pub struct MfaDeleteManager { /* private fields */ }Expand description
Top-level manager. Owns the gateway-wide “default” secret + per-bucket
overrides + per-bucket MFA-Delete enabled/disabled state. All public
operations go through RwLock for thread safety; an Arc<MfaDeleteManager>
is the expected handle shape (same pattern as VersioningManager /
ObjectLockManager).
Implementations§
Source§impl MfaDeleteManager
impl MfaDeleteManager
Sourcepub fn new() -> Self
pub fn new() -> Self
Empty manager — no default secret, no per-bucket overrides, no bucket has MFA Delete enabled.
Sourcepub fn set_default_secret(&self, secret: MfaSecret)
pub fn set_default_secret(&self, secret: MfaSecret)
Install (or replace) the gateway-wide default secret. Buckets with
is_enabled(bucket) == true and no per-bucket override use this
secret to verify the client-supplied TOTP code.
Sourcepub fn set_bucket_secret(&self, bucket: &str, secret: MfaSecret)
pub fn set_bucket_secret(&self, bucket: &str, secret: MfaSecret)
Install (or replace) a per-bucket override.
Sourcepub fn set_bucket_state(&self, bucket: &str, enabled: bool)
pub fn set_bucket_state(&self, bucket: &str, enabled: bool)
Toggle MFA Delete on bucket. true enables enforcement (every
subsequent DELETE / DELETE-version / delete-marker request needs
x-amz-mfa); false disables (the bucket falls back to the
regular versioning DELETE flow).
Sourcepub fn is_enabled(&self, bucket: &str) -> bool
pub fn is_enabled(&self, bucket: &str) -> bool
true when bucket has explicitly enabled MFA Delete (default
false for never-configured buckets, matching S3 spec).
Sourcepub fn lookup_secret(&self, bucket: &str) -> Option<MfaSecret>
pub fn lookup_secret(&self, bucket: &str) -> Option<MfaSecret>
Lookup the MFA secret to use when verifying a request against
bucket: per-bucket override takes precedence over the default.
Returns None when neither has been configured.