Struct SecureCache 

pub struct SecureCache<'a> { /* private fields */ }

Encrypted cache handle returned by CacheKit::secure_cache().

All values are serialized, then encrypted with AES-256-GCM before storage. L1 stores ciphertext to maintain zero-knowledge guarantees. The client’s own value methods route through these same methods once encryption is configured, so the handle and the client read each other’s entries.

Implementations

impl SecureCache<'_>

pub fn previous_key_hits(&self) -> Vec<u64>

Rotation drain signal; see EncryptionLayer::previous_key_hits.

pub fn hardware_acceleration_enabled(&self) -> bool

Whether AES is hardware-accelerated on this host (informational); see EncryptionLayer::hardware_acceleration_enabled.

pub async fn set<T: Serialize>( &self, key: &str, value: &T, ) -> Result<(), CachekitError>

Encrypt and store value under key using the client’s default TTL.

pub async fn set_with_ttl<T: Serialize>( &self, key: &str, value: &T, ttl: Duration, ) -> Result<(), CachekitError>

Encrypt and store value under key with an explicit ttl.

The client namespace is not checked here: an interop key written on a namespaced client lands under {namespace}:{interop_key}, which no interop reader addresses — see CacheKit::interop_get.

pub async fn get<T: DeserializeOwned>( &self, key: &str, ) -> Result<Option<T>, CachekitError>

Retrieve, decrypt, and deserialize a value stored under key.

Checks L1 (which holds ciphertext) before the backend.

Errors

Returns CachekitError::Encryption if the stored entry fails decryption. The key’s L1 copy is dropped first and the backend entry is left in place, so the next read reaches the backend: a hit once the entry is replaced with ciphertext this client can decrypt, a miss once it expires or is deleted. A decrypted entry that does not decode as T is CachekitError::Serialization naming only T: the decoder’s own message would quote the plaintext.

pub async fn interop_get<T: DeserializeOwned>( &self, key: &str, ) -> Result<Option<T>, CachekitError>

Retrieve, decrypt, and deserialize an interop-mode value stored under key.

Identical to Self::get except the decrypted plaintext is decoded with crate::interop::deserialize — exactly one MessagePack document, trailing bytes rejected (interop/v1 spec MUST), as in Self::get. In interop mode the AES-GCM plaintext is the plain MessagePack value bytes, so the AAD (v0x03, format="msgpack", compressed="False") verifies cross-SDK unchanged.

Errors

Returns CachekitError::Config on a namespace-prefixed client — see CacheKit::interop_get — and CachekitError::Encryption if the stored entry fails decryption, with the key’s L1 copy dropped as for Self::get.

pub async fn interop_get_swr<T: DeserializeOwned>( &self, key: &str, ) -> Result<SwrRead<T>, CachekitError>

Retrieve, decrypt, and deserialize an interop-mode value with SWR classification. The secure twin of CacheKit::interop_get_swr: staleness is judged on the L1 ciphertext entry (zero-knowledge is preserved — freshness metadata never exposes plaintext), then the value is decrypted and decoded per Self::interop_get.

Errors

Same as Self::interop_get — the secure path fails closed on every backend and decryption error.

pub async fn delete(&self, key: &str) -> Result<bool, CachekitError>

Delete an encrypted key. Behaves identically to CacheKit::delete.

pub async fn exists(&self, key: &str) -> Result<bool, CachekitError>

Check if an encrypted key exists. Behaves identically to CacheKit::exists.

Trait Implementations

impl Debug for SecureCache<'_>

Available on crate feature encryption only.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.