Struct SecureCache 

pub struct SecureCache<'a> { /* private fields */ }

Encrypted cache handle returned by CacheKit::secure_cache().

All values are serialized, then encrypted with AES-256-GCM before storage. L1 stores ciphertext to maintain zero-knowledge guarantees. The client’s own value methods route through these same methods once encryption is configured, so the handle and the client read each other’s entries.

The handle borrows its CacheKit (SecureCache<'a> holds &'a CacheKit), so it cannot be stored in the same struct as the client it came from. Store the CacheKit and call CacheKit::secure_cache() where you need the handle: it only checks that encryption is configured and copies two references, so calling it per operation is cheap.

Implementations

impl SecureCache<'_>

pub fn previous_key_hits(&self) -> Vec<u64>

Rotation drain signal; see EncryptionLayer::previous_key_hits.

pub fn hardware_acceleration_enabled(&self) -> bool

Whether AES is hardware-accelerated on this host (informational); see EncryptionLayer::hardware_acceleration_enabled.

pub async fn set<T: Serialize>( &self, key: &str, value: &T, ) -> Result<(), CachekitError>

Encrypt and store value under key using the client’s default TTL.

pub async fn set_with_ttl<T: Serialize>( &self, key: &str, value: &T, ttl: Duration, ) -> Result<(), CachekitError>

Encrypt and store value under key with an explicit ttl.

A positive sub-second ttl is sent to the backend as 1 second.

Returns CachekitError::Config if ttl is zero.

The client namespace is not checked here: an interop key written on a namespaced client lands under {namespace}:{interop_key}, which no interop reader addresses — see CacheKit::interop_get.

pub async fn get<T: DeserializeOwned>( &self, key: &str, ) -> Result<Option<T>, CachekitError>

Retrieve, decrypt, and deserialize a value stored under key.

Checks L1 (which holds ciphertext) before the backend.

Errors

Returns CachekitError::Encryption if the stored entry fails decryption. The key’s L1 copy is dropped first and the backend entry is left in place, so the next read reaches the backend: a hit once the entry is replaced with ciphertext this client can decrypt, a miss once it expires or is deleted. A decrypted entry that does not decode as T is CachekitError::Serialization naming only T: the decoder’s own message would quote the plaintext.

pub async fn interop_get<T: DeserializeOwned>( &self, key: &str, ) -> Result<Option<T>, CachekitError>

Retrieve, decrypt, and deserialize an interop-mode value stored under key.

Identical to Self::get except the decrypted plaintext is decoded with crate::interop::deserialize — exactly one MessagePack document, trailing bytes rejected (interop/v1 spec MUST), as in Self::get. In interop mode the AES-GCM plaintext is the plain MessagePack value bytes, so the AAD (v0x03, format="msgpack", compressed="False") verifies cross-SDK unchanged.

Errors

Returns CachekitError::Config on a namespace-prefixed client — see CacheKit::interop_get — and CachekitError::Encryption if the stored entry fails decryption, with the key’s L1 copy dropped as for Self::get.

pub async fn interop_get_swr<T: DeserializeOwned>( &self, key: &str, ) -> Result<SwrRead<T>, CachekitError>

Retrieve, decrypt, and deserialize an interop-mode value with SWR classification. The secure twin of CacheKit::interop_get_swr: staleness is judged on the L1 ciphertext entry (zero-knowledge is preserved — freshness metadata never exposes plaintext), then the value is decrypted and decoded per Self::interop_get.

Errors

Same as Self::interop_get — the secure path fails closed on every backend and decryption error.

pub async fn delete(&self, key: &str) -> Result<bool, CachekitError>

Delete an encrypted key. Behaves identically to CacheKit::delete.

pub async fn exists(&self, key: &str) -> Result<bool, CachekitError>

Check if an encrypted key exists. Behaves identically to CacheKit::exists.

Trait Implementations

impl Debug for SecureCache<'_>

Available on crate feature encryption only.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.