Struct SecretSyncer 

pub struct SecretSyncer<B: SecretBackend, E: KeyEncryptor + Clone, const V: usize = 256, const S: usize = 32> { /* private fields */ }

Background task that keeps an InMemorySecretGroup up-to-date by polling storage.

SecretSyncer is the read side of the key-management system. It:

1. Initial load — calls SecretBackend::load_all once at startup to hydrate the ring buffer and promote the most-recently-activated key as current.
2. Poll loop — periodically calls SecretBackend::poll_new to pick up keys added after the cursor. Keys with activated_at in the future are stored in the ring but only promoted to current once their activation time arrives (via a spawned timer task).

A hash-based dedup cache prevents redundant KeyEncryptor::decrypt calls when the same ciphertext is seen again (e.g. after a service restart or a backend re-delivery).

The poll interval is adaptive: if a rotation is expected soon (based on rotation_interval), the syncer wakes earlier so it picks up the new key promptly; otherwise it sleeps for the configured poll_interval.

Type parameters

• B — backend that implements SecretBackend
• E — encryptor that implements KeyEncryptor
• V — ring buffer size (must match the InMemorySecretGroup passed in, default 256)
• S — key size in bytes (default 32)

Standalone use

Use SecretSyncer directly when your instances should only read keys, not rotate them:

let group = Arc::new(InMemorySecretGroup::<256, 32>::new(0, [0u8; 32]));
let mut syncer: SecretSyncer<_, _, 256, 32> = SecretSyncer::new(
    "session-tokens",
    Arc::clone(&group),
    backend,
    encryptor,
    Duration::from_secs(3600),
    None,
);
let token = CancellationToken::new();
let cursor = syncer.initial_load(&token).await?;
tokio::spawn(syncer.run(token, cursor));

Implementations

impl<B: SecretBackend, E: KeyEncryptor + Clone, const V: usize, const S: usize> SecretSyncer<B, E, V, S>

pub fn new( group_id: impl Into<String>, secret: Arc<InMemorySecretGroup<V, S>>, backend: B, encryptor: E, rotation_interval: Duration, poll_interval: Option<Duration>, ) -> Self

Create a new SecretSyncer.

Arguments

• group_id — identifies the logical key group in storage
• secret — the in-memory ring buffer to keep populated
• backend — implements SecretBackend
• encryptor — used to decrypt ciphertext from storage before placing keys in the ring
• rotation_interval — expected time between rotations; used to compute a smart early wake-up before the next key is due, reducing promotion latency
• poll_interval — base polling cadence; None uses the 5-second default

pub async fn initial_load( &mut self, token: &CancellationToken, ) -> Result<(SystemTime, i64), B::Error>

Load all existing keys from storage and hydrate the ring buffer.

Must be called once before run. Returns a cursor (max_activated_at, max_id) that marks the newest record seen; pass this directly to run so the poll loop starts from where the initial load left off.

Keys already present in the ring are not re-decrypted (hash dedup). Keys with activated_at in the future are stored but not yet promoted; a timer task is spawned for each to promote them at the right moment.

The token parameter is threaded through only for future cancellability of long-running initial loads; it is not yet acted upon inside the method body.

pub async fn run(self, token: CancellationToken, cursor: (SystemTime, i64))

Run the poll loop until token is cancelled.

Consumes self; pass to tokio::spawn after calling initial_load.

On backend errors the syncer backs off for 30 seconds before retrying. Decryption errors for individual records are logged and skipped; the loop continues.