Struct ZeroKMS 

pub struct ZeroKMS<C, ClientKeyState = ()>
where
    ClientKeyState: Zeroize,
{ /* private fields */ }

Implementations

impl<C: Credentials<Token = ServiceToken>> ZeroKMS<C>

pub fn new( base_url: &Url, credentials: C, decryption_log_path: Option<&Path>, ) -> Self

Create a new instance of the ZeroKMS client.

In most cases it is prefered to use crate::config::ZeroKMSConfig::create_client instead of calling this manually.

pub fn new_with_client_key( base_url: &Url, credentials: C, decryption_log_path: Option<&Path>, client_key: ClientKey, ) -> ZeroKMSWithClientKey<C>

Create a new instance of the ZeroKMS client with a ClientKey.

In most cases it is prefered to use crate::config::ZeroKMSConfigWithClientKey::create_client instead of calling this manually.

impl<C: Credentials<Token = ServiceToken>, K> ZeroKMS<C, K>

where K: Zeroize,

pub fn log_decryptions<P>(&self, records: &[P], access_token: &str)

where P: Decryptable,

pub async fn create_dataset( &self, name: &str, description: &str, ) -> Result<Keyset, Error>

👎Deprecated since 0.26.0: replaced by create_keyset

Create a Keyset (previously known as a Keyset) in ZeroKMS used to encrypt data. The name and description are used to identify the keyset.

pub async fn create_keyset( &self, name: &str, description: &str, ) -> Result<Keyset, Error>

Create a Keyset in ZeroKMS used to encrypt data. The name and description are used to identify the keyset.

pub async fn grant_dataset( &self, client_id: Uuid, keyset_id: Uuid, ) -> Result<(), Error>

👎Deprecated since 0.26.0: replaced by grant_keyset

Grant a client with the given client_id access to a Keyset with an ID of keyset_id. For this to work, the client must already exist and have access to at least one dayaset.

If you are creating a new client, use Self::create_client instead. Note that the client and keyset must be in the same workspace.

pub async fn grant_keyset( &self, client_id: Uuid, keyset_id: Uuid, ) -> Result<(), Error>

Grant a client with the given client_id access to a Keyset with an ID of keyset_id. For this to work, the client must already exist and have access to at least one dayaset.

If you are creating a new client, use Self::create_client instead. Note that the client and keyset must be in the same workspace.

pub async fn revoke_dataset( &self, client_id: Uuid, keyset_id: Uuid, ) -> Result<(), Error>

👎Deprecated since 0.26.0: replaced by revoke_keyset

Revoke a Client with the given client_id access to the Keyset with keyset_id. If the client only has access to one keyset, this is the same as deleting the client.

pub async fn revoke_keyset( &self, client_id: Uuid, keyset_id: Uuid, ) -> Result<(), Error>

Revoke a Client with the given client_id access to the Keyset with keyset_id. If the client only has access to one keyset, this is the same as deleting the client.

pub async fn list_datasets( &self, include_disabled: bool, ) -> Result<Vec<Keyset>, Error>

👎Deprecated since 0.26.0: replaced by list_datasets

List all Keysets in ZeroKMS for the current workspace.

pub async fn list_keysets( &self, include_disabled: bool, ) -> Result<Vec<Keyset>, Error>

List all Keysets in ZeroKMS for the current workspace.

pub async fn enable_dataset(&self, keyset_id: Uuid) -> Result<(), Error>

👎Deprecated since 0.26.0: replaced by enable_keyset

Enable a Keyset by ID if it has been disabled.

pub async fn enable_keyset(&self, keyset_id: Uuid) -> Result<(), Error>

Enable a Keyset by ID if it has been disabled.

pub async fn disable_dataset(&self, keyset_id: Uuid) -> Result<(), Error>

👎Deprecated since 0.26.0: replaced by disable_keyset

Disable a Keyset by ID.

A disabled keyset will deny all attempts to encrypt and decrypt data.

pub async fn disable_keyset(&self, keyset_id: Uuid) -> Result<(), Error>

Disable a Keyset by ID.

A disabled keyset will deny all attempts to encrypt and decrypt data.

pub async fn modify_dataset( &self, keyset_id: Uuid, name: Option<&str>, description: Option<&str>, ) -> Result<(), Error>

👎Deprecated since 0.26.0: replaced by modify_keyset

Modify a Keyset by ID by setting a new name or description.

pub async fn modify_keyset( &self, keyset_id: Uuid, name: Option<&str>, description: Option<&str>, ) -> Result<(), Error>

Modify a Keyset by ID by setting a new name or description.

pub async fn create_client( &self, name: &str, description: &str, keyset_id: Uuid, ) -> Result<CreateClientResponse, Error>

Create a new client for the specified keyset.

Clients are required to generate and retrieve keysets key a specified keyset. Use the ClientKey returned by CreateClientResponse to create a ZeroKMSWithClientKey client that can encrypt and decrypt.

This ClientKey can not be retrieved again after creating the client. So it’s important to keep it somewhere safe.

ClientKey compromise

If you suspect that a ClientKey has been compromised, you should revoke the client and create a new one. See Self::delete_client for more information.

Create vs Grant

If you are creating a new client, use this method. If you are granting access to an existing client, use Self::grant_keyset instead.

pub async fn list_clients(&self) -> Result<Vec<KeysetClient>, Error>

List clients for the current workspace in ZeroKMS.

pub async fn delete_client( &self, client_id: Uuid, ) -> Result<DeleteClientResponse, Error>

Delete client by ID.

Once a client is deleted it can’t be used to generate or retrieve data keys. This method nullifies the ClientKey for the client. Even if an attacker has the ClientKey, they can’t use it to decrypt data.

To revoke access only to a specific keyset, use Self::revoke_keyset instead.

impl<C: Credentials<Token = ServiceToken>> ZeroKMS<C, ClientKey>

pub async fn encrypt( &self, payloads: impl IntoIterator<Item = EncryptPayload<'_>>, keyset_id: Option<Uuid>, ) -> Result<Vec<EncryptedRecord>, Error>

Encrypt a stream of EncryptPayload and return them as an EncryptedRecord. Note that this only works when Self is a ZeroKMSWithClientKey client.

pub async fn encrypt_single( &self, payload: EncryptPayload<'_>, keyset_id: Option<Uuid>, ) -> Result<EncryptedRecord, Error>

Encrypt a single EncryptPayload. Note that this only works when Self is a ZeroKMSWithClientKey client.

pub async fn decrypt<P>( &self, payloads: impl IntoIterator<Item = P>, keyset_id: Option<Uuid>, service_token: Option<ServiceToken>, unverified_context: Option<UnverifiedContext>, ) -> Result<Vec<Vec<u8>>, Error>

where P: Decryptable,

Decrypt a stream of EncryptedRecord and return the raw decrypted binary blob. Note that this only works when Self is a ZeroKMSWithClientKey client.

This function will decrypt records from any keyset that the client has access to.

pub async fn decrypt_fallible<P>( &self, payloads: impl IntoIterator<Item = P>, service_token: Option<ServiceToken>, unverified_context: Option<UnverifiedContext>, ) -> Result<Vec<Result<Vec<u8>, RecordDecryptError>>, Error>

where P: Decryptable,

Decrypt a stream of EncryptedRecord and return the raw decrypted binary blob. Note that this only works when Self is a ZeroKMSWithClientKey client.

This function will decrypt records from any keyset that the client has access to.

pub async fn decrypt_single<P>( &self, payload: P, keyset_id: Option<Uuid>, service_token: Option<ServiceToken>, unverified_context: Option<UnverifiedContext>, ) -> Result<Vec<u8>, Error>

where P: Decryptable,

Decrypt a single EncryptedRecord. Note that this only works when Self is a ZeroKMSWithClientKey client.

Trait Implementations

impl<C, ClientKeyState> Drop for ZeroKMS<C, ClientKeyState>

where ClientKeyState: Zeroize,

fn drop(&mut self)

Executes the destructor for this type.

impl<C, ClientKeyState> Zeroize for ZeroKMS<C, ClientKeyState>

where ClientKeyState: Zeroize,

fn zeroize(&mut self)

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler.