Struct EncryptedWal 

pub struct EncryptedWal { /* private fields */ }

Encrypted Write-Ahead Log.

Encrypts each WAL record before writing it to disk. During replay, records are decrypted and deserialized.

Security Properties

• Each record is independently encrypted with a fresh nonce
• AAD prevents record type confusion
• Records cannot be read without the encryption key

Examples

use dbx_core::wal::encrypted_wal::EncryptedWal;
use dbx_core::wal::WalRecord;
use dbx_core::storage::encryption::EncryptionConfig;
use std::path::Path;

let enc = EncryptionConfig::from_password("secret");
let wal = EncryptedWal::open(Path::new("./wal.log"), enc).unwrap();

let record = WalRecord::Insert {
    table: "users".to_string(),
    key: b"user:1".to_vec(),
    value: b"Alice".to_vec(),
    ts: 0,
};
wal.append(&record).unwrap();
wal.sync().unwrap();

Implementations

impl EncryptedWal

pub fn open(path: &Path, encryption: EncryptionConfig) -> DbxResult<Self>

Open or create an encrypted WAL file.

pub fn append(&self, record: &WalRecord) -> DbxResult<u64>

Append an encrypted record to the WAL.

The record is serialized to JSON, encrypted, base64-encoded, and written as a single line.

pub fn sync(&self) -> DbxResult<()>

Synchronize WAL to disk (fsync).

pub fn replay(&self) -> DbxResult<Vec<WalRecord>>

Replay all encrypted records from the WAL.

pub fn current_sequence(&self) -> u64

Returns the current sequence number.

pub fn encryption_config(&self) -> &EncryptionConfig

Get a reference to the encryption config.

pub fn rekey(&mut self, new_encryption: EncryptionConfig) -> DbxResult<usize>

Re-key the WAL with a new encryption configuration.

Reads all existing records, decrypts with the current key, then re-writes them encrypted with the new key. The old WAL file is atomically replaced.

Warning

Callers should ensure no concurrent writes during rekey.