cipherstash-client 0.42.0

#![cfg(all(feature = "test-utils", feature = "tokio"))]

mod prelude;

use prelude::*;
use zerokms_protocol::IdentifiedBy;

async fn create_scoped_cipher(
    access_key: &str,
    workspace_id: WorkspaceId,
    client_key: &ClientKey,
    keyset_id: Option<Uuid>,
) -> Arc<ScopedCipher<AccessKeyStrategy>> {
    let strategy = build_access_key_strategy(access_key, workspace_id);
    let client = Arc::new(build_zerokms_with_client_key(strategy, client_key));
    let cipher = ScopedCipher::init(client, keyset_id.map(IdentifiedBy::Uuid))
        .await
        .expect("failed to create scoped cipher");
    Arc::new(cipher)
}

fn create_column_config_with_indexes(indexes: Vec<Index>) -> ColumnConfig {
    let mut config = ColumnConfig::build("test_column");

    for index in indexes {
        config.indexes.push(index);
    }

    config
}

#[tokio::test]
#[ignore = "e2e"]
async fn test_encrypt_and_decrypt_eql_basic() {
    let _temp_config_dir = &*CONFIG_DIR;

    let token = build_mock_token();
    let cts_client = build_cts_client(token);
    let workspace_id = create_workspace(&cts_client).await;
    let access_key = create_access_key(&cts_client, workspace_id).await;

    let strategy = build_access_key_strategy(&access_key, workspace_id);
    let zero_kms = build_zerokms(strategy);

    let keyset = create_keyset(&zero_kms).await;
    let client_key = create_client_key(&zero_kms, &keyset).await;
    let cipher =
        create_scoped_cipher(&access_key, workspace_id, &client_key, Some(keyset.id)).await;

    // Create test data
    let identifier = Identifier::new("users", "email");
    let plaintext_value = cipherstash_client::encryption::Plaintext::from("test@example.com");
    let column_config = create_column_config_with_indexes(vec![Index::new_match()]);

    let prepared = PreparedPlaintext::new(
        Cow::Owned(column_config),
        identifier.clone(),
        plaintext_value.clone(),
        EqlOperation::Store,
    );

    // Encrypt
    let encrypt_opts = EqlEncryptOpts::default();
    let encrypted = encrypt_eql(cipher.clone(), vec![prepared], &encrypt_opts)
        .await
        .expect("failed to encrypt");

    assert_eq!(encrypted.len(), 1);
    let stored = expect_store(&encrypted[0]);
    let payload = expect_encrypted(stored);
    assert_eq!(payload.identifier, identifier);
    assert_eq!(payload.version, EQL_SCHEMA_VERSION);

    // Decrypt
    let decrypt_opts = EqlDecryptOpts::default();
    let stored_ciphertexts: Vec<EqlCiphertext> = encrypted.into_iter().map(into_store).collect();
    let decrypted = decrypt_eql(cipher.clone(), stored_ciphertexts, &decrypt_opts)
        .await
        .expect("failed to decrypt");

    assert_eq!(decrypted.len(), 1);
    assert_eq!(
        String::try_from(decrypted[0].clone()).unwrap(),
        "test@example.com"
    );
}

#[tokio::test]
#[ignore = "e2e"]
async fn test_encrypt_eql_with_multiple_index_types() {
    let _temp_config_dir = &*CONFIG_DIR;

    let token = build_mock_token();
    let cts_client = build_cts_client(token);
    let workspace_id = create_workspace(&cts_client).await;
    let access_key = create_access_key(&cts_client, workspace_id).await;

    let strategy = build_access_key_strategy(&access_key, workspace_id);
    let zero_kms = build_zerokms(strategy);

    let keyset = create_keyset(&zero_kms).await;
    let client_key = create_client_key(&zero_kms, &keyset).await;
    let cipher =
        create_scoped_cipher(&access_key, workspace_id, &client_key, Some(keyset.id)).await;

    // Create column config with multiple index types
    let identifier = Identifier::new("cms", "doc_text");
    let plaintext_value = cipherstash_client::encryption::Plaintext::from("the quick brown fox");
    let column_config = create_column_config_with_indexes(vec![
        Index::new_match(),
        Index::new_ore(),
        Index::new_unique(),
    ]);

    let prepared = PreparedPlaintext::new(
        Cow::Owned(column_config),
        identifier.clone(),
        plaintext_value,
        EqlOperation::Store,
    );

    // Encrypt
    let encrypt_opts = EqlEncryptOpts::default();
    let encrypted = encrypt_eql(cipher.clone(), vec![prepared], &encrypt_opts)
        .await
        .expect("failed to encrypt");

    assert_eq!(encrypted.len(), 1);

    // Verify indexes were generated
    let payload = expect_encrypted(expect_store(&encrypted[0]));
    assert!(
        payload.bloom_filter.is_some(),
        "Match index should be present"
    );
    assert!(
        payload.ore_block_u64_8_256.is_some(),
        "ORE index should be present"
    );
    assert!(payload.hmac_256.is_some(), "Unique index should be present");
}

#[tokio::test]
#[ignore = "e2e"]
async fn test_encrypt_eql_in_query_mode() {
    let _temp_config_dir = &*CONFIG_DIR;

    let token = build_mock_token();
    let cts_client = build_cts_client(token);
    let workspace_id = create_workspace(&cts_client).await;
    let access_key = create_access_key(&cts_client, workspace_id).await;

    let strategy = build_access_key_strategy(&access_key, workspace_id);
    let zero_kms = build_zerokms(strategy);

    let keyset = create_keyset(&zero_kms).await;
    let client_key = create_client_key(&zero_kms, &keyset).await;
    let cipher =
        create_scoped_cipher(&access_key, workspace_id, &client_key, Some(keyset.id)).await;

    // Create query mode encryption
    let identifier = Identifier::new("users", "name");
    let plaintext_value = cipherstash_client::encryption::Plaintext::from("Alice");
    let match_index = Index::new_match();
    let column_config = create_column_config_with_indexes(vec![match_index.clone()]);

    let prepared = PreparedPlaintext::new(
        Cow::Owned(column_config),
        identifier.clone(),
        plaintext_value,
        EqlOperation::Query(
            &match_index.index_type,
            cipherstash_client::encryption::QueryOp::Default,
        ),
    );

    // Encrypt in query mode
    let encrypt_opts = EqlEncryptOpts::default();
    let encrypted = encrypt_eql(cipher.clone(), vec![prepared], &encrypt_opts)
        .await
        .expect("failed to encrypt in query mode");

    assert_eq!(encrypted.len(), 1);
    let query = expect_query(&encrypted[0]);
    let encrypted_query = expect_query_encrypted(query);
    assert_eq!(encrypted_query.identifier, identifier);

    // In query mode there's no ciphertext field — just the matching index term.
    assert!(
        matches!(encrypted_query.term, RootQueryTerm::BloomFilter { .. }),
        "Query mode should produce a bloom-filter root query term, got {:?}",
        encrypted_query.term
    );
}

#[tokio::test]
#[ignore = "e2e"]
async fn test_decrypt_eql_with_wrong_keyset() {
    let _temp_config_dir = &*CONFIG_DIR;

    let token = build_mock_token();
    let cts_client = build_cts_client(token);
    let workspace_id = create_workspace(&cts_client).await;
    let access_key = create_access_key(&cts_client, workspace_id).await;

    let strategy = build_access_key_strategy(&access_key, workspace_id);
    let zero_kms = build_zerokms(strategy);

    // Create first keyset and encrypt data
    let keyset1 = create_keyset(&zero_kms).await;
    let client_key1 = create_client_key(&zero_kms, &keyset1).await;
    let cipher1 =
        create_scoped_cipher(&access_key, workspace_id, &client_key1, Some(keyset1.id)).await;

    let identifier = Identifier::new("users", "secret");
    let plaintext_value = cipherstash_client::encryption::Plaintext::from("secret_data");
    let column_config = create_column_config_with_indexes(vec![Index::new_unique()]);

    let prepared = PreparedPlaintext::new(
        Cow::Owned(column_config),
        identifier.clone(),
        plaintext_value,
        EqlOperation::Store,
    );

    let encrypt_opts = EqlEncryptOpts::default();
    let encrypted = encrypt_eql(cipher1.clone(), vec![prepared], &encrypt_opts)
        .await
        .expect("failed to encrypt");

    // Create second keyset and try to decrypt with it
    let keyset2 = create_keyset(&zero_kms).await;
    let client_key2 = create_client_key(&zero_kms, &keyset2).await;
    let cipher2 =
        create_scoped_cipher(&access_key, workspace_id, &client_key2, Some(keyset2.id)).await;

    // Try to decrypt with wrong keyset (should fail)
    let decrypt_opts = EqlDecryptOpts {
        keyset_id: Some(keyset2.id),
        ..Default::default()
    };
    let stored: Vec<EqlCiphertext> = encrypted.into_iter().map(into_store).collect();
    let result = decrypt_eql(cipher2.clone(), stored, &decrypt_opts).await;

    assert!(result.is_err(), "Decryption with wrong keyset should fail");

    // Verify error message mentions the keyset
    let err = result.unwrap_err();
    let err_str = err.to_string();
    assert!(
        err_str.contains("decrypt") || err_str.contains("keyset"),
        "Error should mention decryption or keyset failure: {err_str}"
    );
}

#[tokio::test]
#[ignore = "e2e"]
async fn test_encrypt_eql_multiple_plaintexts() {
    let _temp_config_dir = &*CONFIG_DIR;

    let token = build_mock_token();
    let cts_client = build_cts_client(token);
    let workspace_id = create_workspace(&cts_client).await;
    let access_key = create_access_key(&cts_client, workspace_id).await;

    let strategy = build_access_key_strategy(&access_key, workspace_id);
    let zero_kms = build_zerokms(strategy);

    let keyset = create_keyset(&zero_kms).await;
    let client_key = create_client_key(&zero_kms, &keyset).await;
    let cipher =
        create_scoped_cipher(&access_key, workspace_id, &client_key, Some(keyset.id)).await;

    // Create multiple plaintexts
    let column_config = create_column_config_with_indexes(vec![Index::new_match()]);

    let prepared_plaintexts = vec![
        PreparedPlaintext::new(
            Cow::Borrowed(&column_config),
            Identifier::new("users", "email"),
            cipherstash_client::encryption::Plaintext::from("alice@example.com"),
            EqlOperation::Store,
        ),
        PreparedPlaintext::new(
            Cow::Borrowed(&column_config),
            Identifier::new("users", "email"),
            cipherstash_client::encryption::Plaintext::from("bob@example.com"),
            EqlOperation::Store,
        ),
        PreparedPlaintext::new(
            Cow::Borrowed(&column_config),
            Identifier::new("users", "email"),
            cipherstash_client::encryption::Plaintext::from("charlie@example.com"),
            EqlOperation::Store,
        ),
    ];

    // Encrypt multiple values
    let encrypt_opts = EqlEncryptOpts::default();
    let encrypted = encrypt_eql(cipher.clone(), prepared_plaintexts, &encrypt_opts)
        .await
        .expect("failed to encrypt multiple plaintexts");

    assert_eq!(encrypted.len(), 3);

    // Verify all were encrypted
    for eql in &encrypted {
        let payload = expect_encrypted(expect_store(eql));
        assert_eq!(payload.identifier.table, "users");
        assert_eq!(payload.identifier.column, "email");
    }

    // Decrypt all
    let decrypt_opts = EqlDecryptOpts::default();
    let stored: Vec<EqlCiphertext> = encrypted.into_iter().map(into_store).collect();
    let decrypted = decrypt_eql(cipher.clone(), stored, &decrypt_opts)
        .await
        .expect("failed to decrypt multiple values");

    assert_eq!(decrypted.len(), 3);
    assert_eq!(
        String::try_from(decrypted[0].clone()).unwrap(),
        "alice@example.com"
    );
    assert_eq!(
        String::try_from(decrypted[1].clone()).unwrap(),
        "bob@example.com"
    );
    assert_eq!(
        String::try_from(decrypted[2].clone()).unwrap(),
        "charlie@example.com"
    );
}

#[tokio::test]
#[ignore = "e2e"]
async fn test_stevec_encryption_has_no_v2_wire_representation() {
    // Under the SteVec envelope wire format (CIP-3551) a document's entries
    // are encrypted under one data key with selector-derived nonces and carry
    // raw AEAD output only — there is no self-contained per-entry record, so a
    // SteVec document cannot be serialized as a v2 `EqlCiphertext`. Encrypting
    // a SteVec column through the v2 path must therefore fail closed; SteVec is
    // v3-only. (The v3 envelope round-trip is covered by the client lib tests
    // and the EQL SQLx suite.) Both index modes fail the same way — the v2
    // assembler rejects any SteVec document before it inspects the mode.
    for mode in [
        cipherstash_config::column::SteVecMode::Compat,
        cipherstash_config::column::SteVecMode::Standard,
    ] {
        let _temp_config_dir = &*CONFIG_DIR;

        let token = build_mock_token();
        let cts_client = build_cts_client(token);
        let workspace_id = create_workspace(&cts_client).await;
        let access_key = create_access_key(&cts_client, workspace_id).await;

        let strategy = build_access_key_strategy(&access_key, workspace_id);
        let zero_kms = build_zerokms(strategy);

        let keyset = create_keyset(&zero_kms).await;
        let client_key = create_client_key(&zero_kms, &keyset).await;
        let cipher =
            create_scoped_cipher(&access_key, workspace_id, &client_key, Some(keyset.id)).await;

        let json_document = json!({ "user": { "name": "Alice Johnson", "age": 28 } });
        let plaintext_value = cipherstash_client::encryption::Plaintext::Json(Some(json_document));

        let ste_vec_index = Index::new(cipherstash_config::column::IndexType::SteVec {
            prefix: "cs_ste_vec_v1".to_string(),
            term_filters: Vec::new(),
            array_index_mode: cipherstash_config::column::ArrayIndexMode::ALL,
            mode,
        });
        let column_config = create_column_config_with_indexes(vec![ste_vec_index]);

        let prepared = PreparedPlaintext::new(
            Cow::Owned(column_config),
            Identifier::new("users", "profile_data"),
            plaintext_value,
            EqlOperation::Store,
        );

        let encrypt_opts = EqlEncryptOpts {
            keyset_id: Some(keyset.id),
            ..Default::default()
        };
        let err = encrypt_eql(cipher.clone(), vec![prepared], &encrypt_opts)
            .await
            .expect_err("v2 SteVec encryption must fail — SteVec is v3-only");
        assert!(
            matches!(err, EqlError::UnsupportedSteVecInV2),
            "expected UnsupportedSteVecInV2, got {err:?} (mode {mode:?})"
        );
    }
}

fn expect_store(output: &EqlOutput) -> &EqlCiphertext {
    match output {
        EqlOutput::Store(c) => c,
        EqlOutput::Query(_) => panic!("expected EqlOutput::Store, got Query"),
    }
}

fn into_store(output: EqlOutput) -> EqlCiphertext {
    match output {
        EqlOutput::Store(c) => c,
        EqlOutput::Query(_) => panic!("expected EqlOutput::Store, got Query"),
    }
}

fn expect_query(output: &EqlOutput) -> &EqlQueryPayload {
    match output {
        EqlOutput::Query(q) => q,
        EqlOutput::Store(_) => panic!("expected EqlOutput::Query, got Store"),
    }
}

fn expect_encrypted(eql: &EqlCiphertext) -> &EncryptedPayload {
    match eql {
        EqlCiphertext::Encrypted(p) => p,
        EqlCiphertext::SteVec(_) => panic!("expected EqlCiphertext::Encrypted, got SteVec"),
    }
}

fn expect_query_encrypted(eql: &EqlQueryPayload) -> &EncryptedQueryPayload {
    match eql {
        EqlQueryPayload::Encrypted(p) => p,
        EqlQueryPayload::SteVec(_) => panic!("expected EqlQueryPayload::Encrypted, got SteVec"),
    }
}