pub struct CursorKey { /* private fields */ }Expand description
A keyspace-persisted 32-byte HMAC key for signing pagination cursors.
The VTC signs its cursors under the active audit_key from its
crate::audit::AuditKeyStore. The VTA has no such store — it
keeps a flat append-only log with no hash chain — but canonical
audit/list still requires cursors that cannot be forged into a
position the filters did not authorize. This is the minimum that
buys: a random key, generated once and persisted, used for nothing
but cursor MACs.
Not derived from the master seed. A cursor is ephemeral and carries no long-term secret, so seed derivation would only widen the seed’s blast radius for no benefit; and a key that is not reproduced by a backup+restore is the safer default, since a cursor minted against one database should not silently resolve to a position in another.
Implementations§
Source§impl CursorKey
impl CursorKey
Sourcepub fn new(ks: KeyspaceHandle) -> Self
pub fn new(ks: KeyspaceHandle) -> Self
Wrap a keyspace. The key is created lazily on first Self::get.
Sourcepub async fn get(&self) -> Result<[u8; 32], AppError>
pub async fn get(&self) -> Result<[u8; 32], AppError>
Read the signing key, generating and persisting one if this is the first call against a fresh store.
Creation is atomic via
crate::store::KeyspaceHandle::insert_raw_if_absent: a
concurrent creator loses the race and re-reads the winner’s
key, so two requests arriving together never mint cursors under
different keys.