Struct LocalKmsClient 

pub struct LocalKmsClient { /* private fields */ }

本地 KMS 客户端（测试/开发用）

在内存中存储 DEK，按 (column, version) 索引。 DEK 以 Zeroizing<Vec<u8>> 存储，Drop 时自动清零（2026-09-14 安全审计修复： 此前为裸 Vec<u8>，进程退出时密钥材料残留在已释放内存中）。

Implementations

impl LocalKmsClient

pub fn new() -> LocalKmsClient

创建空本地 KMS

pub fn with_dek(column: &str, version: u32, dek: Vec<u8>) -> LocalKmsClient

预置一个 DEK

pub fn generate_dek(&self, column: &str, version: u32) -> DekBuffer

生成随机 32 字节 DEK 并存储

Trait Implementations

impl Default for LocalKmsClient

fn default() -> LocalKmsClient

Returns the “default value” for a type.

impl KmsClient for LocalKmsClient

fn get_dek<'life0, 'life1, 'async_trait>( &'life0 self, column: &'life1 str, version: u32, ) -> Pin<Box<dyn Future<Output = Result<DekBuffer, KmsError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, LocalKmsClient: 'async_trait,

获取 DEK（数据加密密钥）

fn unwrap_dek<'life0, 'life1, 'async_trait>( &'life0 self, wrapped_dek: &'life1 [u8], _version: u32, ) -> Pin<Box<dyn Future<Output = Result<DekBuffer, KmsError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, LocalKmsClient: 'async_trait,

解包 DEK（从 wrapped DEK 还原明文 DEK）

fn rotate_key<'life0, 'life1, 'async_trait>( &'life0 self, column: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<u32, KmsError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, LocalKmsClient: 'async_trait,

轮换密钥，返回新版本号