Struct DerivedKeyProvider 

pub struct DerivedKeyProvider { /* private fields */ }

Derives per-audience LocalKeyCiphers from one login-derived master secret (HKDF-SHA256), caching by audience. The master comes from the Parslee login (per-user) / entitlements (per-org); it is NEVER sent to the relay.

Implementations

impl DerivedKeyProvider

pub fn new(master: impl Into<Vec<u8>>) -> Self

Build over a raw 32-byte master (already high-entropy + stable across the user’s devices). Prefer Self::from_master with a StretchedMaster.

pub fn from_master(master: &StretchedMaster) -> Self

Build the per-audience AEAD keys from a StretchedMaster — the same master that mints the identity keys, so Argon2id runs ONCE at open and both paths share it.

pub fn from_login_secret(login_secret: &[u8], user_id: &str) -> Self

Build from a Parslee-issued high-entropy secret bound to user_id (no Argon2id — the secret is already strong). The issued-key alternative to a passphrase; both converge on a StretchedMaster.

pub fn from_passphrase(passphrase: &str, user_id: &str) -> Self

Build from a user sync passphrase — the zero-knowledge cross-device key source that needs NO server key distribution: every device on which the user enters the same passphrase derives the same keys, and Parslee (relay + platform) never sees it. The passphrase is Argon2id-STRETCHED (see StretchedMaster::from_passphrase) before any key derivation.

Trait Implementations

impl Debug for DerivedKeyProvider

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl SyncKeyProvider for DerivedKeyProvider

fn cipher_for(&self, scope: &Scope) -> Arc<dyn PayloadCipher>