Enum Codec 

pub enum Codec {
    Aead(Box<Aead>),
    Null,
}

The codec actually installed: real AEAD, or a pass-through used only on a localhost dev stack where no key is configured. Production refuses to boot without a real key, so Codec::Null never runs there.

Variants

Aead(Box<Aead>)

Boxed: ring’s expanded AES key schedule makes Aead ~544 bytes, and an enum sized to its largest variant would be paid for by every Null too.

Null

Implementations

impl Codec

pub fn new(raw_key: Option<&str>) -> Result<Self>

Build the codec for a configured key, or the pass-through when none is set. Production validates that a key IS set before calling this.

pub fn encrypt(&self, plaintext: &str) -> String

pub fn encrypt_bound(&self, plaintext: &str, aad: &[u8]) -> String

Encrypt bound to aad — see Aead::encrypt_bound.

Codec::Null passes through, so a dev stack with no key configured gets no binding either. That is the same trade the unbound path already makes, and production is required to configure a key.

pub fn decrypt_bound(&self, token: &str, aad: &[u8]) -> Result<String>

Decrypt a bound record — see Aead::decrypt_bound.

pub fn maybe_decrypt(&self, value: &str) -> Result<String>