Struct VaultBackend 

pub struct VaultBackend { /* private fields */ }

Implementations

impl VaultBackend

pub fn new( addr: impl Into<String>, token: impl Into<String>, mount: impl Into<String>, ) -> Result<Self, BackendError>

Build a backend talking to the vault at addr with token, using the transit engine mounted at mount.

Trait Implementations

impl Backend for VaultBackend

fn kind(&self) -> &'static str

Short, stable name for this backend (e.g. "vault"), used in STATUS.

fn new_key<'life0, 'async_trait>( &'life0 self, key_type: KeyType, ) -> Pin<Box<dyn Future<Output = Result<NewKey, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

NEW_KEY creates a new key of key_type and returns its id + public key.

fn create_named_key<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, key_type: KeyType, ) -> Pin<Box<dyn Future<Output = Result<NewKey, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Create an asymmetric crypto key at a named path (key_id = the catalog transit key name) rather than the server-assigned id [new_key] uses. This is the startup-reconcile (vault-zrg) generate path: the key must exist at the exact catalog path so a later sign/get_public_key resolves to it.

fn create_named_aead<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, aead: AeadAlgorithm, ) -> Pin<Box<dyn Future<Output = Result<(), BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Create a symmetric AEAD crypto key at a named path. AEAD suites are not wire KeyTypes, so the reconcile generate path passes aead, the catalog algorithm. There is no public half to return; Ok(()) means the key now exists at key_id.

fn public_key<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Read the raw public key bytes for key_id (for Ed25519, 32 bytes). Used by credential minters (e.g. to derive a NATS issuer NKey).

fn public_key_with_meta<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<PublicKey, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

GET_PUBLIC_KEY: read the public half plus its metadata (algorithm + current version) for key_id.

fn key_metadata<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<KeyMetadata, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Read value-free metadata (algorithm + latest version) for key_id. Used by list to populate each [basil_proto::KeyEntry] without ever reading key material.

fn public_keys<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<BTreeMap<u32, Vec<u8>>, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Read every live version’s public key for key_id, keyed by version number. For a transit key this is the data.keys map, each archived (and the latest) version’s public half, which is the natural multi-version source for a rotation/grace-aware JWKS (basil-uce.2): the shared generator emits one JWK per version still inside the grace window.

fn import<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, key_id: &'life1 str, key_type: KeyType, material: &'life2 KeyMaterial, ) -> Pin<Box<dyn Future<Output = Result<NewKey, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

IMPORT (BYOK) creates the key key_id from caller-supplied material.

fn sign<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, key_id: &'life1 str, message: &'life2 [u8], ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

SIGN signs message with key_id, returning the raw signature bytes.

fn sign_with_options<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, key_id: &'life1 str, message: &'life2 [u8], options: SignOptions, ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

SIGN with backend-specific algorithm options.

fn verify<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, key_id: &'life1 str, message: &'life2 [u8], signature: &'life3 [u8], ) -> Pin<Box<dyn Future<Output = Result<bool, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

VERIFY verifies signature over message with key_id.

fn verify_with_options<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, key_id: &'life1 str, message: &'life2 [u8], signature: &'life3 [u8], options: SignOptions, ) -> Pin<Box<dyn Future<Output = Result<bool, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

VERIFY with backend-specific algorithm options.

fn encrypt<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, key_id: &'life1 str, algorithm: AeadAlgorithm, plaintext: &'life2 [u8], aad: Option<&'life3 [u8]>, ) -> Pin<Box<dyn Future<Output = Result<CiphertextEnvelope, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

ENCRYPT: AEAD-encrypt plaintext under key_id’s latest version, binding aad if present, and return a normalized CiphertextEnvelope.

fn decrypt<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, key_id: &'life1 str, envelope: &'life2 CiphertextEnvelope, aad: Option<&'life3 [u8]>, ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

DECRYPT: AEAD-decrypt envelope under key_id, binding aad if present, and return the recovered plaintext.

fn rotate<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<u32, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

ROTATE: bump key_id to a fresh transit key version, returning the new (now-latest) version number. New encrypt/sign always uses the newest version; older versions remain decryptable/verifiable within the grace window (see Backend::configure_versions).

fn kv_get<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, version: Option<u32>, ) -> Pin<Box<dyn Future<Output = Result<KvValue, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Read a KV-v2 value for key_id: the stored bytes plus the version they came from. version = None reads the latest version; Some(v) reads that specific version. This is the residual value-returning get path (§7) and is only ever routed to a value/public-class key by the manager. It never reads transit (crypto-key) material.

fn kv_get_secret<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, version: Option<u32>, ) -> Pin<Box<dyn Future<Output = Result<Zeroizing<Vec<u8>>, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Read a KV-v2 value as a SECRET: the stored bytes wrapped in Zeroizing end-to-end, never landing in a non-zeroizing owner that drops un-wiped. Distinct from Backend::kv_get, which returns a plain KvValue for value/public reads, this path is used only by the sealing materialize (materialize_sealing_private), where the bytes are an X25519 private key. The returned buffer wipes on drop.

fn kv_put<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, key_id: &'life1 str, value: &'life2 [u8], ) -> Pin<Box<dyn Future<Output = Result<u32, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Write value as a fresh KV-v2 version of key_id, returning the new version number (never the value). Used to rotate a value key that has a catalog generate recipe: the broker generates a fresh value and stores it as the next version (the vault-a2p decision), and to back the set op.

fn configure_versions<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, min_decryption_version: Option<u32>, min_available_version: Option<u32>, ) -> Pin<Box<dyn Future<Output = Result<(), BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Set the transit version window for key_id: min_decryption_version bounds the grace period (the oldest version decrypt/verify may still target: 0/1 honors all live versions, a higher value rejects pre-window ciphertexts), and min_available_version is the retention floor (transit deletes archived key material below it, irreversibly pruning expired versions). Both are optional; None leaves that field untouched.

fn issue_x509_svid<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, key_id: &'life1 str, spiffe_id: &'life2 str, ttl_seconds: u64, ) -> Pin<Box<dyn Future<Output = Result<X509Svid, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Issue an X.509-SVID leaf from a provider-native PKI role.

fn issue_x509_cert<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, key_id: &'life1 str, request: &'life2 X509CertRequest, ) -> Pin<Box<dyn Future<Output = Result<X509Svid, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Issue a DNS/IP-SAN X.509 leaf (a TLS cert) from a provider-native PKI role.

fn x509_bundle<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<X509Bundle, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Read trust-domain X.509 bundle material from a provider-native PKI issuer path.

fn supports_native_algorithm(&self, algorithm: NativeAlgorithm) -> bool

Whether this backend can perform algorithm natively in place: custody the private key inside the backend and run the operation without ever materializing the seed locally.

fn create_named_pqc_key<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, algorithm: NativeAlgorithm, ) -> Pin<Box<dyn Future<Output = Result<NewKey, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Provision a new backend-native ML-DSA key at the named key_id, returning only its public half. The private seed is generated and kept inside the backend and is never returned. Invoked by the backend-native crypto provider when Self::supports_native_algorithm reports support.

fn sign_pqc<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, key_id: &'life1 str, message: &'life2 [u8], algorithm: NativeAlgorithm, ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

SIGN message with a backend-native ML-DSA key, returning the raw signature bytes. The private seed never leaves the backend.

fn verify_pqc<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, key_id: &'life1 str, message: &'life2 [u8], signature: &'life3 [u8], algorithm: NativeAlgorithm, ) -> Pin<Box<dyn Future<Output = Result<bool, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

VERIFY signature over message with a backend-native ML-DSA key, using only the public half.