@cipherstash/protect-ffi 0.16.1 → 0.18.0-9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +15 -6
  2. package/lib/index.cjs +2 -1
  3. package/lib/index.d.cts +114 -40
  4. package/package.json +8 -9
package/README.md CHANGED
@@ -143,13 +143,22 @@ PGHOST=localhost
143
143
  ```
144
144
 
145
145
  To run integration tests:
146
+ ```sh
147
+ mise setup
148
+ mise test:integration
149
+ ```
150
+
151
+ You can also run the integration tests in "watch" mode:
152
+
153
+ ```sh
154
+ mise test:integration --watch
146
155
  ```
147
- npm run debug
148
- cd integration-tests
149
- docker compose up --detach --wait
150
- npm run eql:download
151
- npm run eql:install
152
- npm run test
156
+
157
+ By default lock context tests are not included because invalid lock contexts fire security warnings in ZeroKMS.
158
+ To include these, run:
159
+
160
+ ```sh
161
+ mise test:integration:all
153
162
  ```
154
163
 
155
164
  ## Releasing
package/lib/index.cjs CHANGED
@@ -1,11 +1,12 @@
1
1
  "use strict";
2
2
  // This module is the CJS entry point for the library.
3
3
  Object.defineProperty(exports, "__esModule", { value: true });
4
- exports.decryptBulkFallible = exports.decryptBulk = exports.decrypt = exports.encryptBulk = exports.encrypt = exports.newClient = void 0;
4
+ exports.decryptBulkFallible = exports.decryptBulk = exports.decrypt = exports.isEncrypted = exports.encryptBulk = exports.encrypt = exports.newClient = void 0;
5
5
  var load_cjs_1 = require("./load.cjs");
6
6
  Object.defineProperty(exports, "newClient", { enumerable: true, get: function () { return load_cjs_1.newClient; } });
7
7
  Object.defineProperty(exports, "encrypt", { enumerable: true, get: function () { return load_cjs_1.encrypt; } });
8
8
  Object.defineProperty(exports, "encryptBulk", { enumerable: true, get: function () { return load_cjs_1.encryptBulk; } });
9
+ Object.defineProperty(exports, "isEncrypted", { enumerable: true, get: function () { return load_cjs_1.isEncrypted; } });
9
10
  Object.defineProperty(exports, "decrypt", { enumerable: true, get: function () { return load_cjs_1.decrypt; } });
10
11
  Object.defineProperty(exports, "decryptBulk", { enumerable: true, get: function () { return load_cjs_1.decryptBulk; } });
11
12
  Object.defineProperty(exports, "decryptBulkFallible", { enumerable: true, get: function () { return load_cjs_1.decryptBulkFallible; } });
package/lib/index.d.cts CHANGED
@@ -1,50 +1,87 @@
1
- export { newClient, encrypt, encryptBulk, decrypt, decryptBulk, decryptBulkFallible, } from './load.cjs';
1
+ export { newClient, encrypt, encryptBulk, isEncrypted, decrypt, decryptBulk, decryptBulkFallible, } from './load.cjs';
2
2
  declare const sym: unique symbol;
3
3
  export type Client = {
4
4
  readonly [sym]: unknown;
5
5
  };
6
6
  declare module './load.cjs' {
7
7
  function newClient(opts: NewClientOptions): Promise<Client>;
8
- function encrypt(client: Client, opts: EncryptOptions): Promise<Encrypted>;
9
- function decrypt(client: Client, opts: DecryptOptions): Promise<string>;
10
- function encryptBulk(client: Client, opts: EncryptBulkOptions): Promise<Encrypted[]>;
11
- function decryptBulk(client: Client, opts: DecryptBulkOptions): Promise<string[]>;
12
- function decryptBulkFallible(client: Client, opts: DecryptBulkOptions): Promise<DecryptResult[]>;
8
+ function encrypt<T extends EncryptConfig>(client: Client, opts: EncryptOptions<T>): Promise<AnyEncrypted<T>>;
9
+ function decrypt<T extends EncryptConfig>(client: Client, opts: DecryptOptions<T>): Promise<JsPlaintext>;
10
+ function isEncrypted<T extends EncryptConfig>(encrypted: AnyEncrypted<T>): boolean;
11
+ function encryptQuery<T extends EncryptConfig, Q extends EncryptedQueryTerm>(client: Client, opts: QueryOptions<T>): Promise<Q>;
12
+ function encryptBulk<T extends EncryptConfig>(client: Client, opts: EncryptBulkOptions<T>): Promise<AnyEncrypted<T>[]>;
13
+ function decryptBulk<T extends EncryptConfig>(client: Client, opts: DecryptBulkOptions<T>): Promise<JsPlaintext[]>;
14
+ function decryptBulkFallible<T extends EncryptConfig>(client: Client, opts: DecryptBulkOptions<T>): Promise<DecryptResult[]>;
13
15
  }
14
16
  export type DecryptResult = {
15
17
  data: string;
16
18
  } | {
17
19
  error: string;
18
20
  };
19
- export type EncryptPayload = {
20
- plaintext: string;
21
- column: string;
22
- table: string;
23
- lockContext?: Context;
24
- };
25
- export type BulkDecryptPayload = {
26
- ciphertext: string;
27
- lockContext?: Context;
21
+ export type EncryptPayload<T extends EncryptConfig> = {
22
+ plaintext: JsPlaintext;
23
+ lockContext?: Context[];
24
+ } & Identifier<T>;
25
+ export type BulkDecryptPayload<T extends EncryptConfig> = {
26
+ ciphertext: AnyEncrypted<T>;
27
+ lockContext?: Context[];
28
28
  };
29
29
  export type CtsToken = {
30
30
  accessToken: string;
31
31
  expiry: number;
32
32
  };
33
33
  export type Context = {
34
- identityClaim: string[];
35
- };
36
- export type Encrypted = {
37
- k: string;
38
- c: string;
39
- ob: string[] | null;
40
- bf: number[] | null;
41
- hm: string | null;
42
- i: {
43
- c: string;
44
- t: string;
45
- };
34
+ identityClaim: string;
35
+ } | {
36
+ tag: string;
37
+ };
38
+ export type Versioned = {
46
39
  v: number;
47
40
  };
41
+ export type Base85Ciphertext = string;
42
+ export type BloomFilter = number[];
43
+ export type HMAC = string;
44
+ export type EncodedBlockOREArray = string[];
45
+ export type EncodedFixedLengthORE = string;
46
+ export type EncodedVariableLengthORE = string;
47
+ export type JSONPathSelector = string;
48
+ export type EncryptedCell<T extends EncryptConfig> = Versioned & {
49
+ k: 'ct';
50
+ c: Base85Ciphertext;
51
+ ob: EncodedBlockOREArray | null;
52
+ bf: BloomFilter | null;
53
+ hm: HMAC | null;
54
+ i: Identifier<T>;
55
+ };
56
+ export type EncryptedSV<T extends EncryptConfig> = Versioned & {
57
+ k: 'sv';
58
+ sv: SteVecEncryptedEntry[];
59
+ i: Identifier<T>;
60
+ };
61
+ export type EncryptedSVE = {
62
+ k: 'sve';
63
+ sve: SteVecEncryptedEntry;
64
+ };
65
+ export type AnyEncrypted<T extends EncryptConfig> = EncryptedCell<T> | EncryptedSV<T> | EncryptedSVE;
66
+ export type SteVecEncryptedEntry = {
67
+ c: Base85Ciphertext;
68
+ parent_is_array: boolean;
69
+ } & SteVecTerm & {
70
+ s: JSONPathSelector;
71
+ };
72
+ export type SteVecQuery = {
73
+ svq: SteQueryVecEntry[];
74
+ };
75
+ export type SteQueryVecEntry = {
76
+ s: JSONPathSelector;
77
+ } & SteVecTerm;
78
+ export type SteVecTerm = {
79
+ hm: HMAC;
80
+ } | {
81
+ ocf: EncodedFixedLengthORE;
82
+ } | {
83
+ ocv: EncodedVariableLengthORE;
84
+ };
48
85
  export type EncryptConfig = {
49
86
  v: number;
50
87
  tables: Record<string, Record<string, Column>>;
@@ -54,6 +91,15 @@ export type Column = {
54
91
  indexes?: Indexes;
55
92
  };
56
93
  export type CastAs = 'big_int' | 'boolean' | 'date' | 'real' | 'double' | 'int' | 'small_int' | 'text' | 'jsonb';
94
+ type TablesOf<C extends EncryptConfig> = C['tables'];
95
+ export type Identifier<C extends EncryptConfig> = {
96
+ [T in keyof TablesOf<C>]: {
97
+ [CName in keyof TablesOf<C>[T]]: {
98
+ table: T;
99
+ column: CName;
100
+ };
101
+ }[keyof TablesOf<C>[T]];
102
+ }[keyof TablesOf<C>];
57
103
  export type Indexes = {
58
104
  ore?: OreIndexOpts;
59
105
  unique?: UniqueIndexOpts;
@@ -92,28 +138,56 @@ export type ClientOpts = {
92
138
  accessKey?: string;
93
139
  clientId?: string;
94
140
  clientKey?: string;
141
+ keyset?: IdentifiedBy;
95
142
  };
96
- export type EncryptOptions = {
97
- plaintext: string;
98
- column: string;
99
- table: string;
100
- lockContext?: Context;
143
+ export type IdentifiedBy = string;
144
+ export type JsPlaintext = string | number | Record<string, unknown> | JsPlaintext[];
145
+ export type EncryptOptions<T extends EncryptConfig> = {
146
+ plaintext: JsPlaintext;
147
+ lockContext?: Context[];
101
148
  serviceToken?: CtsToken;
102
149
  unverifiedContext?: Record<string, unknown>;
103
- };
104
- export type EncryptBulkOptions = {
105
- plaintexts: EncryptPayload[];
150
+ } & Identifier<T>;
151
+ export type EncryptBulkOptions<T extends EncryptConfig> = {
152
+ plaintexts: EncryptPayload<T>[];
106
153
  serviceToken?: CtsToken;
107
154
  unverifiedContext?: Record<string, unknown>;
108
155
  };
109
- export type DecryptOptions = {
110
- ciphertext: string;
111
- lockContext?: Context;
156
+ export type DecryptOptions<T extends EncryptConfig> = {
157
+ ciphertext: AnyEncrypted<T>;
158
+ lockContext?: Context[];
112
159
  serviceToken?: CtsToken;
113
160
  unverifiedContext?: Record<string, unknown>;
114
161
  };
115
- export type DecryptBulkOptions = {
116
- ciphertexts: BulkDecryptPayload[];
162
+ export type DecryptBulkOptions<T extends EncryptConfig> = {
163
+ ciphertexts: BulkDecryptPayload<T>[];
117
164
  serviceToken?: CtsToken;
118
165
  unverifiedContext?: Record<string, unknown>;
119
166
  };
167
+ export type QueryOptions<T extends EncryptConfig> = {
168
+ plaintext: JsPlaintext;
169
+ operator: QueryOperator;
170
+ } & Identifier<T>;
171
+ export type NumericOperator = '>' | '>=' | '<' | '<=' | '=';
172
+ export type StringOperator = '~~' | '~~*' | '=';
173
+ export type JsonbOperator = '@>' | '<@' | '->';
174
+ export type QueryOperator = NumericOperator | StringOperator | JsonbOperator;
175
+ export type EncryptedQueryTerm = {};
176
+ export interface RangeQuery extends EncryptedQueryTerm {
177
+ ob: EncodedBlockOREArray;
178
+ }
179
+ export interface MatchQuery extends EncryptedQueryTerm {
180
+ bf: BloomFilter;
181
+ }
182
+ export interface ExactQuery extends EncryptedQueryTerm {
183
+ hm: HMAC;
184
+ }
185
+ export interface JsonSelect extends EncryptedQueryTerm {
186
+ s: JSONPathSelector;
187
+ }
188
+ export interface JsonContainsQuery extends EncryptedQueryTerm {
189
+ sv: SteQueryVecEntry[];
190
+ }
191
+ export interface JsonIsContainedByQuery extends EncryptedQueryTerm {
192
+ sv: SteQueryVecEntry[];
193
+ }
package/package.json CHANGED
@@ -1,16 +1,15 @@
1
1
  {
2
2
  "name": "@cipherstash/protect-ffi",
3
- "version": "0.16.1",
3
+ "version": "0.18.0-9",
4
4
  "description": "",
5
5
  "main": "./lib/index.cjs",
6
6
  "scripts": {
7
7
  "test": "npm run test:typecheck && npm run test:lint && npm run test:format && npm run test:rust",
8
8
  "test:typecheck": "tsc",
9
9
  "test:rust": "cargo test",
10
- "test:lint": "npm run test:lint:rust && npm run test:lint:ts",
10
+ "test:lint": "npm run test:lint:ts",
11
11
  "test:lint:ts": "biome lint",
12
- "test:lint:rust": "cargo clippy --all --no-deps --all-targets --all-features -- -D warnings",
13
- "test:format": "npm run test:format:rust && npm run test:format:ts",
12
+ "test:format": "npm run test:format:ts",
14
13
  "test:format:ts": "biome format",
15
14
  "test:format:rust": "cargo fmt --check",
16
15
  "cargo-build": "tsc &&cargo build --message-format=json-render-diagnostics > cargo.log",
@@ -61,10 +60,10 @@
61
60
  "@neon-rs/load": "^0.1.82"
62
61
  },
63
62
  "optionalDependencies": {
64
- "@cipherstash/protect-ffi-win32-x64-msvc": "0.16.1",
65
- "@cipherstash/protect-ffi-darwin-x64": "0.16.1",
66
- "@cipherstash/protect-ffi-darwin-arm64": "0.16.1",
67
- "@cipherstash/protect-ffi-linux-x64-gnu": "0.16.1",
68
- "@cipherstash/protect-ffi-linux-arm64-gnu": "0.16.1"
63
+ "@cipherstash/protect-ffi-win32-x64-msvc": "0.18.0-9",
64
+ "@cipherstash/protect-ffi-darwin-x64": "0.18.0-9",
65
+ "@cipherstash/protect-ffi-darwin-arm64": "0.18.0-9",
66
+ "@cipherstash/protect-ffi-linux-x64-gnu": "0.18.0-9",
67
+ "@cipherstash/protect-ffi-linux-arm64-gnu": "0.18.0-9"
69
68
  }
70
69
  }