Struct Vault 

pub struct Vault<S = AgentClient> { /* private fields */ }

High-level lockbox helper that integrates open operations with a key cache.

Vault wraps a ContentKeyStore. Creating or opening a lockbox stores the resulting content key in that store. open_lockbox then reopens the lockbox from the cached key without requiring the original password or contact private key.

Implementations

impl<S> Vault<S>

pub fn new(store: S) -> Self

Creates a vault around a custom content-key store.

pub fn store(&self) -> &S

Returns the content-key store used by this vault.

impl<S: ContentKeyStore> Vault<S>

pub fn create_lockbox_with_password( &self, path: impl AsRef<Path>, password: &SecretString, ) -> Result<Lockbox>

Creates a password-protected lockbox and caches its content key.

pub fn open_lockbox_with_password( &self, path: impl AsRef<Path>, password: &SecretString, ) -> Result<Lockbox>

Opens a password-protected lockbox and caches its content key.

pub fn open_lockbox_with_password_for_duration( &self, path: impl AsRef<Path>, password: &SecretString, ttl_seconds: u64, ) -> Result<Lockbox>

Opens a password-protected lockbox and caches its content key for the requested number of seconds.

pub fn cache_lockbox_password_for_duration( &self, path: impl AsRef<Path>, password: &SecretString, ttl_seconds: u64, ) -> Result<()>

Refreshes a password-protected lockbox’s cached content key for a requested number of seconds without reopening the lockbox payload.

pub fn create_lockbox( &self, path: impl AsRef<Path>, protection: LockboxProtection<'_>, ) -> Result<Lockbox>

Creates a lockbox with the supplied protection mode.

Content-key and password modes cache the opened content key after the file is created. Contact-public-key mode creates the file but cannot cache a content key because no private material is available.

pub fn create_lockbox_with_signing_key( &self, path: impl AsRef<Path>, protection: LockboxProtection<'_>, signing_key: &OwnerSigningKeyPair, ) -> Result<Lockbox>

Creates a lockbox using an owner signing key loaded by the caller.

This variant lets interactive callers reuse an already-open encrypted vault instead of requiring its passphrase to also be available through process environment or platform credential store state. Private signing material remains owned by OwnerSigningKeyPair, whose serialized private key is held in secure, zeroizing memory.

pub fn open_lockbox(&self, path: impl AsRef<Path>) -> Result<Lockbox>

Opens a lockbox using only a content key already present in the store.

This fails if the key store has no cached key for the lockbox id.

pub fn open_lockbox_read_only( &self, path: impl AsRef<Path>, ) -> Result<Lockbox<ReadOnly>>

Opens a cached lockbox for read-only metadata access without loading or requesting an owner-signing key.

pub fn open_password_read_only( &self, path: impl AsRef<Path>, password: &SecretString, ttl_seconds: Option<u64>, ) -> Result<()>

Opens with an explicit password and caches read access without a local vault or owner signing key. The password is not persisted.

pub fn open_lockbox_with( &self, path: impl AsRef<Path>, open: LockboxOpen<'_>, ) -> Result<Lockbox>

Opens a lockbox with explicit open material and caches its content key.

Password and contact-key-pair opens may fall back to a key-directory backup stored in the default VaultDirectory when the embedded key directory cannot be read. That fallback requires LOCKBOX_VAULT_PASSWORD to be set so the default vault directory can be opened.

pub fn open_lockbox_with_signing_key( &self, path: impl AsRef<Path>, open: LockboxOpen<'_>, signing_key: &OwnerSigningKeyPair, ) -> Result<Lockbox>

Opens a lockbox using explicit open material and an owner signing key loaded by the caller, then caches its content key.

pub fn open_lockbox_with_for_duration( &self, path: impl AsRef<Path>, open: LockboxOpen<'_>, ttl_seconds: u64, ) -> Result<Lockbox>

Opens a lockbox with explicit open material and caches its content key for the requested number of seconds.

pub fn open_lockbox_with_for_duration_and_signing_key( &self, path: impl AsRef<Path>, open: LockboxOpen<'_>, ttl_seconds: u64, signing_key: &OwnerSigningKeyPair, ) -> Result<Lockbox>

Opens a lockbox for a requested duration using an owner signing key loaded by the caller.

pub fn close_lockbox(&self, path: impl AsRef<Path>) -> Result<()>

Removes this lockbox’s cached content key from the store.

pub fn close_all(&self) -> Result<()>

Removes every cached content key from the store.

Trait Implementations

impl<S: Clone> Clone for Vault<S>

fn clone(&self) -> Vault<S>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<S: Debug> Debug for Vault<S>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.