(b64: &str)
| 213 | } |
| 214 | |
| 215 | fn decode_32_byte_b64(b64: &str) -> Result<Zeroizing<[u8; 32]>> { |
| 216 | let bytes = base64::engine::general_purpose::STANDARD |
| 217 | .decode(b64) |
| 218 | .map_err(|e| crate::Error::Encryption { |
| 219 | detail: format!("Vault plaintext base64 decode failed: {e}"), |
| 220 | })?; |
| 221 | if bytes.len() != 32 { |
| 222 | return Err(crate::Error::Encryption { |
| 223 | detail: format!( |
| 224 | "Vault plaintext must be 32 bytes after base64 decode, got {}", |
| 225 | bytes.len() |
| 226 | ), |
| 227 | }); |
| 228 | } |
| 229 | let mut key = Zeroizing::new([0u8; 32]); |
| 230 | key.copy_from_slice(&bytes); |
| 231 | Ok(key) |
| 232 | } |
| 233 | |
| 234 | #[cfg(test)] |
| 235 | mod tests { |
no test coverage detected