@Override
  public LogicalResponse write(final String path, final Map<String, Object> nameValuePairs)
      throws VaultException {
    if (path.startsWith(encPathPrefix)) {
      String keyName = path.substring(encPathPrefix.length());
      if (!aeads.containsKey(keyName)) {
        throw new VaultException("Key not found: " + keyName);
      }
      Aead aead = aeads.get(keyName);
      byte[] context = Base64.getDecoder().decode((String) nameValuePairs.get("context"));
      byte[] plaintext = Base64.getDecoder().decode((String) nameValuePairs.get("plaintext"));
      byte[] ciphertext;
      try {
        ciphertext = aead.encrypt(plaintext, context);
      } catch (GeneralSecurityException e) {
        throw new VaultException(e.getMessage());
      }
      RestResponse restResp = new RestResponse(200, null, null);
      LogicalResponse resp = new LogicalResponse(restResp, 0, null);
      resp.getData().put("ciphertext", new String(Base64.getEncoder().encode(ciphertext)));
      return resp;
    }
    if (path.startsWith(decPathPrefix)) {
      String keyName = path.substring(decPathPrefix.length());
      if (!aeads.containsKey(keyName)) {
        throw new VaultException("Key not found: " + keyName);
      }
      Aead aead = aeads.get(keyName);
      byte[] context = Base64.getDecoder().decode((String) nameValuePairs.get("context"));
      String ciphertext = (String) nameValuePairs.get("ciphertext");
      byte[] ciphertextBytes = Base64.getDecoder().decode(ciphertext);
      byte[] plaintext;
      try {
        plaintext = aead.decrypt(ciphertextBytes, context);
      } catch (GeneralSecurityException e) {
        throw new VaultException(e.getMessage());
      }
      RestResponse restResp = new RestResponse(200, null, null);
      LogicalResponse resp = new LogicalResponse(restResp, 0, null);
      resp.getData().put("plaintext", Base64.getEncoder().encodeToString(plaintext));
      return resp;
    }
    throw new VaultException("Unsupported path: " + path);
  }
A partial, fake implementation of Hashicorp Vault that only supports encrypt and decrypt.

<p>It creates a new AEAD for every instance. It can only encrypt and decrypt keys for the URI
specified in the config.
java_src/src/main/java/com/google/crypto/tink/integration/hcvault/FakeHcVault.java