Restore an R-tree from checkpoint bytes. `kek` controls the expected framing: - `None` → file must be plaintext (starting with `RKSPT\0`). If it starts with `SEGV`, returns `Err(MissingKek)`. - `Some(key)` → encryption is **required**. If the file starts with `SEGV`, it is decrypted. If plaintext, returns `Err(KekRequired)`.
(
bytes: &[u8],
kek: Option<&nodedb_wal::crypto::WalEncryptionKey>,
)
| 174 | /// - `Some(key)` → encryption is **required**. If the file starts with |
| 175 | /// `SEGV`, it is decrypted. If plaintext, returns `Err(KekRequired)`. |
| 176 | pub fn from_checkpoint( |
| 177 | bytes: &[u8], |
| 178 | kek: Option<&nodedb_wal::crypto::WalEncryptionKey>, |
| 179 | ) -> Result<Self, RTreeCheckpointError> { |
| 180 | let is_encrypted = bytes.len() >= 4 && bytes[0..4] == SEGV_MAGIC; |
| 181 | |
| 182 | let inner: Vec<u8>; |
| 183 | let inner_ref: &[u8]; |
| 184 | |
| 185 | if is_encrypted { |
| 186 | if let Some(key) = kek { |
| 187 | inner = decrypt_payload(key, bytes)?; |
| 188 | inner_ref = &inner; |
| 189 | } else { |
| 190 | return Err(RTreeCheckpointError::MissingKek); |
| 191 | } |
| 192 | } else if kek.is_some() { |
| 193 | return Err(RTreeCheckpointError::KekRequired); |
| 194 | } else { |
| 195 | inner_ref = bytes; |
| 196 | } |
| 197 | |
| 198 | Self::decode_plaintext_inner(inner_ref) |
| 199 | } |
| 200 | |
| 201 | fn decode_plaintext_inner(bytes: &[u8]) -> Result<Self, RTreeCheckpointError> { |
| 202 | let header_len = RTREE_RKYV_MAGIC.len() + 1; // magic + version byte |
nothing calls this directly
no test coverage detected