fix(proxy): use specific EqlTraits on encrypted columns (instead of EqlTrait::all())#391
fix(proxy): use specific EqlTraits on encrypted columns (instead of EqlTrait::all())#391freshtonic wants to merge 2 commits intomainfrom
EqlTraits on encrypted columns (instead of EqlTrait::all())#391Conversation
…-suite Picks up the in-flight OPE work in cipherstash-suite that hasn't been published yet. The newer suite renames Plaintext::Utf8Str → Text and Plaintext::JsonB → Json (same for ColumnType); this commit applies the mechanical follow-on changes in the proxy. Workspace builds clean and proxy unit tests (97) pass. The path override is temporary; the workspace dep should be reverted to the crates.io version once cipherstash-suite is published.
The schema loader previously stamped every `eql_v2_encrypted` column with `EqlTraits::all()`, which over-promised to the eql-mapper that every encrypted column supports every operation. The mapper would then permit SQL the database can't actually execute (e.g. `LIKE` against a column with only a `unique` index). Derive the traits from the column's configured indexes instead: - `unique` → Eq - `ore` / `ope` → Ord (implies Eq) - `match` → TokenMatch - `ste_vec` → JsonLike (implies Ord+Eq) and Contain Plumb the `EncryptConfigManager` into `SchemaManager` so each schema reload reads a fresh encrypt-config snapshot. Reorder the explicit DatabaseSchema reload to load encrypt-config first, ensuring the schema sees the latest per-column index list.
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (7)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
| let eql_traits = encrypt_config | ||
| .get_column_config(&identifier) | ||
| .map(|config| eql_traits_from_indexes(&config.indexes)) | ||
| .unwrap_or_default(); |
There was a problem hiding this comment.
Encrypted without config has silent fallback.
Log may be helpful here
.unwrap_or_else(|| {
warn!(
target: SCHEMA,
msg = "eql_v2_encrypted column has no encrypt_config entry; refusing all encrypted operations",
table = table_name,
column = col,
);
EqlTraits::none()
});
| let _ = responder.send(()); | ||
| } | ||
| ReloadCommand::EncryptSchema(responder) => { | ||
| encrypt_config_manager.reload().await; |
There was a problem hiding this comment.
The ReloadCommand::EncryptSchema should probably refresh the database schema now the calls are dependent.
ReloadCommand::EncryptSchema(responder) => {
encrypt_config_manager.reload().await;
schema_manager.reload().await;
let _ = responder.send(());
}
2 participants
Acknowledgment
By submitting this pull request, I confirm that CipherStash can use, modify, copy, and redistribute this contribution, under the terms of CipherStash's choice.