Struct KeyHasher 

pub struct KeyHasher { /* private fields */ }

Derives opaque subject keys using HMAC-SHA-256.

Each derivation is domain-separated by the exact policy and scope identifiers. The same normalized subject therefore yields unrelated keys in different policy scopes.

Applications should keep one stable secret per deployment. Rotating it deliberately starts new counters because all derived subject keys change.

Implementations

impl KeyHasher

pub const MINIMUM_SECRET_LENGTH: usize = 32

Minimum accepted secret length in bytes.

pub fn new(secret: impl AsRef<[u8]>) -> Result<Self, KeyHasherError>

Constructs a hasher by copying a secret into zeroizing storage.

Errors

Returns KeyHasherError::SecretTooShort unless the secret contains at least 32 bytes.

pub fn hash( &self, policy_id: &PolicyId, scope_id: &ScopeId, subject: impl AsRef<[u8]>, ) -> SubjectKey

Hashes a normalized subject within an explicit policy and scope.

Normalization is application-owned: two byte strings are treated as distinct subjects even if an application considers them equivalent.

pub fn hash_for( &self, policy: &FixedWindowPolicy, subject: impl AsRef<[u8]>, ) -> SubjectKey

Hashes a normalized subject in a fixed-window policy’s namespace.

Trait Implementations

impl Debug for KeyHasher

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.