What the keyboard binding triggers is
(org-toggle-inline-images), that continues to
(org-display-inline-images) which contains:
(when (and path (string-match-p file-extension-re path)) ...)
file-extension-re is created by
(file-extension-re (image-file-name-regexp)) that's a part of
Fortunately that's always called and isn't cached, which is good, because then I can utilize
org-mode-hook to call my stuff and patch it in a sane way that doesn't corrupt everything around. However that's only the first part of the story and quite an easy one.
The problematic part is that the
(create-image) function is expecting a path or data, so, another patch. Here is helpful the
(advice-add) which has quite a clever way of injecting a custom function before/after/around/etc states, which allowed me to capture the path prior to calling
(create-image), thus decrypt into some temp folder first and return back the temporary path.
Everything loads, we're done, right?
The decrypted files are still present on the system, thus allowing anyone who can look into temp to read them (well, "current user", but that's not enough for a restriction), so removal is in order. I tried to remove it right after decrypting and noticed the return value of
(create-image) is used in
org-mode and due to Lisp being Lisp I couldn't just store it in a temp variable, remove it and then return from the temp variable unless I wanted to start pulling in random packages or misuse
return. So I assembled a set of other hooks where the behavior would be kind of moving away from the editor and in there I injected a function removing the files.
Obviously it's not error proof and a malicious program could just rename files to something different, but until I figure out how to make in less silly, it's the way it works.
Quite a funny experience to code it over night. You can find the source here as well as the instructions how to install.