Helper: grant operations on an HSM key

Converts an `Option<String>` containing an empty or whitespace-only value to `None`. This guards against UI form fields that produce `""` when cleare

Filename-safe slug for output files (e.g. `"benchmarks_kmip-json.json"`).

Creates a test application instance using an explicit `ClapConfig`. This is useful for end-to-end KMIP policy tests that need to tune allowlists and

Serialize the data to encrypt to bytes

This operation requests the server to generate a new public/private key pair and register the two corresponding new Managed Cryptographic Object The r

Export a PQC certificate and parse it with `x509_parser`. Returns (Object, Attributes, DER bytes).

Finalize key creation: create the key pair in the KMS and transition from `Pending` to `Persisted`.

Get a slot If a slot has already been opened, returns the opened slot. To close a slot before re-opening it with another password, call `close_slot()`

Returns a reader connection using round-robin distribution.

Create a criterion benchmark group and (re)start its per-group timer.

Self-signed PQC certificate creation + basic link verification.

This operation requests one or more attributes associated with a Managed Object. The object is specified by its Unique Identifier, and the attributes

Returns the currently configured vendor identification string.

Convert a KMIP Public key to openssl `PKey<Public>` The supported `KeyFormatType` are: PKCS1 PKCS8: actually a SPKI DER (RFC 5480) `TransparentRSAPub

Load the configuration from a toml file. # Errors Return an error if the configuration file is not found or if the file is not a valid toml file.

Return a mutable borrow to the Object Do not use this to set a new object or make sure you clear the cached unwrapped object

This method updates the specified object identified by its `uid` in the database. If the `tags` parameter is `None`, the tags will not be updated. #

Perform an atomic set of operations on the database. This function executes a series of operations (typically in a transaction) atomically. It assume

This operation requests the server to generate a new symmetric key or generate Secret Data as a Managed Cryptographic Object. The request contains inf

Generate a random key for the given symmetric cipher.

Send a KMIP request to the server and return the response

Serialize a `RequestMessage` to the wire body for this transport.

Set the wrapping key id This is the key that will be used to wrap the key on creation The wrapping key id is stored as a vendor attribute # Arguments

This operation requests the server to perform a signature operation on the provided data using a Managed Object specified by its Unique Identifier. Th

Helper: decode a base64url (no-padding) string to bytes, returning `CryptoApiError::BadRequest` with a descriptive message on failure.

Create an AES-256 symmetric key and return its UID.

Decrypt the ciphertext using the given symmetric cipher. Return the decrypted plaintext. The tag is required for AEAD ciphers (`AES GCN`, `ChaCha20 P

This operation is used to indicate to the server that the key material for the specified Managed Object SHALL be destroyed or rendered inaccessible. T

Encrypt the plaintext using the given symmetric cipher. Return the ciphertext and the tag. For XTS mode, the nonce is the tweak, the aad is ignored, a

This operation requests the server to Import a Managed Object specified by its Unique Identifier. The request specifies the object being imported and

Helper: revoke operations on an HSM key

Helper: certify with `generate_key_pair=true`, optionally CA-signed.

Check that bits set in `mask` are only bits set in `flags`. If any bit set in `mask` is not set in `flags`, raise an error. If `mask` is None, raise

Cleanup helper: revoke + destroy a key pair (best-effort).

HTTP `Content-Type` header value for this transport.

Create the given Object in the database. A new UUID will be created if none is supplier. This method will fail if an ` uid ` is supplied and an object

Create an AES-256 key and return its UID.

A minimal OAuth2 config that refers to a reachable-but-wrong token URL (127.0.0.1:1) so that the token-exchange step always fails quickly without hang

Generate RSA key pair and return the private and public key handles in this order If exportable is set to `false`, the `sensitive` flag is set to tru

Retrieve the object handle for a given object ID from the HSM. This function attempts to locate the handle of an object (such as a key) in the HSM by

Return the object store for the given `uid` This function retrieves the appropriate object store based on the prefix of the `uid`. Prefix matching u

Initialize test environment once before any tests run

This operation is used by the client to interrogate the server to determine its capabilities and/or protocol mechanisms. The Query operation SHOULD be

Start (or reuse) the shared in-process KMS test server and return an owner `KmsClient`. A temporary Tokio runtime is used only for the async setup; i