Struct SecretContext 

pub struct SecretContext { /* private fields */ }

High-level context for encrypting and decrypting secrets. Bundles principal key, workspace keys, and environment to hide all crypto details.

Implementations

impl SecretContext

pub fn new( principal_x25519_private_key: [u8; 32], workspace_keys: WorkspaceKeys, environment: Environment, workspace_name: String, project_name: String, environment_name: String, ) -> Result<Self, SecretsError>

Create a new SecretContext from principal key, workspace keys, and environment.

pub fn decrypt_secret(&self, secret: &Secret) -> Result<String, SecretsError>

Decrypt a secret using the bundled context. Handles all KEK/DEK unwrapping, ECDH, and AAD construction internally.

pub fn encrypt_secret( &self, key: &str, value: &str, ) -> Result<EncryptedSecret, SecretsError>

Encrypt a secret using the bundled context. Handles all KEK/DEK unwrapping, ECDH, nonce generation, and AAD construction internally.