Struct EncryptedBlobStore 

pub struct EncryptedBlobStore<S> { /* private fields */ }

Blob-store decorator that exposes plaintext while storing deterministic authenticated ciphertext.

Blob identifiers are digests of the encrypted object. Listing, deletion, timestamps, and cleartext root records pass through to the wrapped store. The key set is an immutable snapshot; a manifest reload or rotation replaces the decorator rather than resolving a KMS key on each blob read.

Implementations

impl<S> EncryptedBlobStore<S>

pub fn new( inner: S, current_epoch: u32, keys: impl IntoIterator<Item = (u32, SecretKey)>, ) -> Result<Self, StoreError>

Creates a decorator with all readable epochs and the epoch used by new writes.

Errors

Returns StoreError::MissingEncryptionKey when current_epoch is not present in keys.

pub fn with_key(inner: S, epoch: u32, key: SecretKey) -> Self

Creates a single-epoch decorator.

pub fn inner(&self) -> &S

Returns the wrapped ciphertext store.

pub fn into_inner(self) -> S

Consumes the decorator and returns the wrapped store.

pub fn current_epoch(&self) -> u32

Returns the epoch used for new writes.

Trait Implementations

impl<S: BlobStore> BlobStore for EncryptedBlobStore<S>

fn put<'life0, 'life1, 'async_trait>( &'life0 self, bytes: &'life1 [u8], ) -> Pin<Box<dyn Future<Output = Result<BlobId, StoreError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Stores bytes and returns their content id.

fn get<'life0, 'life1, 'async_trait>( &'life0 self, id: &'life1 BlobId, ) -> Pin<Box<dyn Future<Output = Result<Option<Vec<u8>>, StoreError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Loads bytes by id, returning None when missing.

fn contains<'life0, 'life1, 'async_trait>( &'life0 self, id: &'life1 BlobId, ) -> Pin<Box<dyn Future<Output = Result<bool, StoreError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Reports whether a blob is present.

fn put_if_absent<'life0, 'life1, 'async_trait>( &'life0 self, bytes: &'life1 [u8], ) -> Pin<Box<dyn Future<Output = Result<BlobId, StoreError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Stores bytes only when their content id is absent, skipping the upload for blobs the store already holds.

fn delete<'life0, 'life1, 'async_trait>( &'life0 self, id: &'life1 BlobId, ) -> Pin<Box<dyn Future<Output = Result<(), StoreError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Deletes a blob during garbage collection. Missing blobs are ignored.

fn list<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = Result<BlobIdStream, StoreError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Lists all blob identifiers known to this backend.

fn modified_at<'life0, 'life1, 'async_trait>( &'life0 self, id: &'life1 BlobId, ) -> Pin<Box<dyn Future<Output = Result<Option<SystemTime>, StoreError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Returns the blob’s creation/last-modification time when available. Backends without timestamps return None, which conservatively keeps the blob whenever a non-zero retention window is active.

impl<S: Clone> Clone for EncryptedBlobStore<S>

fn clone(&self) -> EncryptedBlobStore<S>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<S: RootStore> RootStore for EncryptedBlobStore<S>

fn get_root<'life0, 'life1, 'async_trait>( &'life0 self, name: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<Option<Vec<u8>>, StoreError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Reads a root pointer.

fn cas_root<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, name: &'life1 str, expected: Option<&'life2 [u8]>, new: &'life3 [u8], ) -> Pin<Box<dyn Future<Output = Result<(), StoreError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Publishes a root only if the stored pointer equals expected.

fn delete_root<'life0, 'life1, 'async_trait>( &'life0 self, name: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<(), StoreError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Removes a root pointer. Missing roots are ignored.

fn list_roots<'life0, 'life1, 'async_trait>( &'life0 self, prefix: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<Vec<String>, StoreError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Lists root names beginning with prefix, in sorted order.