Struct SealedVault 

pub struct SealedVault {
    pub scheme_version: u32,
    pub params: KdfParams,
    /* private fields */
}

The sealed-at-rest vault. Serialized (hex-encoded byte fields) to a root-owned 0600 file on headless hosts, or wrapped by an OS keychain on desktops.

Fields

scheme_version: u32

params: KdfParams

Implementations

impl SealedVault

pub fn verify_password(&self, password: &str) -> bool

Whether password matches (constant-time). Does not unseal.

pub fn auth_challenge(&self) -> (String, KdfParams)

The inputs a client needs to compute an auth proof: the verifier salt and the KDF params. Handed out by the daemon in a challenge — neither is secret.

pub fn verify_proof(&self, nonce: &[u8], op: &[u8], proof: &[u8]) -> bool

Verify a challenge-response proof for operation op under nonce. The proof is an AEAD tag over an empty message, keyed by the password verifier, with nonce (the daemon’s fresh 24-byte challenge) and op as AAD — so the password never crosses the wire and a captured proof can’t be replayed for a different nonce/op. Compared constant-time.

pub fn unseal(&self, password: &str) -> Result<LockedSettings, AdminError>

Decrypt the locked settings with the admin password.

pub fn unseal_with_recovery( &self, recovery_key: &str, ) -> Result<LockedSettings, AdminError>

Decrypt the locked settings with the recovery key (no password needed).

pub fn update_settings( &self, password: &str, new_settings: &LockedSettings, ) -> Result<SealedVault, AdminError>

Re-seal new settings, authenticated by the current password. Re-encrypts the settings slot (fresh nonce) while preserving the verifier and recovery slot — i.e. the same password + recovery key still work.

pub fn change_password( &self, old: &str, new: &str, ) -> Result<Provisioned, AdminError>

Change the admin password. Re-derives the verifier and re-seals the settings + recovery slot under the new password. The recovery key is rotated (a fresh one is returned).

Trait Implementations

impl Clone for SealedVault

fn clone(&self) -> SealedVault

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SealedVault

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SealedVault

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for SealedVault

impl PartialEq for SealedVault

fn eq(&self, other: &SealedVault) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for SealedVault

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SealedVault