Function open 

pub fn open<T, K>(blob: &[u8], key: Option<K>) -> Result<T, SerializationError>
where
    T: Decode<()>,
    K: AsRef<str>,

Decode a byte blob produced by seal back into T.

If key is None the default key is used. String literals and owned Strings are both accepted. Returns an error if the key is wrong, the blob is truncated, or the ciphertext has been tampered with — the Poly1305 tag prevents decryption of modified data.

Errors

• SerializationError::Cipher if authentication fails (wrong key or tampered blob).
• SerializationError::Decode if the decrypted bytes cannot be interpreted as T.

Examples found in repository

examples/serialization_macros.rs (line 195)

fn demo_serialize_variable_mode() -> Result<(), Box<dyn std::error::Error>> {
    println!("── #[serialize] / #[deserialize]  variable mode ─────────────────");

    let payload = Payload { id: 42, data: "hello, world".into() };

    // ── Default key ───────────────────────────────────────────────────────────
    // `#[serialize(payload)]` expands to:
    //     let blob: Vec<u8> = toolkit_zero::serialization::seal(&payload, None)?;
    #[serialize(payload)]
    fn blob() -> Vec<u8> {}

    // `#[deserialize(blob)]` expands to:
    //     let restored: Payload = toolkit_zero::serialization::open::<Payload, _>(&blob, None)?;
    #[deserialize(blob)]
    fn restored() -> Payload {}

    assert_eq!(payload, restored);
    println!("  default key  : {} bytes → {:?}", blob.len(), restored);

    // ── Custom key ────────────────────────────────────────────────────────────
    // The `key = <expr>` argument accepts any expression that evaluates to `String`.
    #[serialize(payload, key = "custom-key".to_string())]
    fn blob_keyed() -> Vec<u8> {}

    #[deserialize(blob_keyed, key = "custom-key".to_string())]
    fn restored_keyed() -> Payload {}

    assert_eq!(payload, restored_keyed);
    println!("  custom key   : {} bytes → {:?}", blob_keyed.len(), restored_keyed);

    // ── Cross-key failure check ───────────────────────────────────────────────
    let wrong = toolkit_zero::serialization::open::<Payload, String>(&blob_keyed, None);
    assert!(wrong.is_err(), "decrypting with the wrong key must fail");
    println!("  wrong key    : open → Err (expected) ✓");

    println!();
    Ok(())
}

examples/seal_open.rs (line 54)

fn main() {
    let key = "my-secret-key";

    let original = Payload {
        user:  "alice".into(),
        score: 9001,
        tags:  vec!["rust".into(), "crypto".into()],
    };

    println!("Original : {original:?}");

    // ── Seal ──────────────────────────────────────────────────────────────────
    // String literals and &str both work; K: AsRef<str> handles the conversion.
    let blob = seal(&original, Some(key)).expect("seal failed");
    println!("Sealed   : {} bytes  (nonce ‖ ciphertext ‖ Poly1305 tag)", blob.len());

    // ── Semantic security ─────────────────────────────────────────────────────
    // A fresh random 12-byte nonce is generated on every seal call, so identical
    // plaintext + key still produces a different ciphertext each time.
    let blob2 = seal(&original, Some(key)).expect("seal failed");
    assert_ne!(blob, blob2, "ciphertexts should differ (different nonces)");
    println!("Semantic security   : two seals of the same value differ ✓");

    // ── Open ──────────────────────────────────────────────────────────────────
    // Reconstructs Payload from the opaque blob using the same key.
    let recovered: Payload = open(&blob, Some(key)).expect("open failed");
    println!("Recovered: {recovered:?}");

    assert_eq!(original, recovered, "round-trip mismatch!");
    println!("\nRound-trip successful ✓");

    // ── Wrong key rejects ─────────────────────────────────────────────────────
    let bad: Result<Payload, _> = open(&blob, Some("wrong-key"));
    assert!(bad.is_err(), "wrong key should fail to open");
    println!("Wrong-key rejection ✓");

    // ── Default key ───────────────────────────────────────────────────────────
    // Pass None::<&str> to use the built-in default key.
    let blob3 = seal(&original, None::<&str>).expect("seal with default key failed");
    let back3: Payload = open(&blob3, None::<&str>).expect("open with default key failed");
    assert_eq!(original, back3);
    println!("Default-key round-trip ✓");
}