arche 2.5.0

An opinionated backend foundation for Axum applications, providing batteries-included integrations for cloud services, databases, authentication, middleware, and logging.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

use aws_config::{BehaviorVersion, Region};
use aws_sdk_kms::{Client, primitives::Blob};
use base64::{Engine, engine::general_purpose::STANDARD};

use crate::config::resolve_with_default;
use crate::error::AppError;

pub use crate::config::aws::{AwsConfig, AwsConfigBuilder};

const DEFAULT_REGION: &str = "ap-south-1";

pub async fn get_kms_client(config: impl Into<Option<AwsConfig>>) -> Client {
    let config = config.into().unwrap_or_default();
    let region_str = resolve_with_default(config.region, "AWS_REGION", DEFAULT_REGION.to_string());
    let region = Region::new(region_str);

    let aws_config = aws_config::defaults(BehaviorVersion::latest())
        .region(region)
        .load()
        .await;
    Client::new(&aws_config)
}

pub struct KMSClient {
    client: Client,
}

impl KMSClient {
    pub fn new(client: Client) -> Self {
        KMSClient { client }
    }

    #[allow(dead_code)]
    pub async fn new_with_region(region_name: &str) -> Self {
        let region = Region::new(region_name.to_string());
        let config = aws_config::defaults(BehaviorVersion::latest())
            .region(region)
            .load()
            .await;
        let client = Client::new(&config);

        KMSClient { client }
    }

    pub async fn encrypt(&self, key_id: &str, plaintext: &[u8]) -> Result<Vec<u8>, AppError> {
        let response = self
            .client
            .encrypt()
            .key_id(key_id)
            .plaintext(Blob::new(plaintext))
            .send()
            .await
            .map_err(|e| AppError::internal_error(format!("KMS encrypt failed: {:?}", e), None))?;

        let ciphertext = response
            .ciphertext_blob()
            .ok_or_else(|| {
                AppError::internal_error("KMS encrypt returned no ciphertext".to_string(), None)
            })?
            .as_ref()
            .to_vec();

        Ok(ciphertext)
    }

    pub async fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>, AppError> {
        let response = self
            .client
            .decrypt()
            .ciphertext_blob(Blob::new(ciphertext))
            .send()
            .await
            .map_err(|e| AppError::internal_error(format!("KMS decrypt failed: {:?}", e), None))?;

        let plaintext = response
            .plaintext()
            .ok_or_else(|| {
                AppError::internal_error("KMS decrypt returned no plaintext".to_string(), None)
            })?
            .as_ref()
            .to_vec();

        Ok(plaintext)
    }

    pub async fn decrypt_base64(&self, ciphertext: &str) -> Result<Vec<u8>, AppError> {
        let decoded = STANDARD.decode(ciphertext).map_err(|e| {
            AppError::internal_error(format!("Base64 decode failed: {:?}", e), None)
        })?;
        self.decrypt(&decoded).await
    }
}