Struct KeyInventory 

pub struct KeyInventory { /* private fields */ }

A caller-owned inventory of imported XML Security key material.

Implementations

impl KeyInventory

pub fn key_import_kdf_work(&self) -> usize

Work reserved before password derivation, including unsuccessful imports. An operation importing through temporary inventories must carry this usage forward rather than resetting its remaining KDF allowance.

pub fn entry_count(&self) -> usize

Number of imported candidates, including unsupported XML entries.

pub fn symmetric_keys(&self) -> &[StoredSymmetricKey]

Imported symmetric keys, without mutable access to inventory bounds.

pub fn public_keys(&self) -> &[StoredPublicKey]

Imported public keys, without mutable access to inventory bounds.

pub fn private_keys(&self) -> &[StoredPrivateKey]

Imported private keys, without mutable access to inventory bounds.

pub fn extend( &mut self, other: Self, resources: &ResourcePolicy, ) -> Result<(), KeyStoreError>

Combine two caller-owned imports after checking aggregate bytes, candidates, KDF work, and cross-store name collisions before mutation.

pub fn rsa_encryption_key( &self, name: &str, policy: &EncryptionPolicy, ) -> Result<RsaPublicKey, KeyStoreError>

Select an authorized named RSA recipient from XMLDSig RSAKeyValue or DER SubjectPublicKeyInfo without introducing an implicit key source.

pub fn signing_key( &self, name: &str, algorithm: SignatureAlgorithm, policy: &SigningPolicy, ) -> Result<Box<dyn SigningKey>, KeyStoreError>

Select a named signer under the operation’s immutable policy.

pub fn signing_key_with_budget( &self, name: &str, algorithm: SignatureAlgorithm, policy: &SigningPolicy, budget: &mut SigningLookupBudget, ) -> Result<Box<dyn SigningKey>, KeyStoreError>

Select a named signer while sharing lookup work across caller retries.

pub fn signing_key_with_provider( &self, name: &str, algorithm: SignatureAlgorithm, policy: &SigningPolicy, provider: &dyn CryptoProvider, ) -> Result<Box<dyn SigningKey>, KeyStoreError>

Select an authorized key and import it into the explicitly chosen engine.

pub fn signing_key_with_provider_and_budget( &self, name: &str, algorithm: SignatureAlgorithm, policy: &SigningPolicy, provider: &dyn CryptoProvider, budget: &mut SigningLookupBudget, ) -> Result<Box<dyn SigningKey>, KeyStoreError>

Provider-aware selection sharing the operation’s retry budget.

pub fn decryption_resolver( &self, name: &str, policy: &DecryptionPolicy, ) -> Result<Box<dyn DecryptionKeyResolver>, KeyStoreError>

Select a named direct AES key or RSA private-key transport resolver.

pub fn decryption_resolver_with_provider( &self, name: &str, policy: &DecryptionPolicy, provider: &dyn CryptoProvider, ) -> Result<Box<dyn DecryptionKeyResolver>, KeyStoreError>

Select an authorized recovery key owned by the chosen native engine.

pub fn verification_resolver(&self) -> InventoryVerificationResolver<'_>

Build a resolver from this inventory and one immutable key-store snapshot. Trust anchors are copied once, not on each candidate lookup.

pub fn add_symmetric( &mut self, name: String, kind: SymmetricKeyKind, bytes: Vec<u8>, usages: KeyUsages, resources: &ResourcePolicy, ) -> Result<(), KeyStoreError>

Register raw symmetric bytes under a unique name.

pub fn add_public_der( &mut self, name: String, der: Vec<u8>, resources: &ResourcePolicy, ) -> Result<(), KeyStoreError>

Register DER SubjectPublicKeyInfo or a complete X.509 certificate. A certificate is a lookup candidate, never an implicit trust anchor.

pub fn add_public_der_with_usages( &mut self, name: String, der: Vec<u8>, usages: KeyUsages, resources: &ResourcePolicy, ) -> Result<(), KeyStoreError>

Register public DER with explicit verification/encryption permissions.

pub fn add_public_pem( &mut self, name: String, bytes: &[u8], resources: &ResourcePolicy, ) -> Result<(), KeyStoreError>

Import one PEM-encoded public key. RFC 7468 labels select SPKI or PKCS#1; extra text and multiple armor blocks are rejected. Aggregate capacity includes retained inventory, the live encoded input, decoded DER, and any SPKI normalization output before allocation.

pub fn add_public_pem_with_usages( &mut self, name: String, bytes: &[u8], usages: KeyUsages, resources: &ResourcePolicy, ) -> Result<(), KeyStoreError>

Import one PEM public key with explicit verification/encryption permissions.

pub fn add_private_der( &mut self, name: String, bytes: &[u8], password: Option<&[u8]>, usages: KeyUsages, resources: &ResourcePolicy, ) -> Result<(), KeyStoreError>

Import a DER private key as PKCS#8 (plain or encrypted) or RSA PKCS#1. Passwords are consulted only for a structurally encrypted container; a wrong password never retries a plaintext decoder.

pub fn add_private_der_with_password_callback<F>( &mut self, name: String, bytes: &[u8], password: F, usages: KeyUsages, resources: &ResourcePolicy, ) -> Result<(), KeyStoreError>

where F: FnOnce() -> Option<Zeroizing<Vec<u8>>>,

Import private DER using a caller-owned password callback only when the input is an encrypted PKCS#8 container.

pub fn add_private_pem( &mut self, name: String, bytes: &[u8], password: Option<&[u8]>, usages: KeyUsages, resources: &ResourcePolicy, ) -> Result<(), KeyStoreError>

Import one PEM private key, including encrypted PKCS#8. Traditional OpenSSL PEM encryption is handled at the CLI compatibility boundary.

pub fn add_pkcs12( &mut self, name: String, bytes: &[u8], password: &str, resources: &ResourcePolicy, ) -> Result<(), KeyStoreError>

Import a bounded PKCS#12 bundle from caller-owned bytes. The key may sign; RSA keys may also decrypt. A bundle with more than one private key is rejected rather than assigning names from iteration order.

pub fn add_pkcs12_with_password_callback<F>( &mut self, name: String, bytes: &[u8], password: F, usages: KeyUsages, resources: &ResourcePolicy, ) -> Result<(), KeyStoreError>

where F: FnOnce() -> Option<Zeroizing<String>>,

Import PKCS#12 using a caller-owned password callback. Its result is zeroized after decoding and callback failure exposes no diagnostic.

pub fn add_pkcs12_with_usages( &mut self, name: String, bytes: &[u8], password: &str, usages: KeyUsages, resources: &ResourcePolicy, ) -> Result<(), KeyStoreError>

Import a PKCS#12 bundle with explicit signing/decryption permissions.

pub fn add_certificate_der( &mut self, der: Vec<u8>, trusted_anchor: bool, resources: &ResourcePolicy, ) -> Result<(), KeyStoreError>

Import a DER certificate as an untrusted lookup candidate or an explicitly caller-trusted anchor. Parsing alone never grants trust.

pub fn add_crl_der( &mut self, der: Vec<u8>, resources: &ResourcePolicy, ) -> Result<(), KeyStoreError>

Import a DER CRL for policy-controlled revocation checks.

pub fn from_xml_bytes<P: XmlDocumentPolicy>( bytes: &[u8], policy: &P, backend: XmlBackend, ) -> Result<Self, KeyStoreError>

Import caller-owned XML bytes under the operation’s XML and resource snapshot.

Trait Implementations

impl Default for KeyInventory

fn default() -> Self

Returns the “default value” for a type.