Struct KeyService 

pub struct KeyService { /* private fields */ }

Implementations

impl KeyService

pub fn new(dev_mode: bool, library_id: String) -> Self

pub fn is_dev_mode(&self) -> bool

pub fn library_id(&self) -> &str

The library this key service is scoped to. Lets host apps namespace their own keyring accounts the same way coven does.

pub fn get_encryption_key(&self) -> Result<Option<String>, KeyError>

Read the encryption master key. Ok(None) if not configured, Err if the underlying read failed (keyring backend error or non-utf8 env).

Dev mode: reads BAE_ENCRYPTION_KEY env var. Prod mode: reads from OS keyring (may trigger a system prompt on first access).

pub fn get_or_create_encryption_key(&self) -> Result<String, KeyError>

Get the encryption key, creating a new one if none exists. Errors in dev mode (use environment variables instead).

pub fn set_encryption_key(&self, value: &str) -> Result<(), KeyError>

Save the encryption master key to the OS keyring. Errors in dev mode (use environment variables instead).

pub fn get_cloud_home_credentials( &self, ) -> Result<Option<CloudHomeCredentials>, KeyError>

Read cloud home credentials. Returns Ok(None) if not set, Err if the stored value can’t be parsed.

Dev mode: reads BAE_CLOUD_HOME_CREDENTIALS env var (JSON). Prod mode: reads from OS keyring.

pub fn set_cloud_home_credentials( &self, creds: &CloudHomeCredentials, ) -> Result<(), KeyError>

Save cloud home credentials.

Dev mode: sets the env var. Prod mode: writes to OS keyring.

pub fn delete_cloud_home_credentials(&self) -> Result<(), KeyError>

Delete cloud home credentials.

Dev mode: removes the env var. Prod mode: deletes from OS keyring. Silently ignores missing entries.

pub fn get_user_keypair(&self) -> Result<UserKeypair, KeyError>

Load the user’s Ed25519 keypair from the keyring. Returns an error if no keypair exists (unlike get_or_create_user_keypair which creates one).

pub fn get_or_create_user_keypair(&self) -> Result<UserKeypair, KeyError>

Load the user’s Ed25519 keypair from the keyring, creating a new one if none exists. This is a global identity shared across all libraries.

Dev mode: reads env vars namespaced by library_id (hex). Falls back to generating and storing in env vars so tests can round-trip.

pub fn get_user_public_key(&self) -> Result<Option<[u8; 32]>, KeyError>

Return just the user’s Ed25519 public key. Ok(None) if not stored, Err if the stored signing key is corrupt. Derives from the signing key — there is no separate public-key entry.

pub fn import_user_keypair( &self, signing_key_bytes: &[u8], ) -> Result<(), KeyError>

Import an Ed25519 keypair from raw bytes (64 bytes: seed + public key). Overwrites any existing keypair. Used during restore to preserve the original device’s membership identity.

Trait Implementations

impl Clone for KeyService

fn clone(&self) -> KeyService

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.