[2/3] refactor(eql): adopt the cipherstash-client 0.42.0 representation#421
Closed
freshtonic wants to merge 4 commits into
Closed
[2/3] refactor(eql): adopt the cipherstash-client 0.42.0 representation#421freshtonic wants to merge 4 commits into
freshtonic wants to merge 4 commits into
Conversation
Knowingly leaves the workspace not compiling. Fixing the fallout is deliberately deferred. - cipherstash-client / cipherstash-config / cts-common: 0.34.1-alpha.4 -> 0.42.0 - CS_EQL_VERSION: eql-2.3.0-pre.3 -> eql-3.0.1 (major, breaking) - Drop the CIP-3159 vendored stack-auth patch: 0.42.0 requires stack-auth ^0.42.0, which carries the CancelGuard fix upstream. vendor/stack-auth is left in place but is now unreferenced. Queued-Commit-Id: q-0c7qhchxzewgy0q472w3vcps2t
Switch the encrypt path to cipherstash-client 0.42.0's encrypt_eql_v3 and make v3 the only wire envelope Proxy speaks. Still does not compile; threading the new types through the protocol layer is deferred. - lib.rs re-exports the V3 types under the old names and deliberately does NOT re-export the v2 ones, so any remaining v2 use fails to resolve rather than silently writing v2 payloads. - EQL_SCHEMA_VERSION 2 -> 3; startup gate now queries eql_v3.version() (eql_v2 schema no longer exists in EQL 3). - Decrypt is now local: there is no decrypt_eql_v3 in the client, but a scalar payload's 'c' is an EncryptedRecord and EncryptedRecord is Decryptable, so it goes straight to the cipher. - SteVec (jsonb) decrypt returns SteVecV3DecryptUnsupported: v3 stores the key header once at the document root with raw AEAD bytes per entry, and reassembling that here would hard-code the envelope layout. Queued-Commit-Id: q-4n8w7v1b7dadsf27c98sz33kk1
Follows the approach protect-ffi uses (encrypted_record_from_value / v3_root_record): skip decrypt_eql entirely and hand an EncryptedRecord straight to the cipher. Replaces the SteVecV3DecryptUnsupported error added in the previous commit, which was wrong -- KeyHeader::record_with_selector is public and does exactly the reassembly needed. Scalar and SteVec records are NOT interchangeable, hence the V3Record enum: RecordWithNonce unconditionally reports a nonce override and an AAD selector, so wrapping a scalar record in one would decrypt against a nonce the value was never encrypted with. Note protect-ffi's SteVec branch does not port directly: it pins cipherstash-client =0.41.1, where sv entries are self-describing mp_base85 records. 0.42.0 moved to an envelope -- key material once in the document's 'h' header, raw AEAD bytes per entry, nonce and AAD derived from the entry selector. Queued-Commit-Id: q-2jsj9wjxvdj9s21xzpmp838x93
Completes the v3 move. The workspace compiles again; cargo fmt and
clippy are clean.
The load-bearing change is in data_row.rs. EQL v2's eql_v2_encrypted was
a COMPOSITE type, so reads stripped a ('...') wrapper in text and a
12-byte rowtype header in binary. EQL v3's types are DOMAINS over jsonb
(95 CREATE DOMAIN, zero composites), and a domain is wire-identical to
its base type -- so both of those strips were wrong. Reads now take the
jsonb representation: bare JSON in text, a 1-byte version header plus
JSON in binary.
Also:
- Encrypt now carries EqlOutput, not EqlCiphertext, through the literal
and param paths: a query operand is not a ciphertext. Both v3 enums
are #[serde(untagged)], so the serialized wire form is unchanged.
- backend/bind/data_row imported cipherstash_client::eql::EqlCiphertext
directly, bypassing the crate alias and silently keeping the v2 type.
They now use crate::EqlCiphertext.
- EqlCiphertext::identifier is a method in 0.42.0, not a field.
- Map the new EqlError variants. UnsupportedSteVecOreInV3 gets its own
customer-facing error: v3 has no oc representation, so a ste_vec column
left in Standard (CLLW-ORE) mode cannot be written at all.
- cipherstash-config gained IndexType::SteVec { mode }. SteVecMode::Compat
(CLLW-OPE) is the default and the v3-compatible mode; Standard is
documented upstream as the legacy v2 protocol.
- CouldNotDecryptDataForKeyset gained a #[source]; Proxy's variant does
not carry it, so the chain stops at that boundary (noted in place).
Queued-Commit-Id: q-48c15nyszqvw09e8m6gydxqvfd
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📚 Queued PR · 2 of 3
Part of a queue. The PRs merge in FIFO order — the numbered order below, #1 first. Merging one supersedes the PRs after it until the author runs
git queue sync(rebases the rest onto the merged base) andgit queue submit(retargets their PRs).chore/setup-skills→mainchore/eql-v3-deps→chore/setup-skills👈 this PRfeat/eql-v3-typecheck→chore/eql-v3-deps✅ approved · ♻️ changes requested · ⏳ review pending | 🟣 merged · 🟢 open · ⚫ closed — status as of the last
git queue submit.🥞 Managed by git-queue — do not edit this list by hand.