rose-squared-sdk 0.1.0

Privacy-preserving encrypted search SDK implementing the SWiSSSE protocol with forward/backward security and volume-hiding, compilable to WebAssembly
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136

// tests/integration.rs
//
// End-to-end integration tests for the full RO(SE)² protocol.
// Run with:  cargo test

use rose_squared_sdk::{PrivacyVault, MockStore, VolumeConfig};
use uuid::Uuid;

fn test_salt() -> [u8; 16] { [0xAB; 16] }
fn test_password() -> &'static str { "test-password-do-not-use-in-prod" }

fn new_vault() -> PrivacyVault {
    PrivacyVault::new(test_password(), &test_salt(), VolumeConfig { n_max: 8 }).unwrap()
}

// ── Basic add + search ────────────────────────────────────────────────────────

#[tokio::test]
async fn test_add_and_search_returns_doc() {
    let mut vault = new_vault();
    let store = MockStore::new();
    let doc_id = Uuid::new_v4();

    vault.add_document(&["invoice"], doc_id, &store).await.unwrap();

    let results = vault.search("invoice", &store).await.unwrap();
    assert_eq!(results.len(), 1);
    assert_eq!(results[0], doc_id);
}

#[tokio::test]
async fn test_unknown_keyword_returns_empty() {
    let vault = new_vault();
    let store = MockStore::new();

    let results = vault.search("ghost", &store).await.unwrap();
    assert!(results.is_empty());
}

// ── Forward security ──────────────────────────────────────────────────────────
// A search token generated BEFORE an add should not see the new doc.
// We verify this structurally: the token captures live_indices at generation time.

#[tokio::test]
async fn test_forward_security_new_doc_invisible_to_old_token() {
    use rose_squared_sdk::protocol::search::SearchProtocol;

    let mut vault = new_vault();
    let store     = MockStore::new();

    let doc_a = Uuid::new_v4();
    vault.add_document(&["report"], doc_a, &store).await.unwrap();

    // Capture a token BEFORE adding doc_b.
    let proto   = SearchProtocol::new(&vault.keys, &vault.state);
    let token_a = proto.prepare_search("report").unwrap().unwrap();
    let count_a = token_a.pairs.len();  // should be 1

    // Add a second doc.
    let doc_b = Uuid::new_v4();
    vault.add_document(&["report"], doc_b, &store).await.unwrap();

    // Old token still has count_a pairs — doc_b's index is not in it.
    assert_eq!(count_a, 1, "old token must not see new doc (forward security)");
}

// ── Backward security ─────────────────────────────────────────────────────────

#[tokio::test]
async fn test_backward_security_delete_removes_doc() {
    let mut vault = new_vault();
    let store     = MockStore::new();

    let doc_a = Uuid::new_v4();
    let doc_b = Uuid::new_v4();

    vault.add_document(&["contract"], doc_a, &store).await.unwrap();
    vault.add_document(&["contract"], doc_b, &store).await.unwrap();

    // Delete doc_a from "contract".
    vault.delete_document("contract", doc_a, &store).await.unwrap();

    let results = vault.search("contract", &store).await.unwrap();
    assert_eq!(results.len(), 1, "only doc_b should remain");
    assert_eq!(results[0], doc_b);
    assert!(!results.contains(&doc_a), "deleted doc must not appear");
}

#[tokio::test]
async fn test_delete_all_leaves_empty_results() {
    let mut vault = new_vault();
    let store     = MockStore::new();
    let doc       = Uuid::new_v4();

    vault.add_document(&["memo"], doc, &store).await.unwrap();
    vault.delete_document("memo", doc, &store).await.unwrap();

    let results = vault.search("memo", &store).await.unwrap();
    assert!(results.is_empty());
}

// ── State export / import ─────────────────────────────────────────────────────

#[tokio::test]
async fn test_state_round_trips_correctly() {
    let mut vault = new_vault();
    let store     = MockStore::new();
    let doc       = Uuid::new_v4();

    vault.add_document(&["budget"], doc, &store).await.unwrap();

    // Export state, re-import into a fresh vault.
    let blob       = vault.export_state().unwrap();
    let vault2     = PrivacyVault::from_exported(
        test_password(), &test_salt(), &blob, VolumeConfig { n_max: 8 }
    ).unwrap();

    let results = vault2.search("budget", &store).await.unwrap();
    assert_eq!(results, vec![doc], "restored vault must find the same doc");
}

// ── Multi-keyword indexing ─────────────────────────────────────────────────────

#[tokio::test]
async fn test_multi_keyword_indexes_all() {
    let mut vault = new_vault();
    let store     = MockStore::new();
    let doc       = Uuid::new_v4();

    vault.add_document(&["alpha", "beta", "gamma"], doc, &store).await.unwrap();

    for kw in &["alpha", "beta", "gamma"] {
        let r = vault.search(kw, &store).await.unwrap();
        assert_eq!(r, vec![doc], "keyword '{kw}' should find the doc");
    }
}