Struct SecretsState 

pub struct SecretsState {
    pub nodes: HashMap<String, NodeIdentity>,
    pub wrapped_dek: Option<WrappedDek>,
    pub secrets: HashMap<String, ReplicatedSecret>,
}

Snapshot of the cluster secrets state on this node.

Followers and the leader hold identical content. Snapshots (de)serialize through serde for openraft.

Fields

nodes: HashMap<String, NodeIdentity>

Every node ever registered, keyed by node_id. Soft-revocation is recorded inline (NodeIdentity::revoked_at); the entry is kept so historical wraps in old WrappedDek generations can still be referenced for audit.

wrapped_dek: Option<WrappedDek>

Current cluster DEK envelope (per-node sealed-box wraps + generation). None until the first RegisterNode + RotateDek pair lands.

secrets: HashMap<String, ReplicatedSecret>

Replicated secrets, keyed by their storage_key ("{scope}:{name}").

Implementations

impl SecretsState

pub fn apply(&mut self, op: SecretsRaftOp) -> Result<(), SecretsError>

Apply a Raft op to local state.

Deterministic — every replica that sees the same op sequence must end up with the same SecretsState. Returns an error only on genuinely impossible inputs (e.g. DeleteSecret for an unknown key); the leader’s orchestration is expected to ensure the inputs are well-formed before proposing.

Errors

• SecretsError::Provider if the op references state that doesn’t exist (revoke unknown node, delete unknown secret).

pub fn snapshot(&self) -> Result<Vec<u8>, SecretsError>

Serialize the state for an openraft snapshot. Uses JSON for now; the consensus wire-up task may swap this for a more compact codec once it audits whatever the scheduler SM uses.

Errors

• SecretsError::Storage if serialization fails.

pub fn restore(bytes: &[u8]) -> Result<Self, SecretsError>

Restore from a snapshot blob produced by Self::snapshot.

Errors

• SecretsError::Storage if deserialization fails.

pub fn node_can_decrypt(&self, node_id: &str) -> bool

Convenience: is this node currently in the active recipient set for the current DEK generation?

Trait Implementations

impl Clone for SecretsState

fn clone(&self) -> SecretsState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretsState

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecretsState

fn default() -> SecretsState

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecretsState

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecretsState

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.