Enum CloudCipher 

pub enum CloudCipher {
    Encrypted(EncryptionService),
    Plaintext,
}

How a cloud home protects its objects at rest. An Encrypted home seals every object under the store key (the default); a Plaintext home stores objects in the clear so the bucket is browsable, and drops the .enc suffix.

Variants

Encrypted(EncryptionService)

Plaintext

Implementations

impl CloudCipher

pub fn for_storage( storage: HomeStorage, encryption: Option<EncryptionService>, ) -> Option<Self>

The at-rest cipher a home’s storage mode selects: an opaque home seals under its store key (Encrypted), a browsable home stores in the clear (Plaintext). The sibling of [BlobPathScheme::for_storage] — together they map a HomeStorage to its (path scheme, at-rest cipher) pair.

encryption is the store master service; it is required for (and only consulted on) an opaque home. None is returned only for an opaque home with no service (a locked store) — a browsable home is always Plaintext regardless. A host streaming a Remote blob via [BlobRangeReader] builds the reader with this cipher so a read applies the same protection the upload sealed under.

pub fn seal(&self, plaintext: Vec<u8>, aad_context: &[u8]) -> Vec<u8>

Protect an immutable Store object or mutable membership/key object for storage. Encrypted homes seal under the current store-key generation and prefix that generation in cleartext; plaintext homes return the bytes unchanged.

pub fn open( &self, stored: Vec<u8>, aad_context: &[u8], ) -> Result<Vec<u8>, EncryptionError>

Recover a control object read from storage. Inverse of Self::seal.

pub fn suffix(&self) -> &'static str

The object-key suffix this cipher implies: .enc for an encrypted home, empty for a plaintext one. Note "x".strip_suffix("") returns Some("x"), so the listing parsers strip an empty suffix as a clean no-op.

pub fn is_plaintext(&self) -> bool

Whether this is a plaintext (unencrypted) home.

pub fn body_len(&self, plaintext_len: u64) -> u64

The final object length for a blob of plaintext_len bytes under this cipher: the generation tag plus the chunked-encrypted length for an encrypted home, the plaintext length verbatim for a browsable one.

Trait Implementations

impl Clone for CloudCipher

fn clone(&self) -> CloudCipher

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.