feat: block-level encryption at rest#71

Merged

polaz merged 26 commits into

mainfrom

feat/#20-feat-block-level-encryption-at-rest

Mar 22, 2026

Commits on Mar 22, 2026

feat: block-level encryption at rest
polaz
committed
fix(encryption): add missing doc sections and fix config field docs
polaz
committed
fix(encryption): account for encryption overhead in block size caps and thread through scanner
polaz
committed
fix(encryption): move ENCRYPTION_OVERHEAD const to module level
polaz
committed
feat(encryption): add max_overhead() to EncryptionProvider trait
polaz
committed
docs(vlog): acknowledge key range leak in unencrypted blob metadata
polaz
committed
test(encryption): add tamper detection integration test
polaz
committed
fix(encryption): add missing encryption param in metrics-gated test paths
polaz
committed
docs(encryption): clarify that encryption state is caller-determined
polaz
committed
refactor(encryption): simplify encrypt/decrypt buffer ownership in Block I/O
polaz
committed
fix(encryption): add debug_assert for enc_overhead u32 addition safety
polaz
committed
fix(encryption): use clippy-approved checked conversion in debug_assert
polaz
committed
fix(encryption): validate encrypted payload length fits u32 before cast
polaz
committed
docs(encryption): improve from_reader doc on encryption mismatch behavior
polaz
committed
fix(encryption): validate write-path payload against read-path size cap
polaz
committed
fix(encryption): align write-path size cap with read-path and restrict Config field visibility
polaz
committed
fix(encryption): validate payload size in u64 before u32 cast in write_into
polaz
committed
refactor(encryption): use if-let binding to avoid expect() in from_file decrypt path
polaz
committed
docs(encryption): clarify blob file and KV separation encryption gaps
polaz
committed
fix(encryption): cap write-path max_payload at u32::MAX for safe cast
polaz
committed
refactor(encryption): unify from_reader size check to u64 arithmetic
polaz
committed
refactor(encryption): change max_overhead() return type from usize to u32
polaz
committed
fix(encryption): resolve clippy cast warnings for max_overhead u32 return
polaz
committed
docs(encryption): qualify from_reader doc with authenticated provider caveat
polaz
committed
fix(encryption): use MAX_SEQNO instead of u64::MAX in integration tests
polaz
committed
fix(encryption): replace .expect() with ? in unit tests for clippy compliance
polaz
committed