reEncryptObjectStorage
Este conteúdo não está disponível em sua língua ainda.
reEncryptObjectStorage(
backend,options):Promise<ReEncryptResult>
Defined in: src/persistence/object-storage/reEncryptionSweep.ts:247
Re-encrypt every body under keyPrefix to the active key in keyring.
Idempotent: a body already at the active version is skipped without a PUT. Safe to interrupt and resume — there’s no progress state on disk; a resumed sweep simply re-checks every key and re-skips the ones already at the active version.
Per-object failures (decrypt errors, backend faults) are NOT swallowed — they bubble up immediately and stop the sweep. Run the sweep again after fixing the underlying issue; already-rewritten objects are idempotent on the next pass.
const result = await reEncryptObjectStorage(backend, {
keyPrefix: ‘snapshots/’,
keyring: { active: { version: 2, key: newKey },
retired: [{ version: 1, key: oldKey }] },
info: ‘acme/prod/snapshot/v1’,
onProgress: (e) => process.stderr.write(${e.index}/${e.total} ${e.key}\n),
});
console.log(re-encrypted ${result.rewrote} of ${result.scanned});
Rotating the HKDF context instead of (or alongside) the key adds
newInfo; the sweep then decrypts under info and writes under
newInfo:
await reEncryptObjectStorage(backend, { keyPrefix: ‘snapshots/’, keyring, info: ‘actor-ts/snapshot/v1’, // the shared legacy context newInfo: ‘acme/prod/snapshot/v1’, // per-environment from now on });
Parameters
Section titled “Parameters”backend
Section titled “backend”options
Section titled “options”Returns
Section titled “Returns”Promise<ReEncryptResult>