Repository: syncthing/syncthing
File: cmd/syncthing/decrypt/decrypt.go (Go)

Code before:
	To        string `xor:"mode" placeholder:"PATH" help:"Destination directory, when decrypting"`
	Verify    bool   `xor:"mode" help:"Don't decrypt, just verify that the files are valid"`
	Password  string `help:"Folder password for decryption / verification" env:"FOLDER_PASSWORD"`
	FolderID  string `help:"Folder ID of the encrypted folder, if it cannot be determined automatically"`
	Continue  bool   `help:"Continue processing next file in case of error, instead of aborting"`
	Verbose   bool   `help:"Show verbose progress information"`
	TokenPath string `placeholder:"PATH" help:"Path to the token file within the folder (used to determine folder ID)"`

	folderKey *[32]byte
}

type storedEncryptionToken struct {
	FolderID string
	Token    []byte
}

func (c *CLI) Run() error {
	log.SetFlags(0)

	if c.To == "" && !c.Verify {
		return fmt.Errorf("must set --to or --verify")
	}

	if c.TokenPath == "" {
		// This is a bit long to show as default in --help
		c.TokenPath = ".stfolder/syncthing-encryption_password_token"
	}

	if c.FolderID == "" {
		// We should try to figure out the folder ID
		folderID, err := c.getFolderID()
		if err != nil {
			log.Println("No --folder-id given and couldn't read folder token")
			return fmt.Errorf("getting folder ID: %w", err)
		}

		c.FolderID = folderID
		if c.Verbose {
			log.Println("Found folder ID:", c.FolderID)
		}
	}

	c.folderKey = protocol.KeyFromPassword(c.FolderID, c.Password)

	return c.walk()
}

// walk finds and processes every file in the encrypted folder
func (c *CLI) walk() error {
	srcFs := fs.NewFilesystem(fs.FilesystemTypeBasic, c.Path)
	var dstFs fs.Filesystem

Review comment (suggestion):
```suggestion
		c.TokenPath = filepath.Join(`config.DefaultMarkerName`, "syncthing-encryption_password_token")
```

Where the latter should be something like `config.EncryptionPasswordTokenName`, but that needs more adjustments as I hardcoded that in model.go.

Code after:
	Path       string `arg:"" required:"1" help:"Path to encrypted folder"`
	To         string `xor:"mode" placeholder:"PATH" help:"Destination directory, when decrypting"`
	VerifyOnly bool   `xor:"mode" help:"Don't write decrypted files to disk (but verify plaintext hashes)"`
	Password   string `help:"Folder password for decryption / verification" env:"FOLDER_PASSWORD"`
	FolderID   string `help:"Folder ID of the encrypted folder, if it cannot be determined automatically"`
	Continue   bool   `help:"Continue processing next file in case of error, instead of aborting"`
	Verbose    bool   `help:"Show verbose progress information"`
	TokenPath  string `placeholder:"PATH" help:"Path to the token file within the folder (used to determine folder ID)"`

	folderKey *[32]byte
}

type storedEncryptionToken struct {
	FolderID string
	Token    []byte
}

func (c *CLI) Run() error {
	log.SetFlags(0)

	if c.To == "" && !c.VerifyOnly {
		return fmt.Errorf("must set --to or --verify")
	}

	if c.TokenPath == "" {
		// This is a bit long to show as default in --help
		c.TokenPath = filepath.Join(config.DefaultMarkerName, config.EncryptionTokenName)
	}

	if c.FolderID == "" {
		// We should try to figure out the folder ID
		folderID, err := c.getFolderID()
		if err != nil {
			log.Println("No --folder-id given and couldn't read folder token")
			return fmt.Errorf("getting folder ID: %w", err)
		}

		c.FolderID = folderID
		if c.Verbose {
			log.Println("Found folder ID:", c.FolderID)
		}
	}

	c.folderKey = protocol.KeyFromPassword(c.FolderID, c.Password)

	return c.walk()
}

// walk finds and processes every file in the encrypted folder
func (c *CLI) walk() error {
	srcFs := fs.NewFilesystem(fs.FilesystemTypeBasic, c.Path)