Struct EnvKeyProvider 

pub struct EnvKeyProvider { /* private fields */ }

Key provider that reads from environment variables.

Design Note

The environment variable is read on every call to current_key() rather than being cached at construction time. This is intentional: it allows key rotation by updating the env var (e.g. via a sidecar or init-container) without restarting the process. The overhead of std::env::var is negligible compared to the AES-GCM operations that follow.

Cached Fallback

If the environment variable is temporarily unset (e.g. during key rotation), the provider falls back to the last successfully loaded key for up to grace_period (default 5 s). After the grace period expires, the missing-variable error is propagated.

Hardening

• Grace period reduced from 30 s → 5 s (configurable).
• clear_cache lets operators explicitly discard the cached key once rotation is complete.
• Every cache-fallback hit emits the chronix_auth_env_key_grace_hit counter so operators can detect prolonged rotation windows.

Implementations

impl EnvKeyProvider

pub fn new(env_var: &str, key_id: &str) -> Self

Create a key provider from an environment variable name.

The environment variable should contain a hex-encoded 256-bit key. The default grace period is 5 seconds.

pub fn with_grace_period(self, duration: Duration) -> Self

Override the grace period for cached key fallback.

pub fn clear_cache(&self)

Explicitly discard the cached key, e.g. after rotation is complete.

Trait Implementations

impl Debug for EnvKeyProvider

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl KeyProvider for EnvKeyProvider

fn current_key(&self) -> Result<(SecretKey, String), AuthError>

Get the current (latest) encryption key and its ID.

fn key_by_id(&self, key_id: &str) -> Result<SecretKey, AuthError>

Get a key by its ID (for decrypting old data).

fn key_ids(&self) -> Vec<String>

List all available key IDs.