Struct DatabaseFieldAdapter 

pub struct DatabaseFieldAdapter { /* private fields */ }

Basic implementation of EncryptedFieldAdapter

Uses SecretsManager to fetch encryption keys from Vault and caches ciphers for performance.

Implementations

impl DatabaseFieldAdapter

pub fn new( secrets_manager: Arc<SecretsManager>, field_keys: HashMap<String, String>, ) -> Self

Create new database field adapter

Arguments

• secrets_manager - SecretsManager for fetching encryption keys from Vault
• field_keys - Mapping of database field names to Vault key names

Example

let mut field_keys = HashMap::new();
field_keys.insert("email".to_string(), "db/email_key".to_string());
field_keys.insert("phone".to_string(), "db/phone_key".to_string());

let adapter = DatabaseFieldAdapter::new(secrets_manager, field_keys);

pub fn register_field( &mut self, field_name: impl Into<String>, key_name: impl Into<String>, )

Register new encrypted field with its encryption key

Arguments

• field_name - Database field name to be encrypted
• key_name - Vault secret name for the encryption key

pub async fn invalidate_cache(&self)

Invalidate cipher cache, forcing fresh key retrieval from SecretsManager

Useful after key rotation in Vault. Next encryption/decryption will fetch the new key and create a new cipher.

pub async fn invalidate_field_cache(&self, field_name: &str)

Invalidate cache for specific field

Arguments

• field_name - Field to invalidate cache for

pub async fn cache_size(&self) -> usize

Get current cache size

Returns number of cached ciphers (one per encrypted field being used).

Trait Implementations

impl EncryptedFieldAdapter for DatabaseFieldAdapter

fn get_encrypted_fields(&self) -> Vec<String>

Get list of encrypted field names

async fn encrypt_value( &self, field_name: &str, plaintext: &str, ) -> Result<Vec<u8>, SecretsError>

Encrypt a plaintext value for the given field

async fn decrypt_value( &self, field_name: &str, ciphertext: &[u8], ) -> Result<String, SecretsError>

Decrypt an encrypted value for the given field

async fn encrypt_with_context( &self, field_name: &str, plaintext: &str, context: &str, ) -> Result<Vec<u8>, SecretsError>

Encrypt with additional context for audit trail

async fn decrypt_with_context( &self, field_name: &str, ciphertext: &[u8], context: &str, ) -> Result<String, SecretsError>

Decrypt with context verification

fn is_encrypted(&self, field_name: &str) -> bool

Check if a field is encrypted