Struct TransitEngine 

pub struct TransitEngine { /* private fields */ }

The Transit Engine provides encryption-as-a-service.

Applications can encrypt and decrypt data without ever seeing the keys.

Implementations

impl TransitEngine

pub async fn new( data_path: impl AsRef<Path>, master_key: MasterKey, ) -> Result<Self, TransitError>

Creates a new TransitEngine with the given storage path and master key.

pub async fn create_key( &self, name: &str, config: KeyConfig, ) -> Result<TransitKey, TransitError>

Creates a new transit key.

pub async fn get_key(&self, name: &str) -> Result<TransitKey, TransitError>

Gets metadata for a transit key.

pub async fn list_keys(&self) -> Result<Vec<String>, TransitError>

Lists all transit key names.

pub async fn list_versions( &self, name: &str, ) -> Result<Vec<KeyVersionInfo>, TransitError>

Lists all versions of a key.

pub async fn rotate_key(&self, name: &str) -> Result<u32, TransitError>

Rotates a key to a new version.

pub async fn delete_key(&self, name: &str) -> Result<(), TransitError>

Deletes a transit key (if deletion is allowed).

pub async fn update_key_config( &self, name: &str, min_encryption_version: Option<u32>, min_decryption_version: Option<u32>, deletion_allowed: Option<bool>, ) -> Result<(), TransitError>

Updates key configuration (min versions, etc.).

pub async fn encrypt( &self, name: &str, plaintext: &[u8], ) -> Result<String, TransitError>

Encrypts plaintext using the latest version of a key.

Returns ciphertext in format: egide:v{version}:{base64}

pub async fn encrypt_with_version( &self, name: &str, plaintext: &[u8], version: u32, ) -> Result<String, TransitError>

Encrypts plaintext using a specific key version.

pub async fn decrypt( &self, name: &str, ciphertext: &str, ) -> Result<Vec<u8>, TransitError>

Decrypts ciphertext.

Automatically determines the key version from the ciphertext format.

pub async fn rewrap( &self, name: &str, ciphertext: &str, ) -> Result<String, TransitError>

Rewraps ciphertext with the latest key version.

This decrypts and re-encrypts without exposing plaintext to the caller.

pub async fn generate_datakey( &self, name: &str, ) -> Result<DataKey, TransitError>

Generates a new data encryption key (DEK).

Returns both the plaintext key (for immediate use) and the wrapped key (for storage). The plaintext key should be used and then discarded.

pub async fn decrypt_datakey( &self, name: &str, wrapped: &str, ) -> Result<Vec<u8>, TransitError>

Decrypts a wrapped data key.