Struct SecretHasher 

pub struct SecretHasher<K> { /* private fields */ }

Derives LookupKeys from secrets using a KeyProvider.

Implementations

impl<K: KeyProvider> SecretHasher<K>

pub fn new(key_provider: K) -> Self

Wrap a key provider.

pub fn key_provider(&self) -> &K

Borrow the underlying key provider.

pub fn lookup_key( &self, domain: SecretDomain, value: &str, ) -> Result<(LookupKey, KeyVersion), KeyError>

Derive a lookup key for value in domain using the active key. Returns the key plus the active KeyVersion to store alongside it.

Errors

Propagates KeyError from the provider (e.g. missing active key).

pub fn lookup_key_candidates( &self, domain: SecretDomain, value: &str, ) -> Result<Vec<(LookupKey, KeyVersion)>, KeyError>

Derive one lookup-key candidate per held key (active first, then previous). Managers pass the full slice to store finders so that records written under any held key are reachable during the rotation grace period (RFC-A).

Errors

Propagates KeyError::MissingActiveKey if no keys are configured.

pub fn lookup_key_with_version( &self, domain: SecretDomain, value: &str, version: &KeyVersion, ) -> Result<LookupKey, KeyError>

Derive a lookup key for value in domain using a specific key version. Used during validation to re-derive candidates for records written under older keys.

Errors

Propagates KeyError::MissingKeyVersion if the version is unknown.

Trait Implementations

impl<K: Clone> Clone for SecretHasher<K>

fn clone(&self) -> SecretHasher<K>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<K: Debug> Debug for SecretHasher<K>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.