Struct StoreKeys 

pub struct StoreKeys { /* private fields */ }

One store’s key material: the encryption master key, cloud-home credentials, and OAuth tokens, each stored under a store-scoped keyring account ({base}:{store_id}). The store’s signing identity is not here — it goes through crate::identity_custody::IdentityCustody, the same way the master key goes through crate::custody::KeyCustody.

Implementations

impl StoreKeys

pub fn bind(store_id: String) -> Self

pub fn store_id(&self) -> &str

pub fn get_encryption_key(&self) -> Result<Option<String>, KeyError>

pub fn set_encryption_key(&self, value: &str) -> Result<(), KeyError>

pub fn delete_encryption_key(&self) -> Result<(), KeyError>

pub fn get_cloud_home_credentials( &self, ) -> Result<Option<CloudHomeCredentials>, KeyError>

pub fn set_cloud_home_credentials( &self, creds: &CloudHomeCredentials, ) -> Result<(), KeyError>

pub fn get_cloud_home_oauth_tokens( &self, ) -> Result<Option<OAuthTokens>, KeyError>

pub fn set_cloud_home_oauth_tokens( &self, tokens: &OAuthTokens, ) -> Result<(), KeyError>

pub fn delete_cloud_home_credentials(&self) -> Result<(), KeyError>

pub fn get_host_secret(&self, name: &str) -> Result<Option<String>, KeyError>

A host’s own store-scoped secret — an API token, a service credential — read from the same keyring service and access policy as coven’s own key material. None if never set. KeyError::InvalidSecretName if name collides with one of coven’s own reserved slot names, is empty, or contains : (see validate_host_secret_name).

pub fn set_host_secret(&self, name: &str, value: &str) -> Result<(), KeyError>

Set a host’s own store-scoped secret. Same name restrictions as get_host_secret.

pub fn delete_host_secret(&self, name: &str) -> Result<(), KeyError>

Remove a host secret. Ok whether or not one was set. Same name restrictions as get_host_secret.

pub fn write_cloud_home_credentials_json_for_test( &self, json: &str, ) -> Result<(), KeyError>

pub fn fail_next_cloud_home_credentials_operation_for_test( &self, error: Error, ) -> Result<(), KeyError>

Trait Implementations

impl Clone for StoreKeys

fn clone(&self) -> StoreKeys

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl DeviceIdentityCustody for StoreKeys

fn unlock(&self) -> Result<Option<UserKeypair>, KeyError>

This store’s established signing identity. Ok(None) means none has ever been established — distinct from a failure to produce one (wrong passphrase, unreadable backing store), which is Err.

fn persist(&self, keypair: &UserKeypair) -> Result<(), KeyError>

Protect and store keypair, replacing whatever is stored. Idempotent.

fn forget(&self) -> Result<(), KeyError>

Remove the stored identity. Ok when nothing was stored.

fn establish(&self, keypair: &UserKeypair) -> Result<(), KeyError>

Establish this Store’s identity without replacing a different identity. Repeating the same identity is idempotent.