key-vault 1.0.0

Enterprise-grade key management vault for Rust. 9-layer defense-in-depth: fragmentation, decoy bytes, codex transform, mlock + zeroize, constant-time ops, security monitoring. Pluggable key fetchers (TPM, keychain, file, env). Sub-microsecond access. REPS-compliant.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

//! [`NoMonitor`] — the inert default.

use super::{AccessContext, FailureContext, SecurityMonitor, ThresholdContext};

/// `SecurityMonitor` implementation that discards every event.
///
/// Use this when you want to construct a vault without configuring any
/// observability surface — anomaly events go nowhere, but the vault's
/// own threshold detection (see
/// [`KeyVaultBuilder::with_failure_threshold`](crate::KeyVaultBuilder::with_failure_threshold))
/// still works and can still lock the vault out.
///
/// `NoMonitor` is the default when no monitor is configured. Calling
/// [`with_monitor(NoMonitor)`](crate::KeyVaultBuilder::with_monitor)
/// explicitly is equivalent to leaving the slot empty; the difference is
/// stylistic.
///
/// # Examples
///
/// ```
/// use key_vault::{KeyVaultBuilder, NoMonitor};
///
/// let _vault = KeyVaultBuilder::new()
///     .with_monitor(NoMonitor)
///     .build();
/// ```
#[derive(Debug, Default, Clone, Copy)]
pub struct NoMonitor;

impl SecurityMonitor for NoMonitor {
    #[inline]
    fn on_decryption_failure(&self, _ctx: &FailureContext) {}

    #[inline]
    fn on_anomalous_access(&self, _ctx: &AccessContext) {}

    #[inline]
    fn on_threshold_breach(&self, _ctx: &ThresholdContext) {}
}