Struct MemoryKeyManagementClient 

pub struct MemoryKeyManagementClient { /* private fields */ }

In-memory KMS for testing. Not suitable for production use.

use iceberg::encryption::KeyManagementClient;
use iceberg::encryption::kms::MemoryKeyManagementClient;

let kms = MemoryKeyManagementClient::new();
kms.add_master_key("my-master-key")?;

let dek = vec![0u8; 16];
let wrapped = kms.wrap_key(&dek, "my-master-key").await?;
let unwrapped = kms.unwrap_key(&wrapped, "my-master-key").await?;
assert_eq!(dek.as_slice(), unwrapped.as_bytes());

Implementations

impl MemoryKeyManagementClient

pub fn new() -> Self

Creates a new in-memory KMS with 128-bit AES keys.

pub fn with_master_key_size(master_key_size: AesKeySize) -> Self

Creates a new in-memory KMS with the specified master key size.

pub fn add_master_key(&self, key_id: impl Into<String>) -> Result<()>

Adds a randomly generated master key with the given ID.

pub fn add_master_key_bytes( &self, key_id: impl Into<String>, key_bytes: SensitiveBytes, ) -> Result<()>

Adds a master key with explicit key bytes.

Use this to seed the KMS with known key material, e.g. for cross-language integration tests where both Java and Rust must share the same master key bytes.

pub fn key_count(&self) -> usize

Number of master keys stored.

pub fn has_key(&self, key_id: &str) -> bool

Whether a master key with the given ID exists.

Trait Implementations

impl Clone for MemoryKeyManagementClient

fn clone(&self) -> MemoryKeyManagementClient

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MemoryKeyManagementClient

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for MemoryKeyManagementClient

fn default() -> MemoryKeyManagementClient

Returns the “default value” for a type.

impl KeyManagementClient for MemoryKeyManagementClient

fn wrap_key<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, key: &'life1 [u8], wrapping_key_id: &'life2 str, ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Wrap (encrypt) a key using a wrapping key managed by the KMS.

fn unwrap_key<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, wrapped_key: &'life1 [u8], wrapping_key_id: &'life2 str, ) -> Pin<Box<dyn Future<Output = Result<SensitiveBytes>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Unwrap (decrypt) a previously wrapped key.

fn supports_key_generation(&self) -> bool

Whether this KMS supports server-side key generation.

fn generate_key<'life0, 'life1, 'async_trait>( &'life0 self, _wrapping_key_id: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<GeneratedKey>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Generate a new key and wrap it atomically on the server side.