Struct DbKeyStore 

pub struct DbKeyStore { /* private fields */ }

Implementations

impl DbKeyStore

pub fn new(config: DbKeyStoreConfig) -> Result<Arc<DbKeyStore>>

pub fn new_with_modifiers( modifiers: &HashMap<&str, &str>, ) -> Result<Arc<DbKeyStore>>

pub fn is_encrypted(&self) -> bool

Returns true if the db file is encrypted

pub fn path(&self) -> String

Returns path to database file

pub fn rekey( source_path: impl AsRef<Path>, source_opts: Option<EncryptionOpts>, dest_path: impl AsRef<Path>, dest_opts: Option<EncryptionOpts>, ) -> Result<RekeyOutcome>

Rekey a keystore out-of-place: read every credential from the source database and write it into a freshly created destination database.

This is used to add, remove, or rotate the on-disk encryption key (a DEK rotation): pass dest_opts = Some(..) to add or rotate encryption, or dest_opts = None to write an unencrypted copy. source_opts must supply the cipher/key the source was written with (or None if the source is unencrypted).

The operation is non-destructive to the source: the source database is opened read-only-ish (no rows are mutated) and left fully intact, and the destination is fully written before returning. Callers that own a verify-then-swap-then-delete sequence (for example secret-vault rotate-dek) should treat the returned destination as the new candidate and only retire the source after independently verifying it.

Each credential is copied with its service, user, uuid, comment, and secret preserved. Whether the source enforced (service, user) uniqueness is detected from the source schema and mirrored on the destination so ambiguous keystores round-trip unchanged.

dest_path must not already exist. Returns a RekeyOutcome describing how many credentials were copied. No secret material is logged or included in any returned value.

Trait Implementations

impl Clone for DbKeyStore

fn clone(&self) -> DbKeyStore

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl CredentialStoreApi for DbKeyStore

fn build( &self, service: &str, user: &str, modifiers: Option<&HashMap<&str, &str>>, ) -> Result<Entry>

Create a credential entry for service and user. Service and user must be non-empty, and within the length limits. (<=1024 chars) Supported modifiers: uuid, comment.

fn vendor(&self) -> String

The name of the “vendor” that provides this store.

fn id(&self) -> String

The ID of this credential store instance.

fn search(&self, spec: &HashMap<&str, &str>) -> Result<Vec<Entry>>

Search for credentials that match the given spec.

fn as_any(&self) -> &dyn Any

Return the inner store object cast to Any.

fn persistence(&self) -> CredentialPersistence

The lifetime of credentials produced by this builder.

fn debug_fmt(&self, f: &mut Formatter<'_>) -> Result

The Debug trait call for the object.

impl Debug for DbKeyStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.