Struct TokenKey 

pub struct TokenKey(/* private fields */);

Wraps an AES-256-GCM cipher for sealing/unsealing session tokens.

Implementations

impl TokenKey

pub fn from_base64(encoded: &str) -> Result<Self, ProxyError>

Create a TokenKey from a base64-encoded 32-byte key.

pub fn seal(&self, creds: &TemporaryCredentials) -> Result<String, ProxyError>

Encrypt TemporaryCredentials into a base64url token.

Format: base64url(nonce[12] || ciphertext+tag)

pub fn unseal( &self, token: &str, ) -> Result<Option<TemporaryCredentials>, ProxyError>

Decrypt a session token back into TemporaryCredentials.

Returns Ok(None) if the token doesn’t look like a sealed token (e.g. base64 decode fails or decryption fails — allows fallback to config-based lookup). Returns Err(ExpiredCredentials) when the token decrypts successfully but the credentials have expired.

Trait Implementations

impl Clone for TokenKey

fn clone(&self) -> TokenKey

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl TemporaryCredentialResolver for TokenKey

fn resolve( &self, token: &str, ) -> Result<Option<TemporaryCredentials>, ProxyError>