Struct LocalKeyCustody 

pub struct LocalKeyCustody { /* private fields */ }

Local-tier KeyCustody: real AES-256-GCM under a single process-held KEK.

The KEK is baked into an Aes256Gcm key schedule at construction and the raw bytes are not retained. std::fmt::Debug is hand-written to redact it regardless.

Implementations

impl LocalKeyCustody

pub fn new(kek: [u8; 32]) -> Self

Build a custody instance from a raw 32-byte KEK.

Infallible: a [u8; KEK_LEN] is always a valid AES-256 key. The key schedule is derived once here, so per-message encrypt/decrypt calls do not re-expand it.

pub fn from_env() -> Result<Self, KeyCustodyError>

Load the KEK from the environment. Precedence: FIRSTPASS_KEK (hex), then FIRSTPASS_KEK_FILE (32 raw bytes).

Errors

• KeyCustodyError::MissingKek if neither is set.
• KeyCustodyError::BadKek if the value is malformed, the wrong length, or the file is unreadable.

pub fn from_lookup( lookup: impl Fn(&str) -> Option<String>, ) -> Result<Self, KeyCustodyError>

from_env with an injectable variable lookup — the testable seam (mirrors crate::config::ProxyConfig::from_lookup), so KEK-loading tests need no process-global env mutation.

Errors

Same as from_env.

Trait Implementations

impl Debug for LocalKeyCustody

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl KeyCustody for LocalKeyCustody

fn encrypt( &self, tenant: &str, plaintext: &[u8], ) -> Result<Vec<u8>, KeyCustodyError>

Seal plaintext for tenant, returning an opaque nonce ‖ ciphertext ‖ tag blob that is safe to store at rest.

fn decrypt(&self, tenant: &str, blob: &[u8]) -> Result<Vec<u8>, KeyCustodyError>

Open a blob previously produced by encrypt for the same tenant.