@proteinjs/db-driver-spanner 1.23.5 → 1.24.0

package/dist/test/EncryptionPerf.test.js

@@ -0,0 +1,278 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var db_1 = require("@proteinjs/db");
+var db_driver_spanner_1 = require("@proteinjs/db-driver-spanner");
+var db_transaction_context_1 = require("@proteinjs/db-transaction-context");
+var getDropTestTable_1 = require("./util/getDropTestTable");
+var SpannerEmulatorProvisioner_1 = require("./util/SpannerEmulatorProvisioner");
+var columnEncryptionTestTables_1 = require("./util/columnEncryptionTestTables");
+var columnEncryptionTestHarness_1 = require("./util/columnEncryptionTestHarness");
+var test_1 = require("@proteinjs/db/test");
+require("../generated/test/index");
+var spannerDriver = new db_driver_spanner_1.SpannerDriver({
+    projectId: 'proteinjs-test',
+    instanceName: 'proteinjs-test',
+    databaseName: 'test',
+});
+globalThis['__proteinjs_db_defaultDbDriver'] = spannerDriver;
+var OWNER = 'enc-perf-owner-a';
+var ROW_COUNT = 1000;
+var encTable = new columnEncryptionTestTables_1.EncPerfRowTable();
+var plainTable = new columnEncryptionTestTables_1.PlainPerfRowTable();
+var db = new db_1.Db(spannerDriver, undefined, new db_transaction_context_1.TransactionContext());
+/**
+ * Performance sanity for the doc's claims (TRUST_AND_COMPLIANCE §1.5): per-value AES-256-GCM
+ * decrypt ~1-3µs in Node; a 1k-row read's decrypt overhead an order of magnitude below the
+ * database/network latency the read already pays. Numbers are printed for the report.
+ */
+describe('Column encryption performance sanity', function () {
+    var dropTable = (0, getDropTestTable_1.getDropTestTable)(spannerDriver);
+    var tableManager = spannerDriver.getTableManager();
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var body, _loop_1, batch;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, SpannerEmulatorProvisioner_1.SpannerEmulatorProvisioner.ensureProvisioned({
+                        projectId: 'proteinjs-test',
+                        instanceName: 'proteinjs-test',
+                        databaseName: 'test',
+                    })];
+                case 1:
+                    _a.sent();
+                    (0, test_1.registerTestUser)();
+                    (0, db_1.setDbEncryptionConfig)({
+                        masterKeyProvider: new db_1.InMemoryMasterKeyProvider('column-encryption-test'),
+                        getAccessibleKeyOwners: function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, [OWNER]];
+                        }); }); },
+                    });
+                    return [4 /*yield*/, (0, columnEncryptionTestHarness_1.loadColumnEncryptionTestSchema)(tableManager, [encTable, plainTable])];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, (0, columnEncryptionTestHarness_1.purgeColumnEncryptionTestRows)(spannerDriver, [encTable, plainTable])];
+                case 3:
+                    _a.sent();
+                    body = function (index) {
+                        return "note body ".concat(index, " \u2014 a sentence of ordinary length, the kind a document row actually stores in practice.");
+                    };
+                    _loop_1 = function (batch) {
+                        return __generator(this, function (_b) {
+                            switch (_b.label) {
+                                case 0: return [4 /*yield*/, db.runTransaction(function () { return __awaiter(void 0, void 0, void 0, function () {
+                                        var i, index;
+                                        return __generator(this, function (_a) {
+                                            switch (_a.label) {
+                                                case 0:
+                                                    i = 0;
+                                                    _a.label = 1;
+                                                case 1:
+                                                    if (!(i < 100)) return [3 /*break*/, 4];
+                                                    index = batch * 100 + i;
+                                                    return [4 /*yield*/, db.insert(encTable, { scope: OWNER, body: body(index) })];
+                                                case 2:
+                                                    _a.sent();
+                                                    _a.label = 3;
+                                                case 3:
+                                                    i++;
+                                                    return [3 /*break*/, 1];
+                                                case 4: return [2 /*return*/];
+                                            }
+                                        });
+                                    }); })];
+                                case 1:
+                                    _b.sent();
+                                    return [4 /*yield*/, db.runTransaction(function () { return __awaiter(void 0, void 0, void 0, function () {
+                                            var i, index;
+                                            return __generator(this, function (_a) {
+                                                switch (_a.label) {
+                                                    case 0:
+                                                        i = 0;
+                                                        _a.label = 1;
+                                                    case 1:
+                                                        if (!(i < 100)) return [3 /*break*/, 4];
+                                                        index = batch * 100 + i;
+                                                        return [4 /*yield*/, db.insert(plainTable, { scope: OWNER, body: body(index) })];
+                                                    case 2:
+                                                        _a.sent();
+                                                        _a.label = 3;
+                                                    case 3:
+                                                        i++;
+                                                        return [3 /*break*/, 1];
+                                                    case 4: return [2 /*return*/];
+                                                }
+                                            });
+                                        }); })];
+                                case 2:
+                                    _b.sent();
+                                    return [2 /*return*/];
+                            }
+                        });
+                    };
+                    batch = 0;
+                    _a.label = 4;
+                case 4:
+                    if (!(batch < ROW_COUNT / 100)) return [3 /*break*/, 7];
+                    return [5 /*yield**/, _loop_1(batch)];
+                case 5:
+                    _a.sent();
+                    _a.label = 6;
+                case 6:
+                    batch++;
+                    return [3 /*break*/, 4];
+                case 7: return [2 /*return*/];
+            }
+        });
+    }); }, 600000);
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    (0, db_1.setDbEncryptionConfig)(undefined);
+                    (0, test_1.clearTestUser)();
+                    return [4 /*yield*/, dropTable(encTable)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, dropTable(plainTable)];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, SpannerEmulatorProvisioner_1.SpannerEmulatorProvisioner.release()];
+                case 3:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 120000);
+    var timeQuery = function (table) { return __awaiter(void 0, void 0, void 0, function () {
+        var start, rows, ms;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    start = process.hrtime.bigint();
+                    return [4 /*yield*/, db.query(table, new db_1.QueryBuilder(table.name).condition({ field: 'scope', operator: '=', value: OWNER }))];
+                case 1:
+                    rows = _a.sent();
+                    ms = Number(process.hrtime.bigint() - start) / 1e6;
+                    return [2 /*return*/, { ms: ms, rows: rows.length }];
+            }
+        });
+    }); };
+    test('1k-row read: decrypt overhead measured against the plaintext twin', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var samples, encTotal, plainTotal, i, _a, _b, encAvg, plainAvg, overheadMs, perValueUs, encRows;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: 
+                // warm the key cache + driver sessions
+                return [4 /*yield*/, timeQuery(encTable)];
+                case 1:
+                    // warm the key cache + driver sessions
+                    _c.sent();
+                    return [4 /*yield*/, timeQuery(plainTable)];
+                case 2:
+                    _c.sent();
+                    samples = 5;
+                    encTotal = 0;
+                    plainTotal = 0;
+                    i = 0;
+                    _c.label = 3;
+                case 3:
+                    if (!(i < samples)) return [3 /*break*/, 7];
+                    _a = encTotal;
+                    return [4 /*yield*/, timeQuery(encTable)];
+                case 4:
+                    encTotal = _a + (_c.sent()).ms;
+                    _b = plainTotal;
+                    return [4 /*yield*/, timeQuery(plainTable)];
+                case 5:
+                    plainTotal = _b + (_c.sent()).ms;
+                    _c.label = 6;
+                case 6:
+                    i++;
+                    return [3 /*break*/, 3];
+                case 7:
+                    encAvg = encTotal / samples;
+                    plainAvg = plainTotal / samples;
+                    overheadMs = encAvg - plainAvg;
+                    perValueUs = (overheadMs * 1000) / ROW_COUNT;
+                    // eslint-disable-next-line no-console
+                    console.info("[perf] 1k-row read: encrypted ".concat(encAvg.toFixed(1), "ms vs plaintext ").concat(plainAvg.toFixed(1), "ms \u2014 ") +
+                        "decrypt overhead ".concat(overheadMs.toFixed(1), "ms total, ~").concat(perValueUs.toFixed(2), "\u00B5s/value (doc claim: ~1-3\u00B5s/value)"));
+                    return [4 /*yield*/, db.query(encTable, new db_1.QueryBuilder(encTable.name).condition({ field: 'scope', operator: '=', value: OWNER }))];
+                case 8:
+                    encRows = _c.sent();
+                    expect(encRows.length).toBe(ROW_COUNT);
+                    // Sanity bound, generous (emulator variance): the whole-read overhead stays well under
+                    // the read itself — decrypt must not dominate.
+                    expect(overheadMs).toBeLessThan(Math.max(plainAvg, 250));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    test('per-value decrypt microbenchmark: the in-process AES-256-GCM cost itself', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var key, envelope, value, encrypted, iterations, i, start, i, totalUs, perValueUs;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, new db_1.DataKeyStore().getWriteKey(OWNER)];
+                case 1:
+                    key = _a.sent();
+                    envelope = new db_1.EncryptionEnvelope();
+                    value = 'note body — a sentence of ordinary length, the kind a document row actually stores in practice.';
+                    encrypted = envelope.encrypt(value, key);
+                    iterations = 10000;
+                    // warm
+                    for (i = 0; i < 1000; i++) {
+                        envelope.decrypt(encrypted, key);
+                    }
+                    start = process.hrtime.bigint();
+                    for (i = 0; i < iterations; i++) {
+                        envelope.decrypt(encrypted, key);
+                    }
+                    totalUs = Number(process.hrtime.bigint() - start) / 1e3;
+                    perValueUs = totalUs / iterations;
+                    // eslint-disable-next-line no-console
+                    console.info("[perf] in-process decrypt: ".concat(perValueUs.toFixed(2), "\u00B5s/value over ").concat(iterations, " iterations ") +
+                        "(doc claim: ~1-3\u00B5s/value)");
+                    expect(envelope.decrypt(encrypted, key)).toBe(value);
+                    // The claim's order of magnitude, with generous headroom for slow machines
+                    expect(perValueUs).toBeLessThan(30);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=EncryptionPerf.test.js.map

package/dist/test/EncryptionPerf.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptionPerf.test.js","sourceRoot":"","sources":["../../test/EncryptionPerf.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAQuB;AACvB,kEAA6D;AAC7D,4EAAuE;AACvE,4DAA2D;AAC3D,gFAA+E;AAC/E,gFAAmG;AACnG,kFAAmH;AACnH,2CAAqE;AACrE,mCAAiC;AAEjC,IAAM,aAAa,GAAG,IAAI,iCAAa,CAAC;IACtC,SAAS,EAAE,gBAAgB;IAC3B,YAAY,EAAE,gBAAgB;IAC9B,YAAY,EAAE,MAAM;CACrB,CAAC,CAAC;AAEF,UAAkB,CAAC,gCAAgC,CAAC,GAAG,aAAa,CAAC;AAEtE,IAAM,KAAK,GAAG,kBAAkB,CAAC;AACjC,IAAM,SAAS,GAAG,IAAI,CAAC;AAEvB,IAAM,QAAQ,GAAG,IAAI,4CAAe,EAAuB,CAAC;AAC5D,IAAM,UAAU,GAAG,IAAI,8CAAiB,EAAuB,CAAC;AAChE,IAAM,EAAE,GAAG,IAAI,OAAE,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,2CAAkB,EAAE,CAAC,CAAC;AAEtE;;;;GAIG;AACH,QAAQ,CAAC,sCAAsC,EAAE;IAC/C,IAAM,SAAS,GAAG,IAAA,mCAAgB,EAAC,aAAa,CAAC,CAAC;IAClD,IAAM,YAAY,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;IAErD,SAAS,CAAC;;;;wBACR,qBAAM,uDAA0B,CAAC,iBAAiB,CAAC;wBACjD,SAAS,EAAE,gBAAgB;wBAC3B,YAAY,EAAE,gBAAgB;wBAC9B,YAAY,EAAE,MAAM;qBACrB,CAAC,EAAA;;oBAJF,SAIE,CAAC;oBACH,IAAA,uBAAgB,GAAE,CAAC;oBACnB,IAAA,0BAAqB,EAAC;wBACpB,iBAAiB,EAAE,IAAI,8BAAyB,CAAC,wBAAwB,CAAC;wBAC1E,sBAAsB,EAAE;4BAAY,sBAAA,CAAC,KAAK,CAAC,EAAA;iCAAA;qBAC5C,CAAC,CAAC;oBACH,qBAAM,IAAA,4DAA8B,EAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,EAAA;;oBAA1E,SAA0E,CAAC;oBAC3E,qBAAM,IAAA,2DAA6B,EAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,EAAA;;oBAA1E,SAA0E,CAAC;oBAIrE,IAAI,GAAG,UAAC,KAAa;wBACzB,OAAA,oBAAa,KAAK,gGAAwF;oBAA1G,CAA0G,CAAC;wCACpG,KAAK;;;wCACZ,qBAAM,EAAE,CAAC,cAAc,CAAC;;;;;oDACb,CAAC,GAAG,CAAC;;;yDAAE,CAAA,CAAC,GAAG,GAAG,CAAA;oDACf,KAAK,GAAG,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC;oDAC9B,qBAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAA;;oDAA9D,SAA8D,CAAC;;;oDAFxC,CAAC,EAAE,CAAA;;;;;yCAI7B,CAAC,EAAA;;oCALF,SAKE,CAAC;oCACH,qBAAM,EAAE,CAAC,cAAc,CAAC;;;;;wDACb,CAAC,GAAG,CAAC;;;6DAAE,CAAA,CAAC,GAAG,GAAG,CAAA;wDACf,KAAK,GAAG,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC;wDAC9B,qBAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAA;;wDAAhE,SAAgE,CAAC;;;wDAF1C,CAAC,EAAE,CAAA;;;;;6CAI7B,CAAC,EAAA;;oCALF,SAKE,CAAC;;;;;oBAZI,KAAK,GAAG,CAAC;;;yBAAE,CAAA,KAAK,GAAG,SAAS,GAAG,GAAG,CAAA;kDAAlC,KAAK;;;;;oBAA+B,KAAK,EAAE,CAAA;;;;;SAcrD,EAAE,MAAM,CAAC,CAAC;IAEX,QAAQ,CAAC;;;;oBACP,IAAA,0BAAqB,EAAC,SAAS,CAAC,CAAC;oBACjC,IAAA,oBAAa,GAAE,CAAC;oBAChB,qBAAM,SAAS,CAAC,QAAQ,CAAC,EAAA;;oBAAzB,SAAyB,CAAC;oBAC1B,qBAAM,SAAS,CAAC,UAAU,CAAC,EAAA;;oBAA3B,SAA2B,CAAC;oBAC5B,qBAAM,uDAA0B,CAAC,OAAO,EAAE,EAAA;;oBAA1C,SAA0C,CAAC;;;;SAC5C,EAAE,MAAM,CAAC,CAAC;IAEX,IAAM,SAAS,GAAG,UAAO,KAAwB;;;;;oBACzC,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;oBACzB,qBAAM,EAAE,CAAC,KAAK,CACzB,KAAK,EACL,IAAI,iBAAY,CAAa,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CACpG,EAAA;;oBAHK,IAAI,GAAG,SAGZ;oBACK,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC;oBACzD,sBAAO,EAAE,EAAE,IAAA,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAC;;;SAClC,CAAC;IAEF,IAAI,CAAC,mEAAmE,EAAE;;;;;gBACxE,uCAAuC;gBACvC,qBAAM,SAAS,CAAC,QAAQ,CAAC,EAAA;;oBADzB,uCAAuC;oBACvC,SAAyB,CAAC;oBAC1B,qBAAM,SAAS,CAAC,UAAU,CAAC,EAAA;;oBAA3B,SAA2B,CAAC;oBAEtB,OAAO,GAAG,CAAC,CAAC;oBACd,QAAQ,GAAG,CAAC,CAAC;oBACb,UAAU,GAAG,CAAC,CAAC;oBACV,CAAC,GAAG,CAAC;;;yBAAE,CAAA,CAAC,GAAG,OAAO,CAAA;oBACzB,KAAA,QAAQ,CAAA;oBAAK,qBAAM,SAAS,CAAC,QAAQ,CAAC,EAAA;;oBAAtC,QAAQ,GAAR,KAAY,CAAC,SAAyB,CAAC,CAAC,EAAE,CAAC;oBAC3C,KAAA,UAAU,CAAA;oBAAK,qBAAM,SAAS,CAAC,UAAU,CAAC,EAAA;;oBAA1C,UAAU,GAAV,KAAc,CAAC,SAA2B,CAAC,CAAC,EAAE,CAAC;;;oBAFpB,CAAC,EAAE,CAAA;;;oBAI1B,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;oBAC5B,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC;oBAChC,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;oBAC/B,UAAU,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC;oBAEnD,sCAAsC;oBACtC,OAAO,CAAC,IAAI,CACV,wCAAiC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,6BAAmB,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,eAAO;wBAC7F,2BAAoB,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAc,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,iDAAoC,CACnH,CAAC;oBAEc,qBAAM,EAAE,CAAC,KAAK,CAC5B,QAAQ,EACR,IAAI,iBAAY,CAAa,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CACvG,EAAA;;oBAHK,OAAO,GAAG,SAGf;oBACD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACvC,uFAAuF;oBACvF,+CAA+C;oBAC/C,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;;;;SAC1D,CAAC,CAAC;IAEH,IAAI,CAAC,0EAA0E,EAAE;;;;wBACnE,qBAAM,IAAI,iBAAY,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,EAAA;;oBAAjD,GAAG,GAAG,SAA2C;oBACjD,QAAQ,GAAG,IAAI,uBAAkB,EAAE,CAAC;oBACpC,KAAK,GAAG,iGAAiG,CAAC;oBAC1G,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAEzC,UAAU,GAAG,KAAK,CAAC;oBACzB,OAAO;oBACP,KAAS,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE;wBAC7B,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;qBAClC;oBACK,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;oBACtC,KAAS,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE;wBACnC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;qBAClC;oBACK,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC;oBACxD,UAAU,GAAG,OAAO,GAAG,UAAU,CAAC;oBAExC,sCAAsC;oBACtC,OAAO,CAAC,IAAI,CACV,qCAA8B,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAiB,UAAU,iBAAc;wBAC1F,gCAA2B,CAC9B,CAAC;oBAEF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACrD,2EAA2E;oBAC3E,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;;;;SACrC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/EncryptionSortAndUnique.test.d.ts

@@ -0,0 +1,2 @@
+import '../generated/test/index';
+//# sourceMappingURL=EncryptionSortAndUnique.test.d.ts.map

package/dist/test/EncryptionSortAndUnique.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptionSortAndUnique.test.d.ts","sourceRoot":"","sources":["../../test/EncryptionSortAndUnique.test.ts"],"names":[],"mappings":"AAgBA,OAAO,yBAAyB,CAAC"}

package/dist/test/EncryptionSortAndUnique.test.js

@@ -0,0 +1,229 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var db_1 = require("@proteinjs/db");
+var db_driver_spanner_1 = require("@proteinjs/db-driver-spanner");
+var db_transaction_context_1 = require("@proteinjs/db-transaction-context");
+var getDropTestTable_1 = require("./util/getDropTestTable");
+var SpannerEmulatorProvisioner_1 = require("./util/SpannerEmulatorProvisioner");
+var columnEncryptionTestTables_1 = require("./util/columnEncryptionTestTables");
+var columnEncryptionTestHarness_1 = require("./util/columnEncryptionTestHarness");
+var test_1 = require("@proteinjs/db/test");
+require("../generated/test/index");
+var spannerDriver = new db_driver_spanner_1.SpannerDriver({
+    projectId: 'proteinjs-test',
+    instanceName: 'proteinjs-test',
+    databaseName: 'test',
+});
+globalThis['__proteinjs_db_defaultDbDriver'] = spannerDriver;
+var OWNER_A = 'enc-sort-owner-a';
+var OWNER_B = 'enc-sort-owner-b';
+var sortedTable = new columnEncryptionTestTables_1.EncSortedItemTable();
+var uniqueTable = new columnEncryptionTestTables_1.EncUniqueTagTable();
+var db = new db_1.Db(spannerDriver, undefined, new db_transaction_context_1.TransactionContext());
+/**
+ * The sortKey tier of the sorting story (a DECLARED bounded reveal → native ORDER BY at any
+ * scale), the loud live rejection without one, and value uniqueness through the equality
+ * fingerprint (per owner).
+ */
+describe('Encrypted sortKey ORDER BY + fingerprint uniqueness', function () {
+    var dropTable = (0, getDropTestTable_1.getDropTestTable)(spannerDriver);
+    var tableManager = spannerDriver.getTableManager();
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, SpannerEmulatorProvisioner_1.SpannerEmulatorProvisioner.ensureProvisioned({
+                        projectId: 'proteinjs-test',
+                        instanceName: 'proteinjs-test',
+                        databaseName: 'test',
+                    })];
+                case 1:
+                    _a.sent();
+                    (0, test_1.registerTestUser)();
+                    (0, db_1.setDbEncryptionConfig)({
+                        masterKeyProvider: new db_1.InMemoryMasterKeyProvider('column-encryption-test'),
+                        getAccessibleKeyOwners: function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, [OWNER_A]];
+                        }); }); },
+                    });
+                    return [4 /*yield*/, (0, columnEncryptionTestHarness_1.loadColumnEncryptionTestSchema)(tableManager, [sortedTable, uniqueTable])];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, (0, columnEncryptionTestHarness_1.purgeColumnEncryptionTestRows)(spannerDriver, [sortedTable, uniqueTable])];
+                case 3:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 120000);
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    (0, db_1.setDbEncryptionConfig)(undefined);
+                    (0, test_1.clearTestUser)();
+                    return [4 /*yield*/, dropTable(new db_1.EncryptedColumns().tokenTableFor(sortedTable))];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, dropTable(sortedTable)];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, dropTable(uniqueTable)];
+                case 3:
+                    _a.sent();
+                    return [4 /*yield*/, SpannerEmulatorProvisioner_1.SpannerEmulatorProvisioner.release()];
+                case 4:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 120000);
+    test('sortKey: native ORDER BY + sorted pagination over encrypted values; only the declared prefix is revealed at rest', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var titles, ids, _i, titles_1, title, _a, _b, sorted, sortedTitles, buckets, firstPage, _c, firstPage_1, row, raw, _d, ids_1, id;
+        var _e;
+        return __generator(this, function (_f) {
+            switch (_f.label) {
+                case 0:
+                    titles = ['banana bread', 'Apple pie', 'cherry tart', 'apricot jam', 'Blueberry scone'];
+                    ids = [];
+                    _i = 0, titles_1 = titles;
+                    _f.label = 1;
+                case 1:
+                    if (!(_i < titles_1.length)) return [3 /*break*/, 4];
+                    title = titles_1[_i];
+                    _b = (_a = ids).push;
+                    return [4 /*yield*/, db.insert(sortedTable, { scope: OWNER_A, title: title })];
+                case 2:
+                    _b.apply(_a, [(_f.sent()).id]);
+                    _f.label = 3;
+                case 3:
+                    _i++;
+                    return [3 /*break*/, 1];
+                case 4: return [4 /*yield*/, db.query(sortedTable, new db_1.QueryBuilder(sortedTable.name)
+                        .condition({ field: 'scope', operator: '=', value: OWNER_A })
+                        .sort([{ field: 'title' }]))];
+                case 5:
+                    sorted = _f.sent();
+                    sortedTitles = sorted.map(function (row) { return row.title; });
+                    buckets = sortedTitles.map(function (title) { return (title !== null && title !== void 0 ? title : '').toLowerCase().slice(0, 3); });
+                    expect(buckets).toEqual(__spreadArray([], buckets, true).sort());
+                    return [4 /*yield*/, db.query(sortedTable, new db_1.QueryBuilder(sortedTable.name)
+                            .condition({ field: 'scope', operator: '=', value: OWNER_A })
+                            .sort([{ field: 'title' }])
+                            .paginate({ start: 0, end: 2 }))];
+                case 6:
+                    firstPage = _f.sent();
+                    expect(firstPage.length).toBe(2);
+                    for (_c = 0, firstPage_1 = firstPage; _c < firstPage_1.length; _c++) {
+                        row = firstPage_1[_c];
+                        expect(((_e = row.title) !== null && _e !== void 0 ? _e : '').toLowerCase().slice(0, 2)).toBe('ap');
+                    }
+                    return [4 /*yield*/, spannerDriver.runQuery(function () { return ({
+                            sql: "SELECT `title`, `title_enc_srt` FROM `".concat(sortedTable.name, "` WHERE `id` = '").concat(ids[0], "'"),
+                        }); })];
+                case 7:
+                    raw = _f.sent();
+                    expect(raw[0].title_enc_srt).toBe('ban');
+                    expect(raw[0].title).not.toContain('banana');
+                    _d = 0, ids_1 = ids;
+                    _f.label = 8;
+                case 8:
+                    if (!(_d < ids_1.length)) return [3 /*break*/, 11];
+                    id = ids_1[_d];
+                    return [4 /*yield*/, db.delete(sortedTable, { id: id })];
+                case 9:
+                    _f.sent();
+                    _f.label = 10;
+                case 10:
+                    _d++;
+                    return [3 /*break*/, 8];
+                case 11: return [2 /*return*/];
+            }
+        });
+    }); });
+    test('the live loud rejection: ORDER BY an encrypted column with no sortKey throws at query-build time', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var tagQb, tagQb2;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    tagQb = new db_1.QueryBuilder(uniqueTable.name).sort([{ field: 'name' }]);
+                    return [4 /*yield*/, expect(db.query(uniqueTable, tagQb)).rejects.toThrow(db_1.EncryptedColumnQueryError)];
+                case 1:
+                    _a.sent();
+                    tagQb2 = new db_1.QueryBuilder(uniqueTable.name).sort([{ field: 'name' }]);
+                    return [4 /*yield*/, expect(db.query(uniqueTable, tagQb2)).rejects.toThrow(/no sortKey declared/)];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    test('uniqueness on the value rides the fingerprint: duplicate value for the same owner rejected; other owners unaffected', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var first, otherOwner;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, db.insert(uniqueTable, { scope: OWNER_A, name: 'oncologist' })];
+                case 1:
+                    first = _a.sent();
+                    return [4 /*yield*/, expect(db.insert(uniqueTable, { scope: OWNER_A, name: 'oncologist' })).rejects.toThrow()];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, db.insert(uniqueTable, { scope: OWNER_B, name: 'oncologist' })];
+                case 3:
+                    otherOwner = _a.sent();
+                    return [4 /*yield*/, db.delete(uniqueTable, { id: first.id })];
+                case 4:
+                    _a.sent();
+                    return [4 /*yield*/, db.delete(uniqueTable, { id: otherOwner.id })];
+                case 5:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=EncryptionSortAndUnique.test.js.map

package/dist/test/EncryptionSortAndUnique.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptionSortAndUnique.test.js","sourceRoot":"","sources":["../../test/EncryptionSortAndUnique.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAQuB;AACvB,kEAA6D;AAC7D,4EAAuE;AACvE,4DAA2D;AAC3D,gFAA+E;AAC/E,gFAAuH;AACvH,kFAAmH;AACnH,2CAAqE;AACrE,mCAAiC;AAEjC,IAAM,aAAa,GAAG,IAAI,iCAAa,CAAC;IACtC,SAAS,EAAE,gBAAgB;IAC3B,YAAY,EAAE,gBAAgB;IAC9B,YAAY,EAAE,MAAM;CACrB,CAAC,CAAC;AAEF,UAAkB,CAAC,gCAAgC,CAAC,GAAG,aAAa,CAAC;AAEtE,IAAM,OAAO,GAAG,kBAAkB,CAAC;AACnC,IAAM,OAAO,GAAG,kBAAkB,CAAC;AAEnC,IAAM,WAAW,GAAG,IAAI,+CAAkB,EAA0B,CAAC;AACrE,IAAM,WAAW,GAAG,IAAI,8CAAiB,EAAyB,CAAC;AACnE,IAAM,EAAE,GAAG,IAAI,OAAE,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,2CAAkB,EAAE,CAAC,CAAC;AAEtE;;;;GAIG;AACH,QAAQ,CAAC,qDAAqD,EAAE;IAC9D,IAAM,SAAS,GAAG,IAAA,mCAAgB,EAAC,aAAa,CAAC,CAAC;IAClD,IAAM,YAAY,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;IAErD,SAAS,CAAC;;;wBACR,qBAAM,uDAA0B,CAAC,iBAAiB,CAAC;wBACjD,SAAS,EAAE,gBAAgB;wBAC3B,YAAY,EAAE,gBAAgB;wBAC9B,YAAY,EAAE,MAAM;qBACrB,CAAC,EAAA;;oBAJF,SAIE,CAAC;oBACH,IAAA,uBAAgB,GAAE,CAAC;oBACnB,IAAA,0BAAqB,EAAC;wBACpB,iBAAiB,EAAE,IAAI,8BAAyB,CAAC,wBAAwB,CAAC;wBAC1E,sBAAsB,EAAE;4BAAY,sBAAA,CAAC,OAAO,CAAC,EAAA;iCAAA;qBAC9C,CAAC,CAAC;oBACH,qBAAM,IAAA,4DAA8B,EAAC,YAAY,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,EAAA;;oBAA9E,SAA8E,CAAC;oBAC/E,qBAAM,IAAA,2DAA6B,EAAC,aAAa,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,EAAA;;oBAA9E,SAA8E,CAAC;;;;SAChF,EAAE,MAAM,CAAC,CAAC;IAEX,QAAQ,CAAC;;;;oBACP,IAAA,0BAAqB,EAAC,SAAS,CAAC,CAAC;oBACjC,IAAA,oBAAa,GAAE,CAAC;oBAChB,qBAAM,SAAS,CAAC,IAAI,qBAAgB,EAAE,CAAC,aAAa,CAAC,WAAW,CAAE,CAAC,EAAA;;oBAAnE,SAAmE,CAAC;oBACpE,qBAAM,SAAS,CAAC,WAAW,CAAC,EAAA;;oBAA5B,SAA4B,CAAC;oBAC7B,qBAAM,SAAS,CAAC,WAAW,CAAC,EAAA;;oBAA5B,SAA4B,CAAC;oBAC7B,qBAAM,uDAA0B,CAAC,OAAO,EAAE,EAAA;;oBAA1C,SAA0C,CAAC;;;;SAC5C,EAAE,MAAM,CAAC,CAAC;IAEX,IAAI,CAAC,kHAAkH,EAAE;;;;;;oBACjH,MAAM,GAAG,CAAC,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,CAAC,CAAC;oBACxF,GAAG,GAAa,EAAE,CAAC;0BACC,EAAN,iBAAM;;;yBAAN,CAAA,oBAAM,CAAA;oBAAf,KAAK;oBACd,KAAA,CAAA,KAAA,GAAG,CAAA,CAAC,IAAI,CAAA;oBAAE,qBAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;oBAAjE,cAAS,CAAC,SAAuD,CAAC,CAAC,EAAE,EAAC,CAAC;;;oBADrD,IAAM,CAAA;;wBAKX,qBAAM,EAAE,CAAC,KAAK,CAC3B,WAAW,EACX,IAAI,iBAAY,CAAgB,WAAW,CAAC,IAAI,CAAC;yBAC9C,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;yBAC5D,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAC9B,EAAA;;oBALK,MAAM,GAAG,SAKd;oBACK,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,UAAC,GAAG,IAAK,OAAA,GAAG,CAAC,KAAK,EAAT,CAAS,CAAC,CAAC;oBAG9C,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,UAAC,KAAK,IAAK,OAAA,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAvC,CAAuC,CAAC,CAAC;oBACrF,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,kBAAI,OAAO,QAAE,IAAI,EAAE,CAAC,CAAC;oBAG3B,qBAAM,EAAE,CAAC,KAAK,CAC9B,WAAW,EACX,IAAI,iBAAY,CAAgB,WAAW,CAAC,IAAI,CAAC;6BAC9C,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;6BAC5D,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;6BAC1B,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAClC,EAAA;;oBANK,SAAS,GAAG,SAMjB;oBACD,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACjC,WAA2B,EAAT,uBAAS,EAAT,uBAAS,EAAT,IAAS,EAAE;wBAAlB,GAAG;wBACZ,MAAM,CAAC,CAAC,MAAA,GAAG,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;qBAChE;oBAGW,qBAAM,aAAa,CAAC,QAAQ,CAAC,cAAM,OAAA,CAAC;4BAC9C,GAAG,EAAE,gDAA8C,WAAW,CAAC,IAAI,6BAAsB,GAAG,CAAC,CAAC,CAAC,MAAG;yBACnG,CAAC,EAF6C,CAE7C,CAAC,EAAA;;oBAFG,GAAG,GAAG,SAET;oBACH,MAAM,CAAE,GAAG,CAAC,CAAC,CAAS,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAClD,MAAM,CAAE,GAAG,CAAC,CAAC,CAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;0BAElC,EAAH,WAAG;;;yBAAH,CAAA,iBAAG,CAAA;oBAAT,EAAE;oBACX,qBAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,IAAA,EAAE,CAAC,EAAA;;oBAApC,SAAoC,CAAC;;;oBADtB,IAAG,CAAA;;;;;SAGrB,CAAC,CAAC;IAEH,IAAI,CAAC,kGAAkG,EAAE;;;;;oBACjG,KAAK,GAAG,IAAI,iBAAY,CAAe,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;oBACzF,qBAAM,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,8BAAyB,CAAC,EAAA;;oBAArF,SAAqF,CAAC;oBAEhF,MAAM,GAAG,IAAI,iBAAY,CAAe,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;oBAC1F,qBAAM,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAA;;oBAAlF,SAAkF,CAAC;;;;SACpF,CAAC,CAAC;IAEH,IAAI,CAAC,qHAAqH,EAAE;;;;wBAC5G,qBAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAA;;oBAA5E,KAAK,GAAG,SAAoE;oBAClF,qBAAM,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAA;;oBAA9F,SAA8F,CAAC;oBAG5E,qBAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAA;;oBAAjF,UAAU,GAAG,SAAoE;oBAEvF,qBAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAA9C,SAA8C,CAAC;oBAC/C,qBAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAAnD,SAAmD,CAAC;;;;SACrD,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/index.d.ts

@@ -1,4 +1,5 @@
 export * from './util/getDropTestTable';
 export * from './util/SpannerEmulatorProvisioner';
 export * from './util/serviceUpdateVerbsTestTables';
+export * from './util/columnEncryptionTestTables';
 //# sourceMappingURL=index.d.ts.map

package/dist/test/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../test/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,mCAAmC,CAAC;AAClD,cAAc,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../test/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,mCAAmC,CAAC;AAClD,cAAc,qCAAqC,CAAC;AACpD,cAAc,mCAAmC,CAAC"}

package/dist/test/index.js

@@ -17,4 +17,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./util/getDropTestTable"), exports);
 __exportStar(require("./util/SpannerEmulatorProvisioner"), exports);
 __exportStar(require("./util/serviceUpdateVerbsTestTables"), exports);
+__exportStar(require("./util/columnEncryptionTestTables"), exports);
 //# sourceMappingURL=index.js.map

package/dist/test/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../test/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAwC;AACxC,oEAAkD;AAClD,sEAAoD"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../test/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAwC;AACxC,oEAAkD;AAClD,sEAAoD;AACpD,oEAAkD"}

package/dist/test/util/columnEncryptionTestHarness.d.ts

@@ -0,0 +1,23 @@
+import { Table, TableManager } from '@proteinjs/db';
+import { SpannerDriver } from '@proteinjs/db-driver-spanner';
+/**
+ * Schema loading for the column-encryption suites. `Db.delete` consults the reverse-cascade
+ * edge index over the WHOLE static table registry, and dynamic-reference edges are
+ * target-agnostic — so a delete from ANY table queries every registered table holding a
+ * `reverseCascadeDelete` dynamic-reference column (the cascade-delete test tables). A
+ * single-file run must therefore create those alongside the suite's own tables, plus the
+ * framework's data-key table. Serial `loadTable` (never batch `loadTables`): the registry
+ * deliberately holds same-name table pairs for schema-change tests, which a batch create
+ * would collide on.
+ *
+ * @internal This module is intended to be used only in tests.
+ */
+export declare const loadColumnEncryptionTestSchema: (tableManager: TableManager, suiteTables: Table<any>[]) => Promise<void>;
+/**
+ * Clean-slate purge of a suite's tables (rows + their derived token tables) in beforeAll:
+ * a prior run killed mid-flight (or a teardown starved out by shared-emulator contention)
+ * leaves seeded rows behind, and exact-match search assertions must never depend on a
+ * previous process having exited cleanly.
+ */
+export declare const purgeColumnEncryptionTestRows: (spannerDriver: SpannerDriver, suiteTables: Table<any>[]) => Promise<void>;
+//# sourceMappingURL=columnEncryptionTestHarness.d.ts.map

package/dist/test/util/columnEncryptionTestHarness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"columnEncryptionTestHarness.d.ts","sourceRoot":"","sources":["../../../test/util/columnEncryptionTestHarness.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE9F,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,iBAC3B,YAAY,eACb,MAAM,GAAG,CAAC,EAAE,KACxB,QAAQ,IAAI,CASd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,kBACzB,aAAa,eACf,MAAM,GAAG,CAAC,EAAE,KACxB,QAAQ,IAAI,CAcd,CAAC"}