Struct StaticMasterKeyProvider 

pub struct StaticMasterKeyProvider { /* private fields */ }

v1 master key source: a hex-encoded 32-byte key from an env var, or (if the env var holds a path instead) read from a file. Swappable later for a KMS-backed provider without touching Barrier or its callers.

Implementations

impl StaticMasterKeyProvider

pub fn from_hex(hex_key: &str) -> Result<Self, CryptoError>

pub fn from_env(var: &str) -> Result<Self, CryptoError>

pub fn with_retired_from_env(self, var: &str) -> Result<Self, CryptoError>

Adds decrypt-only keys from a comma-separated env var. Absent or empty is normal — it means no rotation is in flight.

Trait Implementations

impl MasterKeyProvider for StaticMasterKeyProvider

fn current_key(&self) -> [u8; 32]

fn retired_keys(&self) -> Vec<[u8; 32]>

Keys kept only so previously-written values still open. Empty unless a rotation is in progress.