Struct SecretsState 

pub struct SecretsState {
    pub nodes: HashMap<String, NodeIdentity>,
    pub wrapped_dek: Option<WrappedDek>,
    pub secrets: HashMap<String, ReplicatedSecret>,
    pub revoked_tokens: HashMap<String, DateTime<Utc>>,
    pub trusted_bundles: HashMap<String, TrustBundle>,
    pub jwt_algorithm: JwtAlgorithm,
    pub join_secret_wiped_at: Option<DateTime<Utc>>,
}

Snapshot of the cluster secrets state on this node.

Followers and the leader hold identical content. Snapshots (de)serialize through serde for openraft.

Fields

nodes: HashMap<String, NodeIdentity>

Every node ever registered, keyed by node_id. Soft-revocation is recorded inline (NodeIdentity::revoked_at); the entry is kept so historical wraps in old WrappedDek generations can still be referenced for audit.

wrapped_dek: Option<WrappedDek>

Current cluster DEK envelope (per-node sealed-box wraps + generation). None until the first RegisterNode + RotateDek pair lands.

secrets: HashMap<String, ReplicatedSecret>

Replicated secrets, keyed by their storage_key ("{scope}:{name}").

revoked_tokens: HashMap<String, DateTime<Utc>>

Revoked join tokens, keyed by token_hash (lowercase hex SHA-256 of the full token b64 envelope). Auto-pruned during apply: any RevokeToken op also sweeps entries whose expires_at < now().

trusted_bundles: HashMap<String, TrustBundle>

Trusted foreign-cluster trust bundles, keyed by cluster_domain. Imported via SecretsRaftOp::ImportTrustBundle and consulted by crate::cluster_signer::ClusterCa::verify_ca_cert when a v=2 signed token carries a ca_chain whose cluster_domain is not the local cluster’s.

#[serde(default)] so snapshots written before this field existed restore with an empty map.

jwt_algorithm: JwtAlgorithm

Cluster-wide JWT algorithm policy. Drives which join-token formats cluster_join accepts. Default Both for safety — the daemon’s bootstrap may override based on whether {data_dir}/join_secret is already present on first start.

#[serde(default)] so pre-Wave-11 snapshots restore cleanly.

join_secret_wiped_at: Option<DateTime<Utc>>

Timestamp when WipeJoinSecret last applied (None = never).

Two daemon mechanisms consult this field:

• The apply-time wrapper in zlayer_scheduler::raft::ClusterState fires NodeSideEffects::fire_wipe_join_secret, which the daemon’s watcher task drains to delete {data_dir}/join_secret.
• The boot-time reconcile in zlayer serve checks this field on startup; if Some(_) and the file still exists locally (e.g. the node restored from a snapshot where the wipe already happened), the file is removed before the HS256 HMAC loader runs.

Both paths are idempotent.

#[serde(default)] for pre-Wave-11 snapshots.

Implementations

impl SecretsState

pub fn apply(&mut self, op: SecretsRaftOp) -> Result<(), SecretsError>

Apply a Raft op to local state.

Deterministic — every replica that sees the same op sequence must end up with the same SecretsState. Returns an error only on genuinely impossible inputs (e.g. DeleteSecret for an unknown key); the leader’s orchestration is expected to ensure the inputs are well-formed before proposing.

Errors

• SecretsError::Provider if the op references state that doesn’t exist (revoke unknown node, delete unknown secret).

pub fn snapshot(&self) -> Result<Vec<u8>, SecretsError>

Serialize the state for an openraft snapshot. Uses JSON for now; the consensus wire-up task may swap this for a more compact codec once it audits whatever the scheduler SM uses.

Errors

• SecretsError::Storage if serialization fails.

pub fn restore(bytes: &[u8]) -> Result<Self, SecretsError>

Restore from a snapshot blob produced by Self::snapshot.

Errors

• SecretsError::Storage if deserialization fails.

pub fn node_can_decrypt(&self, node_id: &str) -> bool

Convenience: is this node currently in the active recipient set for the current DEK generation?

pub fn token_revoked(&self, token_hash: &str) -> bool

Returns true if the given token hash is currently revoked.

Auto-pruning happens at apply time; callers can rely on the in-memory map being a tight view of un-expired revocations.

pub fn trust_bundle_for(&self, cluster_domain: &str) -> Option<&TrustBundle>

Look up a trusted foreign cluster’s bundle by domain.

pub fn jwt_algorithm(&self) -> JwtAlgorithm

Return the current JWT algorithm policy.

pub fn join_secret_wiped(&self) -> bool

true if WipeJoinSecret has been applied at least once.

Trait Implementations

impl Clone for SecretsState

fn clone(&self) -> SecretsState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretsState

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecretsState

fn default() -> SecretsState

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecretsState

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecretsState

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.