Struct SecretManager 

pub struct SecretManager { /* private fields */ }

Secret manager combining cached and per-request encryption.

Implementations

impl SecretManager

pub fn new(provider: Arc<dyn BaseKmsProvider>, default_key_id: String) -> Self

Create a new secret manager.

pub fn with_context_prefix(self, prefix: String) -> Self

Set a context prefix (e.g., “fraiseql-prod”).

This prefix is added to all encryption contexts for additional isolation between environments.

pub async fn initialize(&self) -> KmsResult<()>

Initialize by generating and caching a data key.

Call this at application startup. The data key is cached in memory for fast local encryption during the application’s lifetime.

Errors

Returns KmsError if data key generation fails

pub async fn is_initialized(&self) -> bool

Check if a data key is cached.

pub async fn rotate_cached_key(&self) -> KmsResult<()>

Rotate the cached data key.

Call this periodically to rotate keys. This regenerates the cached data key via KMS while maintaining application uptime.

Errors

Returns KmsError if rotation fails

pub async fn local_encrypt(&self, plaintext: &[u8]) -> KmsResult<Vec<u8>>

Encrypt data using the cached data key (NO KMS call).

This is fast (~microseconds) and safe for use in hot paths. Requires initialize() to be called first.

Errors

Returns KmsError::EncryptionFailed if not initialized or encryption fails

pub async fn local_decrypt(&self, encrypted: &[u8]) -> KmsResult<Vec<u8>>

Decrypt data using the cached data key (NO KMS call).

Errors

Returns KmsError::DecryptionFailed if not initialized or decryption fails

pub async fn encrypt( &self, plaintext: &[u8], key_id: Option<&str>, ) -> KmsResult<EncryptedData>

Encrypt data using KMS (per-request operation).

This contacts the KMS provider for each encryption, providing per-request key isolation but with higher latency (50-200ms). Use for secrets management, not response data.

Arguments

• plaintext - Data to encrypt
• key_id - KMS key identifier (or None for default)

Errors

Returns KmsError if encryption fails

pub async fn decrypt(&self, encrypted: &EncryptedData) -> KmsResult<Vec<u8>>

Decrypt data using KMS (per-request operation).

Auto-detects the correct provider from EncryptedData metadata.

Errors

Returns KmsError if decryption fails

pub async fn encrypt_string( &self, plaintext: &str, key_id: Option<&str>, ) -> KmsResult<EncryptedData>

Encrypt a string field (convenience method).

Handles UTF-8 encoding/decoding automatically.

pub async fn decrypt_string( &self, encrypted: &EncryptedData, ) -> KmsResult<String>

Decrypt a string field.