Skip to main content

StoreInstance

confium_store::backend

Trait StoreInstance 

Source 
pub trait StoreInstance: Send + Sync {
    // Required methods
    fn put_secret(
        &mut self,
        module: &str,
        app: &str,
        key_id: &str,
        key: *mut c_void,
    ) -> Result<()>;
    fn get_secret(
        &self,
        module: &str,
        app: &str,
        key_id: &str,
    ) -> Result<*mut c_void>;
    fn put_public(
        &mut self,
        module: &str,
        app: &str,
        identity: &str,
        key: *mut c_void,
        sig: &[u8],
    ) -> Result<()>;
    fn get_public(
        &self,
        module: &str,
        app: &str,
        identity: &str,
    ) -> Result<(*mut c_void, Vec<u8>)>;
    fn enumerate(
        &self,
        module: &str,
        app: &str,
        compartment: Compartment,
    ) -> Result<Vec<(*mut c_void, String)>>;

    // Provided method
    fn sign(
        &self,
        _module: &str,
        _app: &str,
        _key_id: &str,
        _algorithm: &str,
        _message: &[u8],
    ) -> Result<Vec<u8>> { ... }
}
Expand description

One open keystore connection. All mutation flows through &mut self; reads take &self so concurrent get/enumerate is sound when the underlying backend allows it.

Key material is opaque to the Store: it carries the key as a *mut c_void (the same handle the Engine’s keyfmt interface produces). Ownership of that handle stays with the caller that produced it — backends store the raw pointer and return it verbatim on get. Lifetime discipline is the caller’s responsibility, matching the rest of the Confium FFI.

Required Methods§

Source

fn put_secret( &mut self, module: &str, app: &str, key_id: &str, key: *mut c_void, ) -> Result<()>

Insert a secret key into the private compartment, indexed by key_id.

Source

fn get_secret( &self, module: &str, app: &str, key_id: &str, ) -> Result<*mut c_void>

Fetch a secret key from the private compartment by key_id. Returns crate::error::Error::ValueNotFound if absent.

Source

fn put_public( &mut self, module: &str, app: &str, identity: &str, key: *mut c_void, sig: &[u8], ) -> Result<()>

Insert a public key into the public compartment, indexed by identity, with a detached signature over the identity.

Source

fn get_public( &self, module: &str, app: &str, identity: &str, ) -> Result<(*mut c_void, Vec<u8>)>

Fetch a public key from the public compartment by identity. Returns the key handle and the stored signature bytes.

Source

fn enumerate( &self, module: &str, app: &str, compartment: Compartment, ) -> Result<Vec<(*mut c_void, String)>>

Enumerate entries in one compartment of one (module, app) scope. Each entry is the opaque key handle paired with its index string (key_id for private, canonical identity for public).

Provided Methods§

Source

fn sign( &self, _module: &str, _app: &str, _key_id: &str, _algorithm: &str, _message: &[u8], ) -> Result<Vec<u8>>

Sign message with the remote key named by key_id, using the provider-specific algorithm name (e.g. "ECDSA_SHA_256" on AWS KMS, "EC_SIGN_P256_SHA256" on Cloud KMS, "ES256" on Key Vault). Input is the raw message — providers that sign digests hash it themselves or the backend does. This is the remote-sign half of the sign-with-handle contract: backends that hold keys out-of-process (cloud KMS, PKCS#11, TPM) implement it; local backends keep the default.

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§