Enum SseSource 

pub enum SseSource<'a> {
    Keyring(&'a SseKeyring),
    CustomerKey {
        key: &'a [u8; 32],
        key_md5: &'a [u8; 16],
    },
    Kms {
        dek: &'a [u8; 32],
        wrapped: &'a WrappedDek,
    },
}

Source of the encryption key for encrypt_with_source / decrypt. SSE-S4 (server-managed, rotation-aware) goes through Keyring; SSE-C (customer-supplied) goes through CustomerKey.

Borrowed (not owned) so the caller can hold a long-lived CustomerKeyMaterial next to the request and just lend it for the duration of one PUT/GET.

Variants

Keyring(&'a SseKeyring)

Server-managed keyring path → produces / consumes S4E1 (legacy) or S4E2 (rotation-aware) frames.

CustomerKey

Client-supplied AES-256 key + its MD5 fingerprint → produces / consumes S4E3 frames. The server never persists the key; it stores key_md5 only.

Fields

key: &'a [u8; 32]

key_md5: &'a [u8; 16]

Kms

SSE-KMS envelope → produces / consumes S4E4 frames. The server holds a per-object plaintext DEK (from a fresh KmsBackend::generate_dek call) and the wrapped form to persist alongside the body. The DEK is dropped after one PUT/GET; only the wrapped form survives at rest.

Fields

dek: &'a [u8; 32]

32-byte plaintext DEK, used as the AES-GCM key.

wrapped: &'a WrappedDek

Wrapped form to persist in the S4E4 frame (PUT) or the one read out of the frame (GET, after a successful unwrap).

Trait Implementations

impl<'a> Clone for SseSource<'a>

fn clone(&self) -> SseSource<'a>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Copy for SseSource<'a>

impl<'a> Debug for SseSource<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a> From<&'a Arc<SseKeyring>> for SseSource<'a>

service.rs holds keyring as Option<Arc<SseKeyring>> and unwraps to &Arc<SseKeyring> — let that coerce too, otherwise every existing call site needs .as_ref() boilerplate.

fn from(kr: &'a Arc<SseKeyring>) -> Self

Converts to this type from the input type.

impl<'a> From<&'a CustomerKeyMaterial> for SseSource<'a>

fn from(m: &'a CustomerKeyMaterial) -> Self

Converts to this type from the input type.

impl<'a> From<&'a SseKeyring> for SseSource<'a>

Back-compat coercion: existing call sites pass &SseKeyring directly to decrypt. With this From impl the generic bound Into<SseSource> accepts &SseKeyring without the caller writing .into(), keeping v0.4 / v0.5 #29 service.rs callers compiling untouched while v0.5 #27 SSE-C callers pass SseSource::CustomerKey explicitly.

fn from(kr: &'a SseKeyring) -> Self

Converts to this type from the input type.