Struct TokenCipher 

pub struct TokenCipher { /* private fields */ }

AES-256-GCM cipher for PAS refresh_token at-rest encryption.

Cheap to Clone — the inner key schedule is wrapped in a shared Aes256Gcm instance. Build one at startup from the base64-encoded key env var and hand clones to every adapter that needs it.

Implementations

impl TokenCipher

pub fn from_base64_key(key_b64: &str) -> Result<Self, CipherError>

Build a cipher from a base64-encoded 32-byte key.

Whitespace is trimmed so env-var values with trailing newlines still parse cleanly.

pub fn encrypt(&self, plaintext: &str) -> Result<String, CipherError>

Encrypt a plaintext token. Returns base64(nonce || ciphertext+tag).

pub fn encrypt_to_token( &self, plaintext: &str, ) -> Result<EncryptedRefreshToken, CipherError>

Encrypt a plaintext token directly into the EncryptedRefreshToken newtype. Prefer this over Self::encrypt when interfacing with SDK middleware types.

Errors

Returns the underlying CipherError from Self::encrypt.

pub fn decrypt(&self, ciphertext_b64: &str) -> Result<String, CipherError>

Decrypt a ciphertext produced by Self::encrypt.

Any tampering (wrong key, truncated ciphertext, altered nonce, altered tag) fails AEAD authentication and returns CipherError::Decrypt. Callers should treat any error here as “session unrecoverable, force re-auth” rather than a transient condition.

Trait Implementations

impl Clone for TokenCipher

fn clone(&self) -> TokenCipher

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.