Struct RotatingKeyProvider 

pub struct RotatingKeyProvider { /* private fields */ }

A key provider with automatic rotation support.

Generates cryptographically random AES-256 keys and rotates them based on the configured RotationPolicy. Old keys are retained (up to retain_old_keys) so historical data can still be decrypted.

Thread-safe: uses RwLock for state and AtomicU64 for the encryption counter (zero contention on the hot read path).

Implementations

impl RotatingKeyProvider

pub fn new(policy: RotationPolicy) -> Self

Create a new rotating key provider with the given policy.

An initial random key is generated immediately.

pub fn with_initial_key( key_bytes: Vec<u8>, key_id: &str, policy: RotationPolicy, ) -> Result<Self, AuthError>

Create a rotating provider seeded with an existing key.

Useful for migrating from a static key to rotating keys.

pub fn rotate_now(&self) -> RotationEvent

Manually trigger key rotation regardless of policy thresholds.

Returns the rotation event.

pub fn record_encryption(&self)

Record that the current key was used for an encryption operation.

Call this from the EncryptionService after each encrypt() call so that usage-based rotation can be tracked.

pub fn current_key_usage(&self) -> u64

Get the current encryption count for the active key.

pub fn rotation_history(&self) -> Vec<RotationEvent>

Return all rotation events (most recent last).

pub fn key_count(&self) -> usize

Number of keys currently held (current + retained old).

pub fn current_key_age(&self) -> Duration

Returns the current key’s age (time since creation).

Trait Implementations

impl Debug for RotatingKeyProvider

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl KeyProvider for RotatingKeyProvider

fn current_key(&self) -> Result<(SecretKey, String), AuthError>

Get the current (latest) encryption key and its ID.

fn key_by_id(&self, key_id: &str) -> Result<SecretKey, AuthError>

Get a key by its ID (for decrypting old data).

fn key_ids(&self) -> Vec<String>

List all available key IDs.