Enum Decryptor 

#[non_exhaustive]
pub enum Decryptor {
    Passphrase(PassphraseDecryptor),
    PrivateKey(PrivateKeyDecryptor),
}

Type-safe entry point for decryption.

Decryptor::open reads the .fcr header without cryptographic work and returns the variant that matches the file’s recipient kind. Each variant takes only the credentials it can use:

• Decryptor::Passphrase takes a passphrase.
• Decryptor::PrivateKey takes a PrivateKey, which carries its own unlock passphrase.

A mismatched-credential call — e.g. trying to decrypt a passphrase-sealed file with a PrivateKey — is therefore a compile error. The runtime CryptoError::DecryptorModeMismatch is left for the one case types cannot cover: the file at the path changed recipient mode after Decryptor::open classified it.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Passphrase(PassphraseDecryptor)

File is sealed with a passphrase. Decrypt via PassphraseDecryptor::decrypt.

PrivateKey(PrivateKeyDecryptor)

File is sealed to one or more public-key recipients. Decrypt via PrivateKeyDecryptor::decrypt.

Implementations

impl Decryptor

pub fn open(input: impl AsRef<Path>) -> Result<Self, CryptoError>

Probes the .fcr header (cheap structural read; no recipient unwrap, no MAC, no payload bytes touched) and returns the matching variant.

The returned value holds the path, not the opened file: each decrypt reads the header again from that path. The classification is therefore a routing hint about a path, not a verdict about a file — if the path stops naming the file probed here, decrypt refuses a changed recipient mode with CryptoError::DecryptorModeMismatch and otherwise processes whatever is there now, under the same acceptance order. Within one decrypt call the file is opened once and kept open.

Errors

Returns CryptoError::InputPath if input does not exist and CryptoError::InvalidInput if input is a directory. An input shorter than the 12-byte .fcr prefix returns CryptoError::InvalidFormat with FormatDefect::Truncated whatever its bytes, because FORMAT.md §3.1 checks the length of the prefix before its magic. An input of at least 12 bytes that does not open with the FerroCrypt magic returns FormatDefect::BadMagic. Malformed headers, unsupported versions, unknown critical recipients, and illegal recipient mixes return their corresponding CryptoError or FormatDefect variants. A passphrase recipient whose stored Argon2id parameters are outside the bounds FORMAT.md §2.2 permits returns CryptoError::InvalidKdfParams. A header shape, or an aggregate header-MAC work total, above HeaderReadLimits::default returns the matching *CapExceeded variant; use Decryptor::open_with_limits to raise the caps.

pub fn open_with_limits( input: impl AsRef<Path>, header_read_limits: HeaderReadLimits, ) -> Result<Self, CryptoError>

Same as Decryptor::open but uses the supplied HeaderReadLimits for the structural header read instead of the conservative defaults.

Callers handling files whose recipient strings, recipient counts, or header lengths legitimately exceed the defaults (for example, forward-compatible files with larger future recipient bodies) should construct a HeaderReadLimits via the builder methods and pass it here. The same limits are stashed on the returned variant so the second header read inside PassphraseDecryptor::decrypt / PrivateKeyDecryptor::decrypt uses them too — callers do not need to set them twice.

Errors

Returns the same errors as Decryptor::open, but applies the supplied HeaderReadLimits during structural header parsing.

Trait Implementations

impl Debug for Decryptor

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.