Module encrypted_blob 

Tenant-scoped encrypted BLOB persistence for tee capture payloads.

The tee stores redacted request and response bodies as opaque binary payloads. This module keeps those payloads encrypted at rest with a tenant-provided 32-byte key and a per-blob ChaCha20-Poly1305 nonce. Authentication failures on read are surfaced as errors and do not return plaintext.

Structs

BlobHandle

Opaque handle returned after a blob is written.

EncryptedBlob

Ciphertext plus the unique nonce required for decryption.

SqliteEncryptedBlobStore

SQLite-backed encrypted BLOB store.

TenantId

Tenant identifier used to isolate encrypted BLOB rows.

TenantKey

Tenant-scoped 256-bit AEAD key.

Enums

BlobStoreError

Errors returned by SQLite encrypted BLOB persistence.

DecryptError

Decryption failure. Authentication failure is intentionally coarse so callers cannot distinguish a wrong key from ciphertext tampering.

EncryptError

Encryption failure surfaced without panicking in public helpers.

Functions

decrypt_blob

Decrypt blob with the tenant key.

encrypt_blob

Encrypt plaintext with the tenant key.