Repository navigation
Conversation
… end
The v3 -> v4 suite covers data Stack 1.x wrote. Customers still on
Protect.js hold EQL v2 data written by an older client (protect-ffi
0.18.1, cipherstash-client 0.28), and nothing showed that data can
reach v4 and keep answering the same queries.
The new suite writes v2 rows with the real @cipherstash/protect@10.2.1
into eql_v2_encrypted columns and queries them with its own search
terms. It then runs the same migration as the v3 suite: add a v4 column
per v2 column, decrypt with the engine Stack 1.x encrypts through
(in-tree protect-ffi, which still reads v2), re-encrypt through the v4
codec, and check equality, ORE range and ordering, and match queries
return the same rows from both columns. Every v4 value must decrypt to
the original plaintext, and the v4 columns must still answer after the
cut-over rename. Protect's dataType('number') encrypted a float64, so
that column migrates to DoubleOrdOre rather than an integer type.
v2 hazards are pinned too: a v2 payload cast into a v4 column fails the
domain CHECK, and relabelling `v` gives a value Stack Encrypt refuses.
@cipherstash/protect@10.2.1 is added exact-pinned as a dev dependency of
the private integration-tests package. It is loaded through import()
because its `types` export condition names ESM declarations.
|
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Proves that data written by Protect.js, the client before Stack, can be moved to the new EQL v4 format and keeps answering the same queries. EQL is the format CipherStash uses to store encrypted values in Postgres. Protect.js wrote EQL v2, and v4 is what the new Stack Encrypt engine writes. Getting from one to the other means decrypting and re-encrypting every value. The v2 rows here are written by the real
@cipherstash/protect@10.2.1, not by today's client pretending to be old.Stacked on #1496 (EQL v3 → v4). Review that one first. This PR's diff is only the v2 part.
Changes
integration-tests/tests/migrate-v2-to-v4.test.ts(9 tests), following the same steps as the v3 suite:eql_v2_encryptedcolumns, and its owncreateSearchTermsqueries them as a baseline.equality()→TextEq,freeTextSearch()→TextMatch, a plain boolean →Boolean. Protect'sdataType('number')encrypted a 64-bit float, soorderAndRange()on it becomesDoubleOrdOre, not an integer type.vto 4 gives a value Stack Encrypt refuses to open.tests/v4-codec.tsaddsDoubleOrdOreto the type list.Supply chain note
New dev-only dependency of the private
@cipherstash/ffi-integration-testspackage, which is never published:@cipherstash/protect@10.2.1, exact-pinned. It is the same pin #1436 adds to@cipherstash/e2e. Its transitive packages (@cipherstash/protect-ffi@0.18.1and its platform packages,@cipherstash/schema, and others) are added topnpm-lock.yaml. No install scripts, and nothing added toonlyBuiltDependencies.Protect 10.2.1 is loaded with
import(), because itstypesexport condition points at ESM declarations, which TypeScript won't import statically into this CommonJS suite. Its plaintext type leaves outbooleaneven though it encrypts booleans (#1436 pins that), so the test casts at that one call.No changeset: only test code and a private package's dev dependencies changed.
Verification
pnpm run typecheckin integration-tests: clean.pnpm run test:scripts: 85 files passed.pnpm install --frozen-lockfile: clean.integration-protect-ffi.ymlrun 41371866544 passed.migrate-v2-to-v4.test.tspassed 9/9 andmigrate-v3-to-v4.test.ts11/11, with 22 suite files passing in total. It wasn't run locally: Protect 10.2.1 reads credentials only fromCS_*environment variables, and those weren't set on the local machine.Related
Stacked on #1496. Refs #1436.