From 2e23e848dfcf0c08c84d7f2b9f6eeea05e7054bf Mon Sep 17 00:00:00 2001
From: MattJackson <1085847+MattJackson@users.noreply.github.com>
Date: Wed, 15 Apr 2026 01:34:30 +0000
Subject: [PATCH] =?UTF-8?q?Decrypt=20back=20in=20streams=20=E2=80=94=20str?=
 =?UTF-8?q?eams=20handle=20their=20own=20decryption?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

IsoStream decrypts in its read path using keys from scan.
IOStream trait gets keys() method with default DecryptKeys::None.
Pipeline no longer handles decrypt — just reads decrypted bytes.
---
 src/mux/iso.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/mux/iso.rs b/src/mux/iso.rs
index 421afc1..d5910c3 100644
--- a/src/mux/iso.rs
+++ b/src/mux/iso.rs
@@ -9,7 +9,7 @@
 
 use super::isowriter::IsoWriter;
 use super::IOStream;
-use crate::decrypt::DecryptKeys;
+use crate::decrypt::{decrypt_sectors, DecryptKeys};
 use crate::disc::{Disc, DiscTitle, ScanOptions};
 use crate::error::{Error, Result};
 use crate::sector::SectorReader;
@@ -203,7 +203,9 @@ impl IsoStream {
             .read_sectors(lba, count, &mut self.batch_buf)
             .map_err(|e| io::Error::other(e.to_string()))?;
 
+        // Decrypt after read — stream handles its own decryption
         let bytes = count as usize * SECTOR_SIZE as usize;
+        decrypt_sectors(&mut self.batch_buf[..bytes], &self.decrypt_keys, 0);
 
         self.buf_pos = 0;
         self.buf_len = bytes;