Struct JsonIndexer 

pub struct JsonIndexer { /* private fields */ }

Implementations

impl JsonIndexer

pub fn new(opts: JsonIndexerOptions) -> Self

pub fn index( &self, json: Value, index_key: &IndexKey, ) -> Result<SteVecPendingEncryption<16>, EncryptionError>

Generates an [SteVecPendingEncryption] from a JSON value. This represents the indexed form of the JSON, but with source plaintexts still present. This can then be encrypted into a final SteVec using a crate::zerokms::DataKeyWithTag with [SteVecPendingEncryption::encrypt].

Once encrypted, the resulting SteVec can be stored in a database column or some other storage.

Example

use cipherstash_client::encryption::{JsonIndexer, JsonIndexerOptions, SteVec};
use cipherstash_client::zerokms::{DataKey, DataKeyWithTag, IndexKey};
use serde_json::Value;

let opts = JsonIndexerOptions { prefix: "foo".to_string() };
let indexer = JsonIndexer::new(opts);
let index_key = IndexKey::from([0; 32]);
let json = serde_json::json!({ "a": 1, "b": { "c": 2 } });
let pending_encryption = indexer.index(json, &index_key).unwrap();

// Encrypt the pending entries with a DataKeyWithTag
// CAUTION: Always use a data key generated by Zerokms for production use.
// Attempting to generate your own keys will result in invalid tags and decryption failures.
let key = DataKey {
    iv: [0; 16],
    key: [0; 32],
};
let key_with_tag = DataKeyWithTag { key, tag: vec![0, 1, 2] };
let ste_vec: SteVec<16> = pending_encryption.encrypt(key_with_tag).unwrap();

pub fn query( &self, json: Value, index_key: &IndexKey, ) -> Result<SteQueryVec<16>, EncryptionError>

Generate an SteQueryVec from a JSON value.

This is useful for building containment queries (e.g. @> operator in Postgres). For example, given an SteVec column attrs, an SteQueryVec generated from a plaintext JSON value.

use cipherstash_client::encryption::{JsonIndexer, JsonIndexerOptions};
use cipherstash_client::zerokms::IndexKey;

let opts = JsonIndexerOptions { prefix: "foo".to_string() };
let indexer = JsonIndexer::new(opts);
let index_key = IndexKey::from([0; 32]);
let json = serde_json::json!({ "a": 1, "b": { "c": 2 } });
let q = indexer.query(json, &index_key).unwrap();

This can then be used in a query like:

-- $1 is the query parameter, q
-- Example: q = [["aaa...", "bbb..."], ["ccc...", "ddd..."]]
SELECT * FROM table WHERE attrs @> $1;

pub fn generate_selector( &self, selector: Selector, index_key: &IndexKey, ) -> TokenizedSelector<16>

Generate a TokenizedSelector from a JSON path. This is useful for building queries that target specific paths in a JSON document.

For example, given an SteVec column attrs, a TokenizedSelector generated from a JSON path.

use cipherstash_client::encryption::{JsonIndexer, JsonIndexerOptions};
use cipherstash_client::zerokms::IndexKey;
use cipherstash_client::ejsonpath::Selector;

let opts = JsonIndexerOptions { prefix: "foo".to_string() };
let indexer = JsonIndexer::new(opts);
let index_key = IndexKey::from([0; 32]);
let json = serde_json::json!({ "a": 1, "b": { "c": 2 } });
let selector = Selector::parse("$.b.c").unwrap();
let tokenized_selector = indexer.generate_selector(selector, &index_key);

This can then be used in a query like:

-- $1 is the tokenized selector
-- Example: "4eb62fb72d75cb53a309b3b091923daf"
SELECT jsonb_path_query(attrs, '$ ? (exists(@ ? (@[0] == $1)))[2]') FROM table;

This is equivalent to the unencrypted query:

SELECT attrs->'b'->'c' FROM table WHERE attrs->'b'->'c' IS NOT NULL;

Trait Implementations

impl Default for JsonIndexer

fn default() -> Self

Returns the “default value” for a type.

impl IndexerInit for JsonIndexer

type Args = JsonIndexerOptions

type Error = EncryptionError

fn try_init<A>(args: A) -> Result<Self, Self::Error>

where Self::Args: TryFrom<A, Error = Self::Error>,