Method open_with_kek

nodedb-array/src/segment/reader.rs:315–342

Open a segment with optional at-rest decryption. - `kek = None` → requires a plaintext (`NDAS`) segment; returns `Err(MissingKek)` if the blob starts with `SEGA`. - `kek = Some(key)` → requires an encrypted (`SEGA`) segment; decrypts the blob, then parses the inner plaintext. Returns `Err(KekRequired)` if the blob starts with `NDAS`.

(
        blob: &[u8],
        kek: Option<&nodedb_wal::crypto::WalEncryptionKey>,
    )

    ///   the blob, then parses the inner plaintext. Returns `Err(KekRequired)`
    ///   if the blob starts with `NDAS`.
    pub fn open_with_kek(
        blob: &[u8],
        kek: Option<&nodedb_wal::crypto::WalEncryptionKey>,
    ) -> ArrayResult<Self> {
        use super::encrypt::{decrypt_segment, detect_encryption};
        let is_encrypted = detect_encryption(blob)?;
        let plaintext = match (is_encrypted, kek) {
            (true, Some(key)) => decrypt_segment(key, blob)?,
            (true, None) => return Err(ArrayError::MissingKek),
            (false, Some(_)) => return Err(ArrayError::KekRequired),
            (false, None) => blob.to_vec(),
        };
        let header = SegmentHeader::decode(&plaintext[..HEADER_SIZE.min(plaintext.len())])?;
        let footer = SegmentFooter::decode(&plaintext)?;
        if header.schema_hash != footer.schema_hash {
            return Err(ArrayError::SegmentCorruption {
                detail: format!(
                    "header/footer schema_hash mismatch: header={:x} footer={:x}",
                    header.schema_hash, footer.schema_hash
                ),
            });
        }
        Ok(Self {
            plaintext,
            header,
            footer,
        })
    }

    /// Borrow a `SegmentReader` over the owned plaintext bytes.
    pub fn reader(&self) -> SegmentReader<'_> {