Method from_file

nodedb-wal/src/crypto.rs:157–171

Load key from a file (must contain exactly 32 bytes). Before reading, the file is checked for: - No symlinks (TOCTOU / path-traversal risk). - Regular file (not a device, FIFO, or directory). - Unix: no group or world access bits (`mode & 0o077 == 0`). - Unix: file owner matches the current process UID.

(path: &std::path::Path)

    /// - Unix: no group or world access bits (`mode & 0o077 == 0`).
    /// - Unix: file owner matches the current process UID.
    pub fn from_file(path: &std::path::Path) -> Result<Self> {
        check_key_file_wal(path)?;
        let key_bytes = std::fs::read(path).map_err(WalError::Io)?;
        if key_bytes.len() != 32 {
            return Err(WalError::EncryptionError {
                detail: format!(
                    "encryption key must be exactly 32 bytes, got {}",
                    key_bytes.len()
                ),
            });
        }
        let mut key_arr = zeroize::Zeroizing::new([0u8; 32]);
        key_arr.copy_from_slice(&key_bytes);
        Self::from_bytes(&key_arr)
    }

    /// Encrypt a payload. Returns ciphertext + auth_tag (16 bytes appended).
    ///