Struct Sealer 

pub struct Sealer { /* private fields */ }

Seals what the storage layer writes — every log line, and every file that is not a log — with AES-256-GCM under a key the host hands over at open(), and opens it again on the way in.

Nothing here knows what it seals. The scope of each call ("log:users", "catalog", "image:docs"…) goes into the additional authenticated data, so a sealed unit moved to another table or another kind of file fails authentication instead of being read.

Implementations

impl Sealer

pub fn new(options: &CipherOptions) -> Result<Self, HaysonCipherError>

pub fn write_key_id(&self) -> &str

pub fn knows(&self, key_id: &str) -> bool

pub fn seal_line(&self, scope: &str, plain: &str) -> String

One log line as $hayson-seal$v1$<keyId>$<iv>$<ciphertext+tag> — text without a newline, so a sealed log keeps the line framing the engine’s offsets and tail detection rest on.

pub fn open_line( &self, scope: &str, sealed: &str, ) -> Result<String, HaysonCipherError>

pub fn seal_blob(&self, scope: &str, plain: &[u8]) -> Vec<u8>

A whole file: HSEAL\x01, the key id (length-prefixed), the IV and the ciphertext with its tag.

pub fn open_blob( &self, scope: &str, bytes: &[u8], ) -> Result<Vec<u8>, HaysonCipherError>

impl Sealer

pub fn image_name_key(&self) -> [u8; 32]

The key image names are made under, derived from the write key so that the name key and the encryption key are never the same bytes.

pub fn plain_len_of_blob(&self, sealed_len: u64, header: &[u8]) -> u64

The bytes an unsealed blob would hold for a sealed one of sealed_len whose header is header (at least the first 7 bytes) — what an image’s size is reported as.

Trait Implementations

impl Clone for Sealer

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Sealer

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.