test(test-server): remove the MPL feature; return decrypt context and suite

test-server/feature-config.json

@@ -1,7 +1,6 @@
 {
   "supportedFeatures": [
     "streaming",
-    "MPL",
     "hierarchical",
     "raw-aes",
     "raw-rsa",

test-server/server/src/main/java/aws/cryptography/esdk/testserver/server/handler/DecryptHandler.java

@@ -3,6 +3,9 @@
 import aws.cryptography.esdk.testserver.server.error.OperationWrapper;
 import aws.cryptography.esdk.testserver.server.model.DecryptInput;
 import aws.cryptography.esdk.testserver.server.model.DecryptOutput;
+import aws.cryptography.esdk.testserver.server.model.ESDKAlgorithmSuiteId;
+import aws.cryptography.esdk.testserver.server.registry.DecryptMetadata;
+import aws.cryptography.esdk.testserver.server.registry.DecryptResult;
 import aws.cryptography.esdk.testserver.server.registry.EsdkClient;
 import aws.cryptography.esdk.testserver.server.service.DecryptOperation;
 import java.nio.ByteBuffer;
@@ -30,10 +33,15 @@ public DecryptHandler(ClientIdGuard guard, OperationWrapper wrapper) {
     public DecryptOutput decrypt(DecryptInput input, RequestContext context) {
         return wrapper.invoke("Decrypt", () -> {
             EsdkClient client = guard.resolve(input.getClientId());
-            byte[] plaintext = client.decrypt(
+            DecryptResult result = client.decrypt(
                 Blobs.toArray(input.getCiphertext()),
                 input.getEncryptionContext());
-            return DecryptOutput.builder().plaintext(ByteBuffer.wrap(plaintext)).build();
+            DecryptMetadata metadata = result.metadata();
+            return DecryptOutput.builder()
+                .plaintext(ByteBuffer.wrap(result.plaintext()))
+                .encryptionContext(metadata.encryptionContext())
+                .algorithmSuiteId(ESDKAlgorithmSuiteId.from(metadata.algorithmSuiteId()))
+                .build();
         });
     }
 }

test-server/server/src/main/java/aws/cryptography/esdk/testserver/server/handler/DecryptStreamHandler.java

@@ -3,6 +3,8 @@
 import aws.cryptography.esdk.testserver.server.error.OperationWrapper;
 import aws.cryptography.esdk.testserver.server.model.DecryptStreamInput;
 import aws.cryptography.esdk.testserver.server.model.DecryptStreamOutput;
+import aws.cryptography.esdk.testserver.server.model.ESDKAlgorithmSuiteId;
+import aws.cryptography.esdk.testserver.server.registry.DecryptMetadata;
 import aws.cryptography.esdk.testserver.server.registry.EsdkClient;
 import aws.cryptography.esdk.testserver.server.service.DecryptStreamOperation;
 import java.io.ByteArrayInputStream;
@@ -41,12 +43,15 @@ public DecryptStreamOutput decryptStream(DecryptStreamInput input, RequestContex
             // Drive the ESDK STREAMING API even though the payload rides as a blob:
             // wrap the received bytes in a stream, stream-decrypt, collect the bytes.
             ByteArrayOutputStream plaintext = new ByteArrayOutputStream();
+            DecryptMetadata metadata;
             try (InputStream ciphertext =
                      new ByteArrayInputStream(Blobs.toArray(input.getCiphertext()))) {
-                client.decryptStream(ciphertext, plaintext, input.getEncryptionContext());
+                metadata = client.decryptStream(ciphertext, plaintext, input.getEncryptionContext());
             }
             return DecryptStreamOutput.builder()
                 .plaintext(ByteBuffer.wrap(plaintext.toByteArray()))
+                .encryptionContext(metadata.encryptionContext())
+                .algorithmSuiteId(ESDKAlgorithmSuiteId.from(metadata.algorithmSuiteId()))
                 .build();
         });
     }

test-server/server/src/main/java/aws/cryptography/esdk/testserver/server/registry/DecryptMetadata.java

@@ -0,0 +1,14 @@
+package aws.cryptography.esdk.testserver.server.registry;
+
+import java.util.Map;
+
+/**
+ * What the ESDK read from a message it decrypted: the authenticated encryption
+ * context and the algorithm suite, which the decrypt responses expose.
+ *
+ * @param encryptionContext the message's encryption context.
+ * @param algorithmSuiteId the suite's {@code CryptoAlgorithm} name, which matches
+ *     the modeled {@code ESDKAlgorithmSuiteId} value.
+ */
+public record DecryptMetadata(Map<String, String> encryptionContext, String algorithmSuiteId) {
+}

test-server/server/src/main/java/aws/cryptography/esdk/testserver/server/registry/DecryptResult.java

@@ -0,0 +1,10 @@
+package aws.cryptography.esdk.testserver.server.registry;
+
+/**
+ * The result of a blob decrypt.
+ *
+ * @param plaintext the plaintext bytes.
+ * @param metadata the encryption context and suite of the decrypted message.
+ */
+public record DecryptResult(byte[] plaintext, DecryptMetadata metadata) {
+}

test-server/server/src/main/java/aws/cryptography/esdk/testserver/server/registry/EsdkClient.java

@@ -41,10 +41,10 @@ byte[] encrypt(byte[] plaintext, Map<String, String> encryptionContext,
      * @param ciphertext the ciphertext bytes.
      * @param encryptionContext optional encryption context to require on decrypt;
      *     may be empty but not {@code null}.
-     * @return the plaintext bytes.
+     * @return the plaintext bytes and the message's encryption context and suite.
      * @throws EsdkClientException if the ESDK client fails (Requirement 4.10).
      */
-    byte[] decrypt(byte[] ciphertext, Map<String, String> encryptionContext)
+    DecryptResult decrypt(byte[] ciphertext, Map<String, String> encryptionContext)
         throws EsdkClientException;
 
     /**
@@ -61,10 +61,11 @@ void encryptStream(InputStream plaintext, OutputStream ciphertext,
      * Decrypt a ciphertext stream into a plaintext stream (Stream_Variant,
      * Requirement 4.6). Only meaningful when {@link #isStreamingCapable()}.
      *
+     * @return the message's encryption context and suite.
      * @throws EsdkClientException if the ESDK client fails (Requirement 4.10).
      */
-    void decryptStream(InputStream ciphertext, OutputStream plaintext,
-                       Map<String, String> encryptionContext) throws EsdkClientException;
+    DecryptMetadata decryptStream(InputStream ciphertext, OutputStream plaintext,
+                                  Map<String, String> encryptionContext) throws EsdkClientException;
 
     /**
      * @return whether the backing ESDK implementation supports the Stream_Variant.

test-server/server/src/main/java/aws/cryptography/esdk/testserver/server/registry/RealEsdkClient.java

@@ -70,20 +70,20 @@ public byte[] encrypt(byte[] plaintext, Map<String, String> encryptionContext,
     }
 
     @Override
-    public byte[] decrypt(byte[] ciphertext, Map<String, String> encryptionContext)
+    public DecryptResult decrypt(byte[] ciphertext, Map<String, String> encryptionContext)
         throws EsdkClientException {
         try {
             AwsCrypto crypto = buildCrypto(null, null);
             Map<String, String> ec = nonNull(encryptionContext);
             if (legacyCmm != null) {
                 CryptoResult<byte[], ?> result = crypto.decryptData(legacyCmm, ciphertext);
                 requireReproducedContext(ec, result.getEncryptionContext());
-                return result.getResult();
+                return new DecryptResult(result.getResult(), metadata(result));
             }
             CryptoResult<byte[], ?> result = ec.isEmpty()
                 ? crypto.decryptData(cmm, ciphertext)
                 : crypto.decryptData(cmm, ciphertext, ec);
-            return result.getResult();
+            return new DecryptResult(result.getResult(), metadata(result));
         } catch (Exception esdkFailure) {
             throw new EsdkClientException(esdkFailure);
         }
@@ -113,8 +113,8 @@ public void encryptStream(InputStream plaintext, OutputStream ciphertext,
     }
 
     @Override
-    public void decryptStream(InputStream ciphertext, OutputStream plaintext,
-                              Map<String, String> encryptionContext) throws EsdkClientException {
+    public DecryptMetadata decryptStream(InputStream ciphertext, OutputStream plaintext,
+                                         Map<String, String> encryptionContext) throws EsdkClientException {
         try {
             AwsCrypto crypto = buildCrypto(null, null);
             Map<String, String> ec = nonNull(encryptionContext);
@@ -132,6 +132,7 @@ public void decryptStream(InputStream ciphertext, OutputStream plaintext,
                     requireReproducedContext(ec, decrypting.getCryptoResult().getEncryptionContext());
                 }
                 decrypting.transferTo(plaintext);
+                return metadata(decrypting.getCryptoResult());
             }
         } catch (Exception esdkFailure) {
             throw new EsdkClientException(esdkFailure);
@@ -179,6 +180,10 @@ private static void requireReproducedContext(Map<String, String> reproduced,
         }
     }
 
+    private static DecryptMetadata metadata(CryptoResult<?, ?> result) {
+        return new DecryptMetadata(result.getEncryptionContext(), result.getCryptoAlgorithm().name());
+    }
+
     private static Map<String, String> nonNull(Map<String, String> encryptionContext) {
         return encryptionContext == null ? Collections.emptyMap() : encryptionContext;
     }

test-server/server/src/test/java/aws/cryptography/esdk/testserver/server/handler/ControllableEsdkClient.java

@@ -1,6 +1,8 @@
 package aws.cryptography.esdk.testserver.server.handler;
 
 import aws.cryptography.esdk.testserver.server.error.EsdkClientException;
+import aws.cryptography.esdk.testserver.server.registry.DecryptMetadata;
+import aws.cryptography.esdk.testserver.server.registry.DecryptResult;
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.util.Map;
@@ -18,6 +20,9 @@ final class ControllableEsdkClient implements aws.cryptography.esdk.testserver.s
 
     enum Mode { SUCCEED, FAIL_ESDK, FAIL_FRAMEWORK }
 
+    private static final DecryptMetadata METADATA =
+        new DecryptMetadata(Map.of(), "ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY");
+
     private final Mode mode;
     private final String failureMessage;
     private final AtomicInteger cryptoCalls = new AtomicInteger();
@@ -63,9 +68,9 @@ public byte[] encrypt(byte[] plaintext, Map<String, String> encryptionContext,
     }
 
     @Override
-    public byte[] decrypt(byte[] ciphertext, Map<String, String> encryptionContext)
+    public DecryptResult decrypt(byte[] ciphertext, Map<String, String> encryptionContext)
         throws EsdkClientException {
-        return act(ciphertext);
+        return new DecryptResult(act(ciphertext), METADATA);
     }
 
     @Override
@@ -76,9 +81,10 @@ public void encryptStream(InputStream plaintext, OutputStream ciphertext,
     }
 
     @Override
-    public void decryptStream(InputStream ciphertext, OutputStream plaintext,
-                              Map<String, String> encryptionContext) throws EsdkClientException {
+    public DecryptMetadata decryptStream(InputStream ciphertext, OutputStream plaintext,
+                                         Map<String, String> encryptionContext) throws EsdkClientException {
         act(new byte[0]);
+        return METADATA;
     }
 
     @Override

test-server/server/src/test/java/aws/cryptography/esdk/testserver/server/registry/StubEsdkClient.java

@@ -23,7 +23,7 @@ public byte[] encrypt(byte[] plaintext, Map<String, String> encryptionContext,
     }
 
     @Override
-    public byte[] decrypt(byte[] ciphertext, Map<String, String> encryptionContext) {
+    public DecryptResult decrypt(byte[] ciphertext, Map<String, String> encryptionContext) {
         throw new UnsupportedOperationException("StubEsdkClient does not decrypt");
     }
 
@@ -35,8 +35,8 @@ public void encryptStream(InputStream plaintext, OutputStream ciphertext,
     }
 
     @Override
-    public void decryptStream(InputStream ciphertext, OutputStream plaintext,
-                              Map<String, String> encryptionContext) throws EsdkClientException {
+    public DecryptMetadata decryptStream(InputStream ciphertext, OutputStream plaintext,
+                                         Map<String, String> encryptionContext) throws EsdkClientException {
         throw new UnsupportedOperationException("StubEsdkClient does not stream");
     }