Method open_with_kek

nodedb-columnar/src/reader/segment_reader.rs:60–74

Open a segment with optional at-rest decryption. - `kek = None` → requires a plaintext (`NDBS`) segment; returns `Err(MissingKek)` if the blob starts with `SEGC`. - `kek = Some(key)` → requires an encrypted (`SEGC`) segment; decrypts the blob, then parses the inner plaintext. Returns `Err(KekRequired)` if the blob starts with `NDBS`.

(
        blob: &[u8],
        kek: Option<&nodedb_wal::crypto::WalEncryptionKey>,
    )

    ///   the blob, then parses the inner plaintext. Returns `Err(KekRequired)`
    ///   if the blob starts with `NDBS`.
    pub fn open_with_kek(
        blob: &[u8],
        kek: Option<&nodedb_wal::crypto::WalEncryptionKey>,
    ) -> Result<Self, ColumnarError> {
        let is_encrypted = blob.len() >= 4 && blob[0..4] == crate::encrypt::SEGC_MAGIC;
        if is_encrypted {
            let key = kek.ok_or(ColumnarError::MissingKek)?;
            let plaintext = crate::encrypt::decrypt_segment(key, blob)?;
            Self::from_plaintext(plaintext)
        } else if kek.is_some() {
            Err(ColumnarError::KekRequired)
        } else {
            Self::from_plaintext(blob.to_vec())
        }
    }

    /// Borrow a `SegmentReader` over the owned plaintext bytes.
    pub fn reader(&self) -> SegmentReader<'_> {