Struct CekCache 

pub struct CekCache { /* private fields */ }

Thread-safe cache for decrypted Column Encryption Keys.

The cache stores decrypted CEKs and pre-computed AEAD encryptors to avoid repeated RSA decryption and key derivation operations.

Cache Key

Entries are keyed by: (database_id, cek_id, cek_version)

Expiration

Entries expire after a configurable TTL (default: 2 hours). Expired entries are lazily removed on access.

Implementations

impl CekCache

pub fn new() -> Self

Create a new CEK cache with default TTL (2 hours).

pub fn with_ttl(ttl: Duration) -> Self

Create a new CEK cache with custom TTL.

pub fn get(&self, key: &CekCacheKey) -> Option<Arc<AeadEncryptor>>

Get a cached encryptor for a CEK.

Returns None if the entry doesn’t exist or has expired.

pub fn insert( &self, key: CekCacheKey, cek: Vec<u8>, ) -> Result<Arc<AeadEncryptor>, EncryptionError>

Insert a CEK into the cache.

Creates an AEAD encryptor from the CEK for future use.

Arguments

• key - The cache key
• cek - The decrypted Column Encryption Key

Returns

The AEAD encryptor for the CEK.

pub async fn get_or_insert<F, Fut>( &self, key: CekCacheKey, get_cek: F, ) -> Result<Arc<AeadEncryptor>, EncryptionError>

where F: FnOnce() -> Fut, Fut: Future<Output = Result<Vec<u8>, EncryptionError>>,

Get or insert a CEK.

If the CEK is cached, returns the cached encryptor. Otherwise, calls the provided function to get the CEK and caches it.

Arguments

• key - The cache key
• get_cek - Function to get the CEK if not cached

pub fn remove(&self, key: &CekCacheKey) -> bool

Remove a CEK from the cache.

Call this when a CEK is rotated or invalidated.

pub fn cleanup_expired(&self)

Clear all expired entries from the cache.

pub fn clear(&self)

Clear all entries from the cache.

pub fn len(&self) -> usize

Get the number of entries in the cache.

pub fn is_empty(&self) -> bool

Check if the cache is empty.

Trait Implementations

impl Default for CekCache

fn default() -> Self

Returns the “default value” for a type.