptedFileStorage

pub fn new(home: &Path) -> Result<EncryptedFileStorage, AgentError>

Create a new EncryptedFileStorage with default path (<home>/keys.enc).

Args:

• home - The Auths home directory (e.g., from auths_home_with_config).

Usage:

let storage = EncryptedFileStorage::new(home_path)?;

pub fn with_path(path: PathBuf) -> Result<EncryptedFileStorage, AgentError>

Create a new EncryptedFileStorage with a custom path

pub fn set_password(&self, password: Zeroizing<String>)

Set the password for this session.

Takes Zeroizing<String> to enforce that callers treat the passphrase as sensitive material from the point of construction.

Trait Implementations

impl KeyStorage for EncryptedFileStorage

fn store_key( &self, alias: &KeyAlias, identity_did: &IdentityDID, role: KeyRole, encrypted_key_data: &[u8], ) -> Result<(), AgentError>

Stores encrypted key data associated with an alias AND an identity DID.

fn load_key( &self, alias: &KeyAlias, ) -> Result<(IdentityDID, KeyRole, Vec<u8>), AgentError>

Loads the encrypted key data AND the associated identity DID for a given alias.

fn delete_key(&self, alias: &KeyAlias) -> Result<(), AgentError>

Deletes a key by its alias.

fn list_aliases(&self) -> Result<Vec<KeyAlias>, AgentError>

Lists all aliases stored by this backend for the specific service.

fn list_aliases_for_identity( &self, identity_did: &IdentityDID, ) -> Result<Vec<KeyAlias>, AgentError>

Lists aliases associated ONLY with the given identity DID.

fn get_identity_for_alias( &self, alias: &KeyAlias, ) -> Result<IdentityDID, AgentError>

Retrieves the identity DID associated with a given alias.

fn backend_name(&self) -> &'static str

Returns the name of the storage backend.

fn list_aliases_for_identity_with_role( &self, identity_did: &IdentityDID, role: KeyRole, ) -> Result<Vec<KeyAlias>, AgentError>

List aliases for an identity filtered by role.

fn is_hardware_backend(&self) -> bool

Returns true if this backend manages keys in hardware (SE, HSM).

fn rebind_identity( &self, alias: &KeyAlias, identity_did: &IdentityDID, ) -> Result<(), AgentError>

Re-associates an existing stored key with a different identity DID without touching the key material.

fn export_public_key(&self, alias: &KeyAlias) -> Result<Vec<u8>, AgentError>

Returns the raw public key bytes of a stored key without a passphrase.

fn sign_raw( &self, alias: &KeyAlias, message: &[u8], ) -> Result<Vec<u8>, AgentError>

Signs a message with a stored key without a passphrase.