Struct KeyProviderMacKeys 

pub struct KeyProviderMacKeys { /* private fields */ }

A fixed set of HMAC keys, loaded from a KeyProvider by string id.

Every key carries the one algorithm the set was loaded for. Rotation is a new set with the new key id listed next to the old one.

Implementations

impl KeyProviderMacKeys

pub async fn load<P, I, S>( provider: &P, alg: CoseAlg, key_ids: I, ) -> Result<KeyProviderMacKeys, CratestackError>

where P: KeyProvider + ?Sized, I: IntoIterator<Item = S>, S: Into<String>,

Resolve every id in key_ids through provider, for alg (CoseAlg::Hmac256_64 or CoseAlg::Hmac256_256).

A configuration step, so it fails loudly: with CratestackError::Validation for a non-MAC alg, an empty or repeated id list, a secret shorter than 32 bytes, or two ids that resolve to the same secret (one key under two names is a misconfiguration waiting to happen, and the two would share a kid); with the provider’s own error when it cannot resolve an id.

pub fn alg(&self) -> CoseAlg

The algorithm every key in the set verifies.

pub fn kids(&self) -> impl Iterator<Item = (&str, [u8; 8])>

The configured key ids with the kid each one travels as, for logs and for mapping a verified message back to its configured name.

pub fn signer(&self, key_id: &str) -> Option<HmacSigner>

A signer for the configured key id key_id, or None if it was not loaded.

Trait Implementations

impl Clone for KeyProviderMacKeys

fn clone(&self) -> KeyProviderMacKeys

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl CoseVerifierResolver for KeyProviderMacKeys

Every loaded key whose kid and algorithm match; an unknown kid is Ok(vec![]), as the resolver contract requires. Never Err: the secrets were resolved at construction, so there is no backend left to fail.

fn resolve<'life0, 'life1, 'async_trait>( &'life0 self, kid: &'life1 [u8], alg: CoseAlg, ) -> Pin<Box<dyn Future<Output = Result<Vec<CoseVerifyKey>, CratestackError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, KeyProviderMacKeys: 'async_trait,

Every key whose kid is kid and which verifies alg; Ok(vec![]) if there is none. Err only for a backend failure.

impl Debug for KeyProviderMacKeys

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.