Struct StateEncryptionService 

pub struct StateEncryptionService { /* private fields */ }

AEAD encryption service for OAuth state and PKCE blobs.

Wire format: URL-safe base64 of [12-byte nonce || ciphertext || 16-byte tag].

The 32-byte key is never printed in fmt::Debug output.

Implementations

impl StateEncryptionService

pub const fn from_raw_key( key: &[u8; 32], algorithm: EncryptionAlgorithm, ) -> Self

Construct from a raw 32-byte key slice.

pub fn from_hex_key( hex: &str, algorithm: EncryptionAlgorithm, ) -> Result<Self, KeyError>

Construct from a 64-character hex string (= 32 bytes).

Errors

Returns KeyError::WrongLength if hex is not 64 chars. Returns KeyError::InvalidHex if hex contains non-hex chars.

pub fn new_from_env( var: &str, algorithm: EncryptionAlgorithm, ) -> Result<Self, Error>

Load the key from an environment variable containing a 64-char hex string.

Errors

Returns an error if the env var is absent or the value is not valid hex/length.

pub fn from_compiled_schema( security_json: &Value, ) -> Result<Option<Arc<Self>>, Error>

Build from the security blob of a compiled schema, if enabled.

Returns Ok(None) when the state_encryption key is absent or enabled = false.

Errors

Returns Err when enabled = true but the key environment variable is absent or contains an invalid value. The server must refuse to start in this case.

pub fn encrypt(&self, plaintext: &[u8]) -> Result<String, Error>

Encrypt plaintext to a URL-safe base64 string.

A fresh random nonce is generated on every call.

Errors

Returns an error only on internal cipher failure (essentially never).

pub fn decrypt(&self, encoded: &str) -> Result<Vec<u8>, DecryptionError>

Decrypt a URL-safe base64 string produced by Self::encrypt.

Errors

• DecryptionError::InvalidInput — empty / too-short / bad base64
• DecryptionError::AuthenticationFailed — tampered or wrong-key

Trait Implementations

impl Debug for StateEncryptionService

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.