Struct Vault 

pub struct Vault<S = AgentClient> { /* private fields */ }

High-level lockbox helper that integrates open operations with a key cache.

Vault wraps a ContentKeyStore. Creating or opening a lockbox stores the resulting content key in that store. open_lockbox then reopens the lockbox from the cached key without requiring the original password or contact private key.

Implementations

impl<S> Vault<S>

pub fn new(store: S) -> Vault<S>

Creates a vault around a custom content-key store.

pub fn store(&self) -> &S

Returns the content-key store used by this vault.

impl<S> Vault<S>

where S: ContentKeyStore,

pub fn create_lockbox_with_password( &self, path: impl AsRef<Path>, password: &SecureString, ) -> Result<Lockbox, Error>

Creates a password-protected lockbox and caches its content key.

pub fn open_lockbox_with_password( &self, path: impl AsRef<Path>, password: &SecureString, ) -> Result<Lockbox, Error>

Opens a password-protected lockbox and caches its content key.

pub fn open_lockbox_with_password_for_duration( &self, path: impl AsRef<Path>, password: &SecureString, ttl_seconds: u64, ) -> Result<Lockbox, Error>

Opens a password-protected lockbox and caches its content key for the requested number of seconds.

pub fn cache_lockbox_password_for_duration( &self, path: impl AsRef<Path>, password: &SecureString, ttl_seconds: u64, ) -> Result<(), Error>

Refreshes a password-protected lockbox’s cached content key for a requested number of seconds without reopening the lockbox payload.

pub fn create_lockbox( &self, path: impl AsRef<Path>, protection: LockboxProtection<'_>, ) -> Result<Lockbox, Error>

Creates a lockbox with the supplied protection mode.

Content-key and password modes cache the opened content key after the file is created. Contact-public-key mode creates the file but cannot cache a content key because no private material is available.

pub fn create_lockbox_with_signing_key( &self, path: impl AsRef<Path>, protection: LockboxProtection<'_>, signing_key: &OwnerSigningKeyPair, ) -> Result<Lockbox, Error>

Creates a lockbox using an owner signing key loaded by the caller.

This variant lets interactive callers reuse an already-open encrypted vault instead of requiring its passphrase to also be available through process environment or platform secret-store state. Private signing material remains owned by OwnerSigningKeyPair, whose serialized private key is held in secure, zeroizing memory.

pub fn open_lockbox(&self, path: impl AsRef<Path>) -> Result<Lockbox, Error>

Opens a lockbox using only a content key already present in the store.

This fails if the key store has no cached key for the lockbox id.

pub fn open_lockbox_read_only( &self, path: impl AsRef<Path>, ) -> Result<Lockbox<ReadOnly>, Error>

Opens a cached lockbox for read-only metadata access without loading or requesting an owner-signing key.

pub fn open_lockbox_with( &self, path: impl AsRef<Path>, open: LockboxOpen<'_>, ) -> Result<Lockbox, Error>

Opens a lockbox with explicit open material and caches its content key.

Password and contact-key-pair opens may fall back to a key-directory backup stored in the default VaultDirectory when the embedded key directory cannot be read. That fallback requires LOCKBOX_VAULT_PASSWORD to be set so the default vault directory can be opened.

pub fn open_lockbox_with_signing_key( &self, path: impl AsRef<Path>, open: LockboxOpen<'_>, signing_key: &OwnerSigningKeyPair, ) -> Result<Lockbox, Error>

Opens a lockbox using explicit open material and an owner signing key loaded by the caller, then caches its content key.

pub fn open_lockbox_with_for_duration( &self, path: impl AsRef<Path>, open: LockboxOpen<'_>, ttl_seconds: u64, ) -> Result<Lockbox, Error>

Opens a lockbox with explicit open material and caches its content key for the requested number of seconds.

pub fn open_lockbox_with_for_duration_and_signing_key( &self, path: impl AsRef<Path>, open: LockboxOpen<'_>, ttl_seconds: u64, signing_key: &OwnerSigningKeyPair, ) -> Result<Lockbox, Error>

Opens a lockbox for a requested duration using an owner signing key loaded by the caller.

pub fn close_lockbox(&self, path: impl AsRef<Path>) -> Result<(), Error>

Removes this lockbox’s cached content key from the store.

pub fn close_all(&self) -> Result<(), Error>

Removes every cached content key from the store.

Trait Implementations

impl<S> Clone for Vault<S>

where S: Clone,

fn clone(&self) -> Vault<S>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<S> Debug for Vault<S>

where S: Debug,

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.