cipherstash-client 0.41.1

The official CipherStash SDK
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111

//! Mode-specific construction of leaf [`EncryptedSteVecTerm`] values.
//!
//! [`PrefixMac`] picks a [`TermBuilder`] via its associated type, so the leaf
//! shape (`Compat` vs. `Standard`) is selected at type-level by the MAC choice
//! rather than threaded through a runtime mode flag.

use super::{
    mac_term::{MacBuild, MacTerm},
    ste_plaintext_term::OrderableTerm,
};
use crate::encryption::{
    json_indexer::{
        prefix_mac::{PrefixMac, UpdatePrefixMac},
        ste_vec::encrypted_term::{
            EncryptedSteVecTerm, EncryptedSteVecTermCompat, EncryptedSteVecTermStandard,
        },
    },
    EncryptionError, TokenizedSelector,
};
use zerokms_protocol::cipherstash_config::column::SteVecMode;

pub(crate) trait TermBuilder {
    fn mac_term<M, const N: usize>(
        macca: &mut M,
        selector: TokenizedSelector<N>,
        term: MacTerm,
    ) -> EncryptedSteVecTerm
    where
        M: PrefixMac + UpdatePrefixMac<MacTerm> + UpdatePrefixMac<TokenizedSelector<N>>;

    fn orderable_term<M>(
        term: OrderableTerm,
        macca: &mut M,
    ) -> Result<EncryptedSteVecTerm, EncryptionError>
    where
        M: PrefixMac + UpdatePrefixMac<&'static str>;
}

/// Continuation invoked with the [`TermBuilder`] selected for a [`SteVecMode`].
///
/// [`dispatch_mode`] is the single place a runtime [`SteVecMode`] is turned into
/// a compile-time [`TermBuilder`]. Every mode-dependent construction path routes
/// through it, so the mode->builder mapping lives in exactly one place; the
/// builder->variant mapping is fixed by each builder's own impl (a
/// [`CompatTermBuilder`] can only produce `EncryptedSteVecTerm::Compat` values,
/// a [`StandardTermBuilder`] only `::Standard`). A column therefore cannot emit
/// the wrong wire key for its mode.
pub(crate) trait WithTermBuilder {
    type Output;
    fn call<TB: TermBuilder>(self) -> Self::Output;
}

pub(crate) fn dispatch_mode<W: WithTermBuilder>(mode: SteVecMode, with: W) -> W::Output {
    match mode {
        SteVecMode::Compat => with.call::<CompatTermBuilder>(),
        SteVecMode::Standard => with.call::<StandardTermBuilder>(),
    }
}

pub(crate) struct CompatTermBuilder;

impl TermBuilder for CompatTermBuilder {
    fn mac_term<M, const N: usize>(
        macca: &mut M,
        selector: TokenizedSelector<N>,
        term: MacTerm,
    ) -> EncryptedSteVecTerm
    where
        M: PrefixMac + UpdatePrefixMac<MacTerm> + UpdatePrefixMac<TokenizedSelector<N>>,
    {
        let mac = MacBuild::from((selector, term)).build(macca);
        EncryptedSteVecTerm::Compat(EncryptedSteVecTermCompat::Mac(mac))
    }

    fn orderable_term<M>(
        term: OrderableTerm,
        macca: &mut M,
    ) -> Result<EncryptedSteVecTerm, EncryptionError>
    where
        M: PrefixMac + UpdatePrefixMac<&'static str>,
    {
        term.build_compat(macca).map(EncryptedSteVecTerm::Compat)
    }
}

pub(crate) struct StandardTermBuilder;

impl TermBuilder for StandardTermBuilder {
    fn mac_term<M, const N: usize>(
        macca: &mut M,
        selector: TokenizedSelector<N>,
        term: MacTerm,
    ) -> EncryptedSteVecTerm
    where
        M: PrefixMac + UpdatePrefixMac<MacTerm> + UpdatePrefixMac<TokenizedSelector<N>>,
    {
        let mac = MacBuild::from((selector, term)).build(macca);
        EncryptedSteVecTerm::Standard(EncryptedSteVecTermStandard::Mac(mac))
    }

    fn orderable_term<M>(
        term: OrderableTerm,
        macca: &mut M,
    ) -> Result<EncryptedSteVecTerm, EncryptionError>
    where
        M: PrefixMac + UpdatePrefixMac<&'static str>,
    {
        term.build_standard(macca)
            .map(EncryptedSteVecTerm::Standard)
    }
}