Struct StoreKeychain 

pub struct StoreKeychain { /* private fields */ }

One store’s entries kept on this device only: its device id, store and member keys, provider credentials, the invite code of a join under way, the record of a restore or a replacement under way and the app’s host secrets (§12.4, §13.1, §13.2, §19.3). They never leave the device, so deleting them reaches no other device of the person. Every read, write and deletion here uses the device-only scope; the person’s entries belong to PersonEntries.

Implementations

impl StoreKeychain

pub fn new(keychain: Arc<Keychain>, store: StoreId) -> Self

Bind the injected keychain to one store without reading a key (E1).

pub fn device_id(&self) -> Result<Option<DeviceId>, KeyError>

The installation id, in a device-only entry a backup doesn’t carry to another device (§19.3). Reading it does not unlock any member or store key.

pub fn set_device_id(&self, device: DeviceId) -> Result<(), KeyError>

Keep the installation id in this device’s non-restored keychain scope.

pub fn delete_device_id(&self) -> Result<(), KeyError>

Remove an unpublished installation’s entry after creation failed.

pub fn storage_credentials(&self) -> Result<Option<SecretBytes>, KeyError>

Provider-encoded credentials. Public storage settings never contain them.

pub fn set_storage_credentials( &self, bytes: &SecretBytes, ) -> Result<(), KeyError>

Commit provider-encoded credentials in this device’s keychain scope.

pub fn delete_storage_credentials(&self) -> Result<(), KeyError>

Remove this device’s provider credentials; an absent entry succeeds.

pub fn setup_credentials(&self) -> Result<Option<SecretBytes>, KeyError>

The credentials a storage setup under way connects with, kept apart from the committed ones until it finishes, so undoing it leaves those as they were (§11.6, §20.8).

pub fn set_setup_credentials(&self, bytes: &SecretBytes) -> Result<(), KeyError>

Keep the credentials of a storage setup about to write to storage.

pub fn delete_setup_credentials(&self) -> Result<(), KeyError>

Remove a finished or undone setup’s credentials; an absent entry succeeds.

pub fn replacing_access_key(&self) -> Result<Option<SecretBytes>, KeyError>

The S3 key replacing this member’s own, kept apart from the committed credentials until history records it as the member’s key, so custody never connects with a key history doesn’t name (§14.3).

pub fn set_replacing_access_key( &self, bytes: &SecretBytes, ) -> Result<(), KeyError>

Keep a replacement S3 key apart until history records it.

pub fn delete_replacing_access_key(&self) -> Result<(), KeyError>

Remove a replacement key once custody connects with it or the replacement ended unrecorded; an absent entry succeeds.

pub fn invite_code(&self) -> Result<Option<SecretText>, KeyError>

The invite code of a join under way for this store on this device: its saved request is encrypted with the code’s secret, so resuming needs the code (§13.2). It is never synced.

pub fn set_invite_code(&self, code: &SecretText) -> Result<(), KeyError>

Keep a join’s invite code until the join ends.

pub fn delete_invite_code(&self) -> Result<(), KeyError>

Remove a join’s invite code once the join has ended; an absent entry succeeds.

pub fn restore_record(&self) -> Result<Option<(SecretText, String)>, KeyError>

The record of a restore under way for this store on this device: the restore code it loads with and the name it registers the device under. A restore past its registration finishes from it, so the app can resume it without the code (§13.1). It is never synced.

pub fn set_restore_record( &self, code: &SecretText, device_name: &str, ) -> Result<(), KeyError>

Keep a restore’s record from before it registers the device until the restore ends: the code, which holds no NUL, then a NUL, then the device’s name.

pub fn delete_restore_record(&self) -> Result<(), KeyError>

Remove a restore’s record once the restore has ended; an absent entry succeeds.

pub fn replacement_record( &self, ) -> Result<Option<(SecretText, String)>, KeyError>

What a replacement of this device’s installation under way keeps to finish (§19.3): the restore code it loads with and the name it registers the fresh device under. A replacement past its record resumes from it with nothing from the app. It is never synced.

pub fn set_replacement_record( &self, code: &SecretText, device_name: &str, ) -> Result<(), KeyError>

Keep a replacement’s code and device name from before it registers the fresh device until it is published or ends, as a restore’s record is kept.

pub fn delete_replacement_record(&self) -> Result<(), KeyError>

Remove a replacement’s record once it has been published or has ended; an absent entry succeeds.

pub fn delete_device_entries(&self) -> Result<(), KeyError>

Remove this device’s entries for the store, including all recorded host secrets, without opening the database or decoding the values. Delete listed secrets before the list, then coven’s other entries. The person’s restore code and S3 key stay: they serve the person’s next devices (§13.1). The caller holds the store’s deletion lock; repeating after a failure is safe, including absent listed entries.

pub fn set_host_secret(&self, name: &str, value: &str) -> Result<(), KeyError>

Records the name in a device-only keychain list before writing the value to its own entry. Arbitrary names are encoded into native account names; each value retains the platform’s per-entry size limit. A failed write may leave an extra name, so deletion can always find every saved secret. The caller holds the store’s writer lock; this capability serializes updates.

pub fn host_secret(&self, name: &str) -> Result<Option<String>, KeyError>

The app secret, or None if it was never set (E11).

pub fn delete_host_secret(&self, name: &str) -> Result<(), KeyError>

Removes the secret before its recorded name (E11); absent entries succeed. Failure can leave an extra name; retrying is safe. The caller holds the store’s writer lock.

Trait Implementations

impl Debug for StoreKeychain

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.