Struct HmacEnvelope 

pub struct HmacEnvelope<K: KeyProvider> { /* private fields */ }

HMAC-SHA-256 backed envelope. Sealed messages are self-describing CBOR maps: signature recipients can decode the envelope, fetch the key by kid, and verify without out-of-band coordination.

Implementations

impl<K: KeyProvider> HmacEnvelope<K>

pub fn new(keys: Arc<K>, signing_kid: impl Into<String>) -> Self

pub fn with_clock_skew_secs(self, secs: i64) -> Self

pub fn with_nonce_store(self, store: Arc<dyn NonceStore>) -> Self

Attach a nonce store so open rejects replays. Without this, the envelope is only protected by the clock-skew window — an attacker who captured a sealed message can replay it inside that window.

pub async fn seal(&self, payload: Value) -> Result<SealedEnvelope, CoolError>

Seal a request body. The returned bytes are a CBOR-encoded SealedEnvelope payload — the sender wraps these in their codec of choice on the way out.

pub async fn open(&self, envelope: &SealedEnvelope) -> Result<Value, CoolError>

Verify a sealed envelope. Returns the body on success. Constant- time MAC compare; clock-skew window enforced; envelope kid is resolved through the configured provider so callers can rotate keys without changing the recipient.

Trait Implementations

impl<K: Clone + KeyProvider> Clone for HmacEnvelope<K>

fn clone(&self) -> HmacEnvelope<K>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.