Module at_rest

Structs§

TokenEncryptionKey: 32-byte ChaCha20-Poly1305 key. Wiped from memory on drop.

decrypt_provider_token: Decrypt a provider refresh token that was encrypted by encrypt_provider_token.
decrypt_provider_token_bound: Decrypt a stored provider refresh token, verifying aad for the current "enc2:" format.
encrypt_provider_token: Encrypt a provider refresh token in the legacy unbound format.
encrypt_provider_token_bound: Encrypt a provider refresh token with AAD binding it to its row identity.
maybe_decrypt: Attempt to decrypt stored if it carries an encryption sentinel. Equivalent to maybe_decrypt_bound with empty AAD.
maybe_decrypt_bound: Attempt to decrypt stored if it carries the "enc2:" or "enc:" prefix, verifying aad for the bound format. If no key is provided but the value is encrypted, return an error — the caller should not silently return ciphertext as the token value.
maybe_encrypt: Attempt to encrypt value in the legacy unbound format if a key is available. If key is None the value is stored as plaintext. New write paths should use maybe_encrypt_bound.
maybe_encrypt_bound: Attempt to encrypt value with row-identity AAD if a key is available, returning the stored representation. If key is None the value is stored as plaintext.