Allow constructing credential stores with supplied keys

crates/walletkit-core/src/authenticator/mod.rs

@@ -1071,7 +1071,7 @@ mod tests {
     async fn test_authenticator(
         server: &mut mockito::Server,
     ) -> (Authenticator, std::path::PathBuf) {
-        use crate::storage::tests_utils::{temp_root_path, InMemoryStorageProvider};
+        use crate::storage::{tests_utils::temp_root_path, StorageKeys, StoragePaths};
         use alloy::primitives::address;
         use world_id_core::primitives::ServiceEndpoint;
         use world_id_proof::artifacts::dummy::DummyZkArtifactSource;
@@ -1096,9 +1096,11 @@ mod tests {
         )
         .expect("valid config");
         let root = temp_root_path();
-        let provider = InMemoryStorageProvider::new(&root);
+        let keys =
+            StorageKeys::from_bytes(vec![0x51; 32]).expect("resolved database key");
         let store =
-            CredentialStore::from_provider(&provider).expect("credential store");
+            CredentialStore::new(Arc::new(StoragePaths::new(&root)), Arc::new(keys))
+                .expect("credential store");
         let authenticator = Authenticator::init_with_config(
             &TEST_SEED,
             config,
@@ -1209,6 +1211,22 @@ mod tests {
         ));
     }
 
+    #[tokio::test]
+    async fn test_init_with_resolved_database_keys() {
+        let mut server = mockito::Server::new_async().await;
+        let (authenticator, root) = test_authenticator(&mut server).await;
+        authenticator
+            .init_storage(1000)
+            .expect("initialize direct-key storage");
+        assert!(authenticator
+            .store
+            .list_credentials(None, 1000)
+            .expect("read storage")
+            .is_empty());
+        drop(authenticator);
+        crate::storage::tests_utils::cleanup_test_storage(&root);
+    }
+
     #[tokio::test]
     async fn test_poll_status_normalizes_request_id() {
         use crate::storage::tests_utils::cleanup_test_storage;
@@ -1489,7 +1507,7 @@ mod tests {
 
         let root = temp_root_path();
         let provider = InMemoryStorageProvider::new(&root);
-        let store = CredentialStore::from_provider(&provider).expect("store");
+        let store = provider.open_store().expect("store");
         store.init(42, 100).expect("init storage");
 
         let artifacts =

crates/walletkit-core/src/authenticator/with_storage.rs

@@ -20,9 +20,11 @@ impl Authenticator {
         Ok(())
     }
 
-    /// Permanently destroys all credential storage data.
+    /// Closes credential storage and attempts to delete its database files.
     ///
-    /// Removes the encryption keys, vault database, and cache database.
+    /// Releases the store's key reference and removes the vault and cache databases
+    /// on a best-effort basis. File deletion failures are logged, not returned.
+    /// The host must separately delete any key envelope it owns.
     /// After this call the authenticator can no longer generate proofs or
     /// access stored credentials. Intended for logout or account deletion.
     ///
@@ -78,7 +80,6 @@ mod tests {
     use crate::storage::tests_utils::{
         cleanup_test_storage, temp_root_path, InMemoryStorageProvider,
     };
-    use crate::storage::CredentialStore;
     use world_id_core::primitives::merkle::MerkleInclusionProof;
     use world_id_core::primitives::AuthenticatorPublicKeySet;
     use world_id_core::FieldElement;
@@ -87,7 +88,7 @@ mod tests {
     fn test_cached_inclusion_round_trip() {
         let root = temp_root_path();
         let provider = InMemoryStorageProvider::new(&root);
-        let store = CredentialStore::from_provider(&provider).expect("store");
+        let store = provider.open_store().expect("store");
         store.init(42, 100).expect("init storage");
 
         let siblings = [FieldElement::from(0u64); TREE_DEPTH];

crates/walletkit-core/src/issuers/recovery_bindings_manager.rs

@@ -398,9 +398,7 @@ mod tests {
     fn create_test_credential_store() -> Arc<CredentialStore> {
         let root = temp_root_path();
         let provider = InMemoryStorageProvider::new(&root);
-        Arc::new(
-            CredentialStore::from_provider(&provider).expect("create credential store"),
-        )
+        Arc::new(provider.open_store().expect("create credential store"))
     }
 
     async fn create_mock_eth_server() -> (ServerGuard, mockito::Mock) {

crates/walletkit-core/src/proof_request_credential_constraints_check.rs

@@ -231,7 +231,7 @@ mod tests {
     ) -> (CredentialStore, std::path::PathBuf) {
         let root = temp_root_path();
         let provider = InMemoryStorageProvider::new(&root);
-        let store = CredentialStore::from_provider(&provider).expect("create store");
+        let store = provider.open_store().expect("create store");
         store.init(42, now).expect("init");
 
         for &id in issuer_ids {
@@ -296,7 +296,7 @@ mod tests {
         let now = 5000;
         let root = temp_root_path();
         let provider = InMemoryStorageProvider::new(&root);
-        let store = CredentialStore::from_provider(&provider).expect("create store");
+        let store = provider.open_store().expect("create store");
         store.init(42, 1000).expect("init");
 
         let cred: Credential = CoreCredential::new()
@@ -634,7 +634,7 @@ mod tests {
     ) -> (CredentialStore, std::path::PathBuf) {
         let root = temp_root_path();
         let provider = InMemoryStorageProvider::new(&root);
-        let store = CredentialStore::from_provider(&provider).expect("create store");
+        let store = provider.open_store().expect("create store");
         store.init(42, now).expect("init");
         let cred: Credential = CoreCredential::new()
             .issuer_schema_id(issuer_id)