Struct LocalManagedSecretStore 

pub struct LocalManagedSecretStore { /* private fields */ }

Version-1 encrypted local Managed-secret backend.

Implementations

impl LocalManagedSecretStore

pub fn initialize( deployment_id: Uuid, identity: ManagedSecretIdentity, ) -> Result<Self, ManagedSecretError>

pub fn open( deployment_id: Uuid, identity: ManagedSecretIdentity, ) -> Result<Self, ManagedSecretError>

pub fn open_verified( deployment_id: Uuid, identity: ManagedSecretIdentity, ) -> Result<Self, ManagedSecretError>

Opens a completely verified store without recovery or another mutation.

pub fn open_selected_read_only( deployment_id: Uuid, identity: ManagedSecretIdentity, ) -> Result<SelectedManagedSecretReader, ManagedSecretError>

Opens the fixed store for selected, read-only resolution without recovering state or authenticating unrelated Secret envelopes.

pub fn verify_all( deployment_id: Uuid, identity: ManagedSecretIdentity, ) -> Result<ManagedSecretVerification, ManagedSecretError>

Completely verifies the fixed active store without repair or mutation.

pub fn rotate_root( deployment_id: Uuid, ) -> Result<RootRotationVerification, RootRotationError>

Stages a complete root-identity rotation at the fixed production paths. The active store and both identity projections are never replaced.

pub fn list(&self) -> Result<Vec<ManagedSecretMetadata>, ManagedSecretError>

Returns safe metadata for every active Managed secret in canonical reference order. No ciphertext or Secret material crosses this seam.

pub fn inspect( &self, reference: &ManagedSecretReference, ) -> Result<ManagedSecretMetadata, ManagedSecretError>

Authenticates one active envelope and returns only its safe metadata.

Trait Implementations

impl Debug for LocalManagedSecretStore

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ManagedSecretBackend for LocalManagedSecretStore

fn create( &self, reference: &ManagedSecretReference, material: &SecretMaterial, ) -> Result<ManagedSecretMetadata, ManagedSecretError>

fn resolve( &self, reference: &ManagedSecretReference, ) -> Result<ResolvedManagedSecret, ManagedSecretError>

fn lookup_active_metadata( &self, reference: &ManagedSecretReference, ) -> Result<ManagedSecretMetadata, ManagedSecretError>

Authenticates the store manifest and looks up safe active metadata without opening the selected Secret envelope.