Method streamDecrypted

src/FileRise/Support/CryptoAtRest.php:354–424

* Stream-decrypt an encrypted file into an output stream resource. * * @param resource $out */

(string $path, $out)

     * @param resource $out
     */
    public static function streamDecrypted(string $path, $out): void
    {
        if (!self::isAvailable()) {
            throw new \RuntimeException('libsodium secretstream is not available on this PHP build.');
        }
        $key = self::requireMasterKey();

        $in = @fopen($path, 'rb');
        if ($in === false) {
            throw new \RuntimeException('Unable to open encrypted file.');
        }

        try {
            $hdr = fread($in, self::HEADER_LEN);
            if (!is_string($hdr) || strlen($hdr) !== self::HEADER_LEN) {
                throw new \RuntimeException('Invalid encrypted file header.');
            }
            if (substr($hdr, 0, 4) !== self::MAGIC || ord($hdr[4]) !== self::VERSION) {
                throw new \RuntimeException('Invalid encrypted file magic/version.');
            }

            $ssHeader = substr($hdr, 14, 24);
            $state = sodium_crypto_secretstream_xchacha20poly1305_init_pull($ssHeader, $key);

            $written = 0;

            while (!feof($in)) {
                $lenBytes = fread($in, 4);
                if ($lenBytes === '' || $lenBytes === false) {
                    break;
                }
                if (strlen($lenBytes) !== 4) {
                    throw new \RuntimeException('Corrupt encrypted file framing.');
                }
                $u = unpack('Nlen', $lenBytes);
                $len = (int)($u['len'] ?? 0);
                if ($len <= 0 || $len > self::MAX_FRAME_BYTES) {
                    throw new \RuntimeException('Invalid encrypted frame length.');
                }

                $cipher = '';
                $remaining = $len;
                while ($remaining > 0 && !feof($in)) {
                    $buf = fread($in, min(65536, $remaining));
                    if ($buf === '' || $buf === false) {
                        break;
                    }
                    $cipher .= $buf;
                    $remaining -= strlen($buf);
                }
                if (strlen($cipher) !== $len) {
                    throw new \RuntimeException('Truncated encrypted frame.');
                }

                $res = sodium_crypto_secretstream_xchacha20poly1305_pull($state, $cipher, '');
                $msg = $res[0] ?? '';
                $tag = $res[2] ?? null;