Struct LocalFileKms 

pub struct LocalFileKms { /* private fields */ }

A KEK read from a file. See the module docs for why it refuses production.

Implementations

impl LocalFileKms

pub fn open(path: impl AsRef<Path>, env: &str) -> Result<Self, KmsError>

Reads the master key from path.

env is the deployment environment, as cratefield_core::VentureEnv spells it: anything equal to "production" (case-insensitively) is refused. The environment is a parameter rather than read from the process here, so the refusal cannot be sidestepped by unsetting a variable, and so the caller passes the same value it validated everything else with.

The file holds 32 raw bytes, or their hex or base64 encoding on one line; a trailing newline is ignored, because the difference between printf and echo should not be a cryptographic event.

Errors

KmsError::Refused in production, KmsError::Unavailable when the file cannot be read, KmsError::Invalid when its contents are not a 32-byte key.

pub fn from_key( kek: Dek, key_ref: impl Into<String>, env: &str, ) -> Result<Self, KmsError>

A KEK the caller already holds, for tests that do not want a file. Refuses production for the same reason.

Errors

KmsError::Refused in production.

pub fn create(path: impl AsRef<Path>) -> Result<(), KmsError>

Writes a fresh master key to path for a development environment. Refuses to overwrite: losing a KEK means losing every secret wrapped under it, so the destructive version of this is a human deleting the file on purpose.

Errors

KmsError::Refused when the file exists, KmsError::Unavailable when it cannot be written.

Trait Implementations

impl Debug for LocalFileKms

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Names the key file, never its contents. Written by hand rather than derived so it cannot start printing key material because a field was added.

impl Kms for LocalFileKms

fn provider(&self) -> &'static str

Stored with every wrapped key: "local-file", "worker-secret", "aws-kms", "gcp-kms".

fn key_ref(&self) -> &str

The master key this instance wraps under, as the vendor names it. Stored with every wrapped key so a re-wrap knows what it is moving from.

fn wrap<'life0, 'life1, 'async_trait>( &'life0 self, dek: &'life1 Dek, ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, KmsError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Wraps a data key. The result is opaque to the caller and is what goes in the database (docs/SECRETS-DESIGN.md §3).

fn unwrap<'life0, 'life1, 'async_trait>( &'life0 self, wrapped: &'life1 [u8], ) -> Pin<Box<dyn Future<Output = Result<Dek, KmsError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Unwraps what Kms::wrap produced.