uqa_storage/
encryption_key.rs

1//
2// Unified Query Algebra
3//
4// Copyright (c) 2023-2026 Cognica, Inc.
5//
6
7//! Explicit, non-serializable key propagation between persistent storage owners.
8
9use std::fmt;
10use std::sync::Arc;
11
12/// Encryption credential for database-owned auxiliary storage. Drivers validate
13/// the credential when opening storage; cloning this handle shares its bytes.
14/// Debug output never includes the credential.
15#[derive(Clone)]
16pub struct StorageEncryptionKey(Arc<str>);
17
18impl StorageEncryptionKey {
19    #[must_use]
20    pub fn new(key: &str) -> Self {
21        Self(Arc::from(key))
22    }
23
24    /// Expose the credential only to configure a storage driver's encryption.
25    #[must_use]
26    pub fn expose_secret(&self) -> &str {
27        &self.0
28    }
29}
30
31impl fmt::Debug for StorageEncryptionKey {
32    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
33        formatter.write_str("StorageEncryptionKey([REDACTED])")
34    }
35}
36
37#[cfg(test)]
38mod tests {
39    use super::*;
40
41    #[test]
42    fn cloned_key_shares_bytes_without_disclosing_them_in_debug() {
43        let key = StorageEncryptionKey::new("storage-key-regression-marker");
44        let cloned = key.clone();
45        assert!(Arc::ptr_eq(&key.0, &cloned.0));
46        assert_eq!(cloned.expose_secret(), "storage-key-regression-marker");
47        assert_eq!(format!("{cloned:?}"), "StorageEncryptionKey([REDACTED])");
48    }
49}
uqa_storage/encryption_key.rs

uqa_storage/
encryption_key.rs
