Struct EncryptionContext 

pub struct EncryptionContext { /* private fields */ }

Runtime context for encryption operations.

This is the active encryption state for a connected client, including resolved CEKs and encryptors.

The context holds an Arc<EncryptionConfig> so providers remain accessible across connection retries/redirects where the Config (and its inner encryption config Arc) gets cloned multiple times.

Implementations

impl EncryptionContext

pub fn from_arc(config: Arc<EncryptionConfig>) -> Self

Create a new encryption context from an Arc-wrapped configuration.

The Arc is retained by the context so provider lookups continue to work for the lifetime of the client — regardless of how many times the outer Config has been cloned for retry/redirect handling.

pub fn new(config: EncryptionConfig) -> Self

Create a new encryption context from configuration.

pub async fn get_encryptor( &self, cek_entry: &CekTableEntry, ) -> Result<Arc<AeadEncryptor>, EncryptionError>

Get or decrypt a CEK for a column.

This handles the CEK caching and decryption logic:

1. Check cache for existing encryptor
2. If not cached, decrypt CEK using the appropriate key store
3. Create and cache the encryptor

pub async fn encrypt_value( &self, plaintext: &[u8], cek_entry: &CekTableEntry, encryption_type: EncryptionTypeWire, ) -> Result<Vec<u8>, EncryptionError>

Encrypt a value for a column.

Arguments

• plaintext - The plaintext value to encrypt
• cek_entry - The CEK table entry for this column
• encryption_type - Deterministic or randomized encryption

pub async fn decrypt_value( &self, ciphertext: &[u8], cek_entry: &CekTableEntry, ) -> Result<Vec<u8>, EncryptionError>

Decrypt a value from an encrypted column.

Arguments

• ciphertext - The encrypted value
• cek_entry - The CEK table entry for this column

pub fn clear_cache(&self)

Clear the CEK cache.

Call this when keys may have been rotated.

pub fn has_provider(&self, name: &str) -> bool

Check if a provider is registered.

Trait Implementations

impl Debug for EncryptionContext

Available on crate feature always-encrypted only.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.