Struct Vault 

pub struct Vault { /* private fields */ }

An encrypted in-memory vault for storing named secrets.

Secrets are encrypted with XChaCha20-Poly1305, keys are derived from a password via Argon2i, and all key material is zeroized on drop.

Examples

use memseal::Vault;

let mut vault = Vault::create(b"password1234").unwrap();
vault.store("db_url", b"postgres://localhost/mydb").unwrap();

vault.save(&path).unwrap();

let loaded = Vault::load(&path, b"password1234").unwrap();
assert_eq!(
    loaded.retrieve("db_url").unwrap(),
    Some(b"postgres://localhost/mydb".to_vec())
);

Implementations

impl Vault

pub fn create(password: &[u8]) -> Result<Self, VaultError>

Creates a new empty vault protected by the given password.

Password must be at least 8 bytes.

pub fn open(password: &[u8], data: &[u8]) -> Result<Self, VaultError>

Opens an existing vault from exported bytes.

Returns VaultError::InvalidPassword if the password is wrong.

pub fn load(path: &Path, password: &[u8]) -> Result<Self, VaultError>

Loads a vault from a file on disk.

Reads at most 256 MiB to prevent resource exhaustion.

pub fn store(&mut self, name: &str, plaintext: &[u8]) -> Result<(), VaultError>

Stores a named secret in the vault, encrypting it immediately.

Name must be at most 255 bytes. Data must be at most 64 MiB. If a secret with the same name already exists, it is overwritten.

pub fn retrieve(&self, name: &str) -> Result<Option<Vec<u8>>, VaultError>

Retrieves a secret by name, decrypting it.

Returns Ok(None) if no secret with that name exists.

pub fn remove(&mut self, name: &str) -> Result<bool, VaultError>

Removes a secret by name. Returns true if it existed.

pub fn export(&mut self) -> Result<Vec<u8>, VaultError>

Serializes the vault to bytes for persistence.

Each call generates a fresh random index nonce and advances the authenticated nonce counter.

Returns VaultError::SerializationError if the serialized vault exceeds the 256 MiB file-size bound enforced by Vault::load; this guarantees that anything export() produces can be loaded back. Encrypted entry bytes are stored in the index JSON as number arrays (roughly 3.6 output bytes per stored byte), so the practical bound on total stored plaintext is about 70 MiB. The vault itself is left intact by this error; remove entries and export again.

pub fn save(&mut self, path: &Path) -> Result<(), VaultError>

Saves the vault to a file on disk.

Uses atomic write (temp file + rename) with 0600 permissions on Unix.

pub fn change_password( &mut self, current_password: &[u8], new_password: &[u8], ) -> Result<(), VaultError>

Changes the vault’s password.

Re-derives all keys from the new password and re-encrypts every entry one at a time (at most one plaintext in memory at any given time).