Repository navigation
Conversation
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the
 |
… end
The v3 -> v4 suite covers data Stack 1.x wrote. Customers still on
Protect.js hold EQL v2 data written by an older client (protect-ffi
0.18.1, cipherstash-client 0.28), and nothing showed that data can
reach v4 and keep answering the same queries.
The new suite writes v2 rows with the real @cipherstash/protect@10.2.1
into eql_v2_encrypted columns and queries them with its own search
terms. It then runs the same migration as the v3 suite: add a v4 column
per v2 column, decrypt with the engine Stack 1.x encrypts through
(in-tree protect-ffi, which still reads v2), re-encrypt through the v4
codec, and check equality, ORE range and ordering, and match queries
return the same rows from both columns. Every v4 value must decrypt to
the original plaintext, and the v4 columns must still answer after the
cut-over rename. Protect's dataType('number') encrypted a float64, so
that column migrates to DoubleOrdOre rather than an integer type.
v2 hazards are pinned too: a v2 payload cast into a v4 column fails the
domain CHECK, and relabelling `v` gives a value Stack Encrypt refuses.
@cipherstash/protect@10.2.1 is added exact-pinned as a dev dependency of
the private integration-tests package. It is loaded through import()
because its `types` export condition names ESM declarations.
7304baa to
504bce0
Compare
Summary
Proves that data written by Protect.js, the client before Stack, can be moved to the new EQL v4 format and keeps answering the same queries. EQL is the format CipherStash uses to store encrypted values in Postgres. Protect.js wrote EQL v2, and v4 is what the new Stack Encrypt engine writes. Getting from one to the other means decrypting and re-encrypting every value. The v2 rows here are written by the real
@cipherstash/protect@10.2.1, not by today's client pretending to be old.Stacked on #1496 (EQL v3 → v4). Review that one first. This PR's diff is only the v2 part.
Changes
integration-tests/tests/migrate-v2-to-v4.test.ts(9 tests), following the same steps as the v3 suite:eql_v2_encryptedcolumns, and its owncreateSearchTermsqueries them as a baseline.equality()→TextEq,freeTextSearch()→TextMatch, a plain boolean →Boolean. Protect'sdataType('number')encrypted a 64-bit float, soorderAndRange()on it becomesDoubleOrdOre, not an integer type.vto 4 gives a value Stack Encrypt refuses to open.tests/v4-codec.tsaddsDoubleOrdOreto the type list.Supply chain note
New dev-only dependency of the private
@cipherstash/ffi-integration-testspackage, which is never published:@cipherstash/protect@10.2.1, exact-pinned. It is the same pin #1436 adds to@cipherstash/e2e. Its transitive packages (@cipherstash/protect-ffi@0.18.1and its platform packages,@cipherstash/schema, and others) are added topnpm-lock.yaml. No install scripts, and nothing added toonlyBuiltDependencies.Protect 10.2.1 is loaded with
import(), because itstypesexport condition points at ESM declarations, which TypeScript won't import statically into this CommonJS suite. Its plaintext type leaves outbooleaneven though it encrypts booleans (#1436 pins that), so the test casts at that one call.No changeset: only test code and a private package's dev dependencies changed.
Verification
pnpm run typecheckin integration-tests: clean.pnpm run test:scripts: 85 files passed.pnpm install --frozen-lockfile: clean.integration-protect-ffi.ymlrun 41371866544 passed.migrate-v2-to-v4.test.tspassed 9/9 andmigrate-v3-to-v4.test.ts11/11, with 22 suite files passing in total. It wasn't run locally: Protect 10.2.1 reads credentials only fromCS_*environment variables, and those weren't set on the local machine.Related
Stacked on #1496. Refs #1436.