Struct Store 

pub struct Store { /* private fields */ }

An encrypted store bound to a config and its recipient list.

Implementations

impl Store

pub fn open(config: Config) -> Result<Self>

Opens an existing store and loads its recipients. Does not unlock the identity, so the returned store can write but not yet read secrets.

Errors

• Error::StoreNotFound if the store directory does not exist.
• Error::NoRecipients if .age-recipients is missing or empty.
• Error::Io / Error::InvalidRecipient on parse failures.

pub fn create( config: Config, owner: &Identity, extra: &[Recipient], ) -> Result<Self>

Creates a brand-new store, writing .age-recipients with the owner’s public key plus any extra recipients.

Errors

• Error::StoreExists if .age-recipients already exists.
• Error::Io on filesystem failures.

pub fn root(&self) -> &Path

Returns the absolute store directory.

pub fn recipients(&self) -> &[Recipient]

Returns the configured recipient list.

pub fn exists(&self, logical: &str) -> bool

Returns true if a secret exists at logical.

pub fn set(&self, logical: &str, secret: &Secret) -> Result<()>

Encrypts and writes (or overwrites) secret at logical.

Errors

Error::InvalidPath for malformed paths; Error::Io / Error::Encrypt on failure.

pub fn insert(&self, logical: &str, secret: &Secret) -> Result<()>

Inserts a new secret, failing with Error::SecretExists if present.

Errors

See set plus Error::SecretExists.

pub fn get(&self, logical: &str, identity: &Identity) -> Result<Secret>

Reads and decrypts the secret at logical.

Errors

Error::InvalidPath, Error::SecretNotFound, or Error::Decrypt / Error::Io on failure.

pub fn delete(&self, logical: &str) -> Result<()>

Deletes the secret at logical, pruning now-empty parent directories.

Errors

Error::SecretNotFound if the file is absent; Error::Io otherwise.

pub fn rename(&self, from: &str, to: &str, identity: &Identity) -> Result<()>

Renames a secret: decrypts it, re-binds the envelope to to, re-encrypts, writes the destination, then removes the source. Needs the identity because the path binding lives inside the ciphertext.

Errors

Error::SecretNotFound if from is absent, Error::SecretExists if to exists, Error::InvalidPath for malformed paths, or Error::Decrypt / Error::Tampered reading the source.

pub fn copy(&self, from: &str, to: &str, identity: &Identity) -> Result<()>

Copies a secret: decrypts it, re-binds the envelope to to, re-encrypts, and writes the destination. Needs the identity for the same reason as rename.

Errors

Same as rename, minus pruning.

pub fn list(&self, prefix: &str) -> Result<Vec<String>>

Lists logical paths under prefix ("" for all), sorted.

Errors

Error::Io on directory traversal failures.

pub fn grep( &self, query: &str, identity: Option<&Identity>, ) -> Result<Vec<String>>

Searches paths (always) and decrypted contents (when identity is Some) case-insensitively for query.

Errors

Error::Io / Error::Decrypt on failure when scanning contents.

pub fn set_recipients( &mut self, new_recipients: Vec<Recipient>, identity: &Identity, ) -> Result<usize>

Replaces the recipient list and re-encrypts every secret to it.

new_recipients must include identity’s public key, otherwise the user would lock themselves out.

Rotation is crash-consistent. Phase 1 re-encrypts every secret into a .ks-rotate staging tree, records the target recipients, and finally drops a READY marker — the commit point. Phase 2 moves the staged files over the live ones and flips the recipients file. A crash before READY rolls back (the live store was never touched); a crash after it rolls forward, because phase 2 is idempotent. Recovery runs automatically on the next open and can be invoked via recover_rotation.

Errors

Error::InvalidRecipient if the user’s own key is missing, or Error::Io / Error::Decrypt during re-encryption.

pub fn recover_rotation(&self) -> Result<RotationRecovery>

Detects and resolves a recipient rotation that a crash interrupted, taking the store write lock. A no-op when no staging area is present, so it is cheap to call on every open.

A rotation that crashed before its READY commit point is rolled back (the live store was never modified); one that crashed after it is rolled forward to completion. Both directions are idempotent.

Errors

Error::Io on lock or filesystem failure, or Error::NoRecipients / Error::InvalidRecipient if a staged recipient list cannot be parsed while rolling forward.

Trait Implementations

impl Debug for Store

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.