Struct Unlocked 

pub struct Unlocked {
    pub user_key: SymmetricCryptoKey,
    pub private_key: Option<RsaPrivateKey>,
    pub org_keys: HashMap<String, SymmetricCryptoKey>,
    pub failed_orgs: Vec<String>,
    pub user_key_fingerprint: String,
}

An unlocked account’s keys: the user key every personal cipher inherits, the account private key, and any organization keys the profile carries.

The caller (the workspace’s VaultSession) owns these and is responsible for locking them; this type is the plain hand-off from the unlock path.

Fields

user_key: SymmetricCryptoKey

private_key: Option<RsaPrivateKey>

org_keys: HashMap<String, SymmetricCryptoKey>

failed_orgs: Vec<String>

Organizations whose key the profile carries but this unlock could not unwrap. A cipher in one of them fails with VaultError::MissingKey rather than being encrypted or decrypted with the wrong key.

user_key_fingerprint: String

SHA-256 of the wrapped user key this unlock used, so a later sync can prove the account’s keys did not rotate while the session was open.

Implementations

impl Unlocked

fn base_key<'a>( &'a self, cipher: &Value, ) -> Result<&'a SymmetricCryptoKey, VaultError>

The key a cipher inherits: its organization’s when it carries one, else the user key. A personal cipher is the common case; an organization cipher whose key was not unlocked is refused rather than silently falling back to the user key.

pub fn decrypt_item_str( &self, cipher: &Value, enc: &str, ) -> Result<String, VaultError>

Decrypt one of a cipher’s encrypted fields with the cipher’s own key.

pub fn encrypt_item_str( &self, cipher: &Value, value: &str, ) -> Result<String, VaultError>

Encrypt one of a cipher’s fields with the cipher’s own key.

pub fn decrypt_user_str(&self, enc: &str) -> Result<String>

Decrypt a folder name or another value encrypted with the user key.

pub fn encrypt_user_str(&self, value: &str) -> Result<String>

Encrypt a folder name or another value with the user key.

pub fn prepare_attachment( &self, cipher: &Value, name: &str, data: &[u8], ) -> Result<(String, String, Vec<u8>), VaultError>

Prepare one attachment: a fresh key wrapped with the item key, the encrypted file name, and the 0x02 blob the server stores.

pub fn open_attachment( &self, cipher: &Value, wrapped_key: &str, blob: &[u8], ) -> Result<Vec<u8>, VaultError>

Open one downloaded attachment: unwrap its key with the item key and decrypt the 0x02 blob.