Struct UserKeyManager 

pub struct UserKeyManager { /* private fields */ }

Internal key manager that holds decrypted keys during user session

Security

This struct holds sensitive cryptographic material in memory:

• decrypted_keys: Contains plaintext PrivateKeys (zeroized on drop)
• encryption_key: Password-derived key (zeroized via manual Zeroize impl), None for passwordless users

All sensitive data is zeroized when the struct is dropped.

Implementations

impl UserKeyManager

pub fn new( password: &str, salt: &str, encrypted_keys: Vec<UserKey>, ) -> Result<Self>

Create from user password and encrypted keys

Decrypts all provided keys using the password-derived encryption key.

Arguments

• password - The user’s password
• salt - The password salt (base64 encoded string)
• encrypted_keys - Vec of encrypted UserKey entries from database

Returns

A UserKeyManager with all keys decrypted and ready for use

pub fn new_passwordless(keys: Vec<UserKey>) -> Result<Self>

Create from unencrypted keys (for passwordless users)

Keys are stored and loaded unencrypted for performance.

Arguments

• keys - Vec of UserKey entries with unencrypted keys

Returns

A UserKeyManager with all keys ready for use

pub fn get_signing_key(&self, key_id: &PublicKey) -> Option<&PrivateKey>

Get a decrypted signing key

Arguments

• key_id - The public key identifier

Returns

A reference to the PrivateKey if found

pub fn add_key(&mut self, metadata: UserKey) -> Result<()>

Add a key to the manager from metadata

Handles both encrypted and unencrypted keys based on metadata. Use serialize_keys() to get updated keys for storage.

Arguments

• metadata - The UserKey metadata with storage info

Returns

Ok(()) if the key was successfully added

pub fn serialize_keys(&self) -> Result<Vec<UserKey>>

Serialize all keys for storage

Returns UserKey metadata suitable for storing in the database. Encrypted keys are re-encrypted with the current encryption key. Unencrypted keys are serialized directly.

Keys are returned in sorted order by key_id for deterministic output.

Returns

Vec of UserKey with updated storage, sorted by key_id

pub fn clear(&mut self)

Clear all decrypted keys from memory

Explicitly zeroizes all sensitive key material. Called automatically on Drop via ZeroizeOnDrop, but can be called manually to end session early.

pub fn list_key_ids(&self) -> Vec<PublicKey>

List all key IDs managed by this manager

Returns key IDs sorted by creation timestamp (oldest first) for deterministic behavior.

pub fn get_key_metadata(&self, key_id: &PublicKey) -> Option<&UserKey>

Get metadata for a key

pub fn get_default_key_id(&self) -> Option<PublicKey>

Get the default key ID

Returns the key marked as is_default=true, or falls back to the oldest key by creation timestamp if no default is explicitly set.

Returns

The PublicKey of the default key, or None if there are no keys

Trait Implementations

impl Zeroize for UserKeyManager

fn zeroize(&mut self)

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler.

impl ZeroizeOnDrop for UserKeyManager