Function encrypt_segment_bytes

nodedb/src/storage/segment.rs:191–215

Encrypt segment data into a self-describing byte envelope (no file I/O). Equivalent to `write_encrypted_segment` but returns the full envelope bytes instead of writing to disk. Used by object-store upload paths where the caller manages persistence.

(
    data: &[u8],
    footer: &SegmentFooter,
    key: Option<&nodedb_wal::crypto::WalEncryptionKey>,
)

/// bytes instead of writing to disk. Used by object-store upload paths where
/// the caller manages persistence.
pub fn encrypt_segment_bytes(
    data: &[u8],
    footer: &SegmentFooter,
    key: Option<&nodedb_wal::crypto::WalEncryptionKey>,
) -> crate::Result<Vec<u8>> {
    let mut out = Vec::new();
    if let Some(key) = key {
        let fresh_key = key.with_fresh_epoch().map_err(crate::Error::Wal)?;
        let epoch = *fresh_key.epoch();
        let preamble = SegmentPreamble::new_seg(epoch);
        let preamble_bytes = preamble.to_bytes();
        let ciphertext = fresh_key
            .encrypt_aad(footer.min_lsn.as_u64(), &preamble_bytes, data)
            .map_err(|e| crate::Error::Storage {
                engine: "segment".into(),
                detail: format!("segment encryption failed: {e}"),
            })?;
        out.extend_from_slice(&preamble_bytes);
        out.extend_from_slice(&ciphertext);
    } else {
        out.extend_from_slice(data);
    }
    out.extend_from_slice(&footer.to_bytes());
    Ok(out)
}

/// Decrypt a segment byte envelope (no file I/O).
///