Struct CredentialEncryption 

pub struct CredentialEncryption { /* private fields */ }

Holds the AES-256-GCM cipher derived from CREDENTIAL_ENCRYPTION_KEY.

Implementations

impl CredentialEncryption

pub fn from_key(key_bytes: &[u8; 32]) -> Self

Create a new instance directly from a 32-byte key.

Useful in tests and contexts where the key is already available without reading an environment variable.

pub fn from_env() -> Result<Option<Self>>

Create a new instance from the CREDENTIAL_ENCRYPTION_KEY env var.

The env var must be either exactly 32 ASCII bytes or a 64-hex-char encoding of a 32-byte key. Returns Ok(None) if the env var is absent so the caller can decide whether to hard-fail or degrade gracefully (single-tenant deployments never set it).

pub fn encrypt(&self, plaintext: &str) -> Result<String>

Encrypt plaintext and return base64(nonce || ciphertext).

pub fn decrypt(&self, encoded: &str) -> Result<String>

Decrypt a value produced by Self::encrypt.

pub fn key_hint(plaintext: &str, n: usize) -> String

Return the last n characters of a key for display as a hint.

Trait Implementations

impl Clone for CredentialEncryption

fn clone(&self) -> CredentialEncryption

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CredentialEncryption

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.