Struct PasswordBackend 

pub struct PasswordBackend { /* private fields */ }

Password-based vault authentication.

Uses Argon2id to derive a KEK from password bytes, then wraps/unwraps the master key via AES-256-GCM in a .password-wrap blob.

Password bytes must be injected via with_password() before calling unlock() or enroll().

Implementations

impl PasswordBackend

pub fn new() -> Self

pub fn with_password(self, password: SecureVec) -> Self

Inject password bytes for the next unlock/enroll operation.

The password is stored in a SecureVec (mlock’d, zeroize-on-drop).

pub fn set_password(&mut self, password: SecureVec)

Set password bytes on an existing instance.

Trait Implementations

impl Default for PasswordBackend

fn default() -> Self

Returns the “default value” for a type.

impl VaultAuthBackend for PasswordBackend

fn factor_id(&self) -> AuthFactorId

Which auth factor this backend provides.

fn name(&self) -> &str

Human-readable name for audit logs and overlay display.

fn backend_id(&self) -> &str

Short identifier for IPC messages and config.

fn is_enrolled(&self, profile: &TrustProfileName, config_dir: &Path) -> bool

Check whether this backend has a valid enrollment for the profile.

fn can_unlock<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, profile: &'life1 TrustProfileName, config_dir: &'life2 Path, ) -> Pin<Box<dyn Future<Output = bool> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Check whether this backend can currently perform an unlock. Must be fast (< 100ms).

fn requires_interaction(&self) -> AuthInteraction

What kind of user interaction this backend requires.

fn unlock<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, profile: &'life1 TrustProfileName, config_dir: &'life2 Path, salt: &'life3 [u8], ) -> Pin<Box<dyn Future<Output = Result<UnlockOutcome, AuthError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Attempt to derive/unwrap the master key for a profile.

fn enroll<'life0, 'life1, 'life2, 'life3, 'life4, 'async_trait>( &'life0 self, profile: &'life1 TrustProfileName, master_key: &'life2 SecureBytes, config_dir: &'life3 Path, salt: &'life4 [u8], _selected_key_index: Option<usize>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, 'life4: 'async_trait,

Enroll this backend for a profile. Requires the master key.

fn revoke<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, profile: &'life1 TrustProfileName, config_dir: &'life2 Path, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Remove enrollment for this backend.