Struct QueryBuilderIntegration 

pub struct QueryBuilderIntegration { /* private fields */ }

Query builder integration for encrypted field validation

Validates queries to ensure encrypted fields are not used in operations that require plaintext comparison (WHERE, ORDER BY, JOIN).

Implementations

impl QueryBuilderIntegration

pub fn new(encrypted_fields: Vec<String>) -> Self

Create new query builder integration

pub fn validate_where_clause(&self, fields: &[&str]) -> Result<(), SecretsError>

Validate that encrypted fields are not used in WHERE clause

Encrypted fields cannot be directly compared due to non-deterministic encryption (random nonces). Queries using encrypted fields in WHERE must use alternative approaches like:

• Deterministic hash of plaintext
• Separate plaintext index
• Application-level filtering

pub fn validate_order_by_clause( &self, fields: &[&str], ) -> Result<(), SecretsError>

Validate that encrypted fields are not used in ORDER BY clause

Encrypted fields cannot be compared for sorting because ciphertext does not preserve plaintext order.

pub fn validate_join_condition( &self, fields: &[&str], ) -> Result<(), SecretsError>

Validate that encrypted fields are not used in JOIN condition

Encrypted fields cannot be compared in JOIN conditions because ciphertext is non-deterministic (different every time even for same plaintext).

pub fn validate_group_by_clause( &self, fields: &[&str], ) -> Result<(), SecretsError>

Validate that encrypted fields are not used in GROUP BY clause

pub fn validate_is_null_on_encrypted( &self, _field: &str, ) -> Result<(), SecretsError>

Validate IS NULL can be used on encrypted fields

IS NULL checks NULL at database level (before encryption), so it works correctly with encrypted fields.

pub fn validate_clause( &self, clause_type: ClauseType, fields: &[&str], ) -> Result<(), SecretsError>

Validate clause type contains allowed fields

pub fn encrypted_fields(&self) -> Vec<String>

Get encrypted field names

pub fn is_encrypted(&self, field: &str) -> bool

Check if field is encrypted

pub fn get_encrypted_fields_in_list(&self, fields: &[&str]) -> Vec<String>

Get encrypted fields that appear in field list

pub fn validate_query( &self, query_type: QueryType, where_fields: &[&str], order_by_fields: &[&str], join_fields: &[&str], ) -> Result<(), SecretsError>

Validate entire query structure

Performs comprehensive validation across multiple clauses.