Struct SendAccessKey 

pub struct SendAccessKey {
    secret: Zeroizing<[u8; 16]>,
    key: SymmetricCryptoKey,
}

Symmetric key material for an anonymous Send access, derived entirely from the URL fragment — no account key store or logged-in user involved. This is the only Send flow whose key doesn’t come from the user’s key store, hence a standalone type rather than a [bitwarden_crypto::KeyStoreContext] slot.

The key is opaque by design: callers need to use it three ways (hash a password, decrypt a response, decrypt a downloaded blob) but never need to see it.

Fields

secret: Zeroizing<[u8; 16]>

The raw fragment key. Retained because the send password hash is salted with the unstretched key, not with Self::key.

key: SymmetricCryptoKey

The stretched send key that actually encrypts the send’s fields and file blob.

Implementations

impl SendAccessKey

pub fn from_url_b64(key_b64: &str) -> Result<Self, SendAccessKeyError>

Parse the URL-safe-base64 key from a Send URL fragment and stretch it into the send’s symmetric key. Equivalent to the legacy clients’ Utils.fromUrlB64ToArray followed by KeyService.makeSendKey.

The "send"/Some("send") name/info pair must stay in lockstep with Send::derive_shareable_key — that is what bw send create used to encrypt the send, so any divergence makes every send undecryptable through this path. The round-trip test below pins the two together.

pub fn hash_password_b64(&self, password: &str) -> String

PBKDF2-HMAC-SHA256 over password, SEND_ITERATIONS (100,000) rounds, salted with the raw URL key — the password_hash_b64 credential the send-access token grant expects.

Identical recipe to SendAuthType::auth_data, which is what bw send create --password stored on the server. A pinning test asserts the two agree; if they ever diverge, every password-protected receive fails with an opaque server-side rejection.

pub fn decrypt_response( &self, response: SendAccessResponse, ) -> Result<SendAccessView, SendAccessDecryptError>

Decrypt a SendAccessResponse’s encrypted fields into a plaintext SendAccessView.

pub fn decrypt_file_buffer( &self, buffer: &[u8], ) -> Result<Vec<u8>, SendAccessDecryptError>

Decrypt a downloaded file-send blob. The blob is a single whole-buffer [EncString] (not the chunked attachment format), matching the legacy clients’ EncArrayBuffer.fromResponse + EncryptService.decryptFileData.

fn decrypt_optional( &self, value: Option<String>, ) -> Result<Option<String>, SendAccessDecryptError>

Parse and decrypt an optional wire-format [EncString] field. Absent fields stay absent — the caller decides whether a missing field is fatal.