Struct SecretStore 

pub struct SecretStore { /* private fields */ }

One store: one database, one StoreId, one data key.

Implementations

impl SecretStore

pub async fn rotate_dek( &self, actor: &Actor, plan: bool, ) -> Result<RotationReport, SecretsError>

Rotates this store’s data key: a new key becomes active, every live secret version is re-encrypted under it, and the old key is retired once nothing references it.

Reads keep working throughout, because each secret row names the key that sealed it and the old key row stays until the end. A rotation interrupted half way leaves a store whose secrets are split across two keys, which is a valid state: running it again finishes the job.

Errors

SecretsError. The attempt is audited either way.

pub async fn rewrap( &self, actor: &Actor, plan: bool, ) -> Result<RewrapReport, SecretsError>

Re-wraps every data key under the master key’s current material, without touching a single secret. After a KMS rotates its key material in place, old wrapped keys still unwrap; this makes sure none of them depends on the old material any more.

Errors

SecretsError. The attempt is audited either way.

impl SecretStore

pub fn id(&self) -> &StoreId

pub async fn put( &self, name: &str, value: &SecretBytes, actor: &Actor, ) -> Result<Version, SecretsError>

Writes a new version of name and returns it. Versions are monotonic per name and start at 1; a value is never overwritten, because the previous version is what a rollback needs and what the audit log refers to.

Errors

SecretsError, and the attempt is audited either way.

pub async fn get( &self, name: &str, actor: &Actor, ) -> Result<Option<SecretBytes>, SecretsError>

The latest version of name that has not been deleted, or None.

Errors

SecretsError::NotAuthentic when the row does not match the context it was sealed with, and otherwise as SecretStore::put.

pub async fn list(&self, actor: &Actor) -> Result<Vec<SecretMeta>, SecretsError>

Every secret’s latest version: names and versions, never values.

Errors

As SecretStore::put.

pub async fn delete( &self, name: &str, actor: &Actor, ) -> Result<(), SecretsError>

Soft-deletes every version of name. The rows stay, so the audit trail and any restore keep something to refer to; the value is no longer readable through SecretStore::get.

Errors

As SecretStore::put.