pub trait CloudSyncCipherStateAccess: Send + Sync {
// Required methods
fn is_plaintext(&self) -> bool;
fn suffix(&self) -> &'static str;
fn current_generation(&self) -> Option<u64>;
fn current_fingerprint(&self) -> Option<String>;
fn open(
&self,
stored: Vec<u8>,
aad_context: &[u8],
) -> Result<Vec<u8>, EncryptionError>;
fn seal(&self, plaintext: Vec<u8>, aad_context: &[u8]) -> Vec<u8> ⓘ;
fn open_sealed_blob_for_test(
&self,
stored: &[u8],
aad_context: &[u8],
) -> Result<(KeyFingerprint, Vec<u8>), EncryptionError>;
fn merged_keyring(
&self,
new_encryption: &EncryptionService,
) -> Result<CloudKeyringMerge, EncryptionError>;
fn merge_key_rotation(
&self,
new_encryption: &EncryptionService,
custody: &dyn MasterKeyCustody,
) -> Result<Option<String>, KeyError>;
// Provided method
fn adopt_key_rotation(
&self,
new_encryption: &EncryptionService,
custody: &dyn MasterKeyCustody,
) -> Result<AdoptedCloudKeyRotation, KeyError> { ... }
}Expand description
Closed access to one session’s live at-rest keyring. Callers can use the cipher but cannot take the retained key service out of its owner.