Struct Aead 

pub struct Aead { /* private fields */ }

A bound encryptor/decryptor holding the derived key.

Implementations

impl Aead

pub fn new(raw_key: &str) -> Result<Self>

Build a codec from the raw configured key value (see derive_key).

pub fn is_ciphertext(value: &str) -> bool

True if value is one of our ciphertext tokens, in EITHER format (vs. legacy plaintext).

Recognising both matters: if this matched only v1, then Aead::maybe_decrypt would classify a bound token as legacy plaintext and hand the raw ciphertext back to the caller as though it were the value.

pub fn encrypt(&self, plaintext: &str) -> String

Encrypt into an unbound enc.v1.gcm.… token (AAD empty).

Panics if the OS CSPRNG is unavailable. This is a deliberate divergence from crate::new_session_id, which falls back to a weak entropy mix: a guessable session id is bad, but a REPEATED GCM nonce is catastrophic — it leaks the XOR of two plaintexts and enables tag forgery. There is no safe degraded mode here, so this fails loudly.

pub fn encrypt_bound(&self, plaintext: &str, aad: &[u8]) -> String

Encrypt into a bound enc.v2.gcm.… token.

aad names the row and column this ciphertext belongs to, so it authenticates nowhere else — moving it to another row makes it undecryptable rather than silently valid.

pub fn decrypt(&self, token: &str) -> Result<String>

Decrypt an UNBOUND enc.v1.gcm.… token. A bound token is rejected here: reading one through this path would drop the binding check silently.

pub fn decrypt_bound(&self, token: &str, aad: &[u8]) -> Result<String>

Decrypt a bound enc.v2.gcm.… token, requiring aad to match the binding it was sealed under.

An unbound v1 token is REJECTED rather than accepted-without-checking: otherwise the binding is opt-out and anything able to write the row would simply store the unbound form.

pub fn maybe_decrypt(&self, value: &str) -> Result<String>

Migrate-on-read: decrypt if the value is one of our tokens, otherwise treat it as legacy plaintext and return it unchanged. Callers re-encrypt on the next write, transparently upgrading old rows.