Skip to content

Commit 9524f33

Browse files
tobyhedetobyhede
authored
Merge pull request #131 from cipherstash/add-constraint-on-add-search-config
fix: add constraint on add search config
2 parents 6ba78f6 + c245711 commit 9524f33

File tree

5 files changed

+93
-11
lines changed

5 files changed

+93
-11
lines changed

‎src/config/config_test.sql‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,24 @@
11
\set ON_ERROR_STOP on
22

33

4+
-- Create tables for adding configuration
5+
DROP TABLE IF EXISTS users;
6+
CREATE TABLE users
7+
(
8+
id bigint GENERATED ALWAYS AS IDENTITY,
9+
name eql_v2_encrypted,
10+
PRIMARY KEY(id)
11+
);
12+
13+
DROP TABLE IF EXISTS blah;
14+
CREATE TABLE blah
15+
(
16+
id bigint GENERATED ALWAYS AS IDENTITY,
17+
vtha eql_v2_encrypted,
18+
PRIMARY KEY(id)
19+
);
20+
21+
422
--
523
-- Helper function for assertions
624
--
@@ -90,7 +108,7 @@ DO $$
90108
PERFORM eql_v2.remove_search_config('blah', 'vtha', 'unique', migrating => true);
91109
ASSERT NOT (SELECT _search_config_exists('users', 'vtha', 'unique'));
92110

93-
-- All indexes removed, but column config preserved
111+
-- All indexes removed, but column config preserved
94112
ASSERT (SELECT EXISTS (SELECT FROM eql_v2_configuration c WHERE c.state = 'pending'));
95113
ASSERT (SELECT data #> array['tables', 'blah', 'vtha', 'indexes'] = '{}' FROM eql_v2_configuration c WHERE c.state = 'pending');
96114

@@ -222,7 +240,7 @@ DO $$
222240
'Pending configuration exists but is empty',
223241
'SELECT * FROM eql_v2_configuration c WHERE c.state = ''pending''',
224242
1);
225-
243+
226244
-- Verify the config is empty
227245
ASSERT (SELECT data #> array['tables'] = '{}' FROM eql_v2_configuration c WHERE c.state = 'pending');
228246

‎src/config/functions.sql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ AS $$
6161
PERFORM eql_v2.activate_config();
6262
END IF;
6363

64-
-- PERFORM eql_v2.add_encrypted_constraint(table_name, column_name);
64+
PERFORM eql_v2.add_encrypted_constraint(table_name, column_name);
6565

6666
-- exeunt
6767
RETURN _config;

‎src/encrypted/constraints_test.sql‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,66 @@ DO $$
4343
$$ LANGUAGE plpgsql;
4444

4545

46+
-- -----------------------------------------------
47+
-- Adding search config adds the constraint
48+
--
49+
-- -----------------------------------------------
50+
TRUNCATE TABLE eql_v2_configuration;
51+
52+
DO $$
53+
BEGIN
54+
-- reset the table
55+
PERFORM create_table_with_encrypted();
56+
57+
PERFORM eql_v2.add_search_config('encrypted', 'e', 'match');
58+
59+
PERFORM assert_exception(
60+
'Constraint catches invalid eql_v2_encrypted',
61+
'INSERT INTO encrypted (e) VALUES (''{}''::jsonb::eql_v2_encrypted)');
62+
63+
-- add constraint without error
64+
PERFORM eql_v2.add_encrypted_constraint('encrypted', 'e');
65+
66+
PERFORM eql_v2.remove_encrypted_constraint('encrypted', 'e');
67+
68+
PERFORM assert_result(
69+
'Insert invalid data without constraint',
70+
'INSERT INTO encrypted (e) VALUES (''{}''::jsonb::eql_v2_encrypted) RETURNING id');
71+
72+
END;
73+
$$ LANGUAGE plpgsql;
74+
75+
76+
-- -----------------------------------------------
77+
-- Adding column adds the constraint
78+
--
79+
-- -----------------------------------------------
80+
TRUNCATE TABLE eql_v2_configuration;
81+
82+
DO $$
83+
BEGIN
84+
-- reset the table
85+
PERFORM create_table_with_encrypted();
86+
87+
PERFORM eql_v2.add_column('encrypted', 'e');
88+
89+
PERFORM assert_exception(
90+
'Constraint catches invalid eql_v2_encrypted',
91+
'INSERT INTO encrypted (e) VALUES (''{}''::jsonb::eql_v2_encrypted)');
92+
93+
-- add constraint without error
94+
PERFORM eql_v2.add_encrypted_constraint('encrypted', 'e');
95+
96+
PERFORM eql_v2.remove_encrypted_constraint('encrypted', 'e');
97+
98+
PERFORM assert_result(
99+
'Insert invalid data without constraint',
100+
'INSERT INTO encrypted (e) VALUES (''{}''::jsonb::eql_v2_encrypted) RETURNING id');
101+
102+
END;
103+
$$ LANGUAGE plpgsql;
104+
105+
46106
-- EQL version is enforced
47107
DO $$
48108
DECLARE

‎src/encrypted/functions.sql‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,12 @@ CREATE FUNCTION eql_v2.add_encrypted_constraint(table_name TEXT, column_name TEX
5151
RETURNS void
5252
AS $$
5353
BEGIN
54-
EXECUTE format('ALTER TABLE %I ADD CONSTRAINT eql_v2_encrypted_check_%I CHECK (eql_v2.check_encrypted(%I))', table_name, column_name, column_name);
55-
END;
54+
EXECUTE format('ALTER TABLE %I ADD CONSTRAINT eql_v2_encrypted_constraint_%I_%I CHECK (eql_v2.check_encrypted(%I))', table_name, table_name, column_name, column_name);
55+
EXCEPTION
56+
WHEN duplicate_table THEN
57+
WHEN duplicate_object THEN
58+
RAISE NOTICE 'Constraint `eql_v2_encrypted_constraint_%_%` already exists, skipping', table_name, column_name;
59+
END;
5660
$$ LANGUAGE plpgsql;
5761

5862

@@ -66,7 +70,7 @@ CREATE FUNCTION eql_v2.remove_encrypted_constraint(table_name TEXT, column_name
6670
RETURNS void
6771
AS $$
6872
BEGIN
69-
EXECUTE format('ALTER TABLE %I DROP CONSTRAINT IF EXISTS eql_v2_encrypted_check_%I', table_name, column_name);
73+
EXECUTE format('ALTER TABLE %I DROP CONSTRAINT IF EXISTS eql_v2_encrypted_constraint_%I_%I', table_name, table_name, column_name);
7074
END;
7175
$$ LANGUAGE plpgsql;
7276

‎src/encryptindex/functions_test.sql‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ CREATE TABLE users
154154
-- An encrypting config should exist
155155
DO $$
156156
BEGIN
157-
PERFORM eql_v2.add_search_config('users', 'name', 'match', migrating => true);
157+
PERFORM eql_v2.add_search_config('users', 'name_encrypted', 'match', migrating => true);
158158
PERFORM eql_v2.migrate_config();
159159
ASSERT (SELECT EXISTS (SELECT FROM eql_v2_configuration c WHERE c.state = 'active'));
160160
ASSERT (SELECT EXISTS (SELECT FROM eql_v2_configuration c WHERE c.state = 'encrypting'));
@@ -167,7 +167,7 @@ $$ LANGUAGE plpgsql;
167167
DO $$
168168
BEGIN
169169
TRUNCATE TABLE eql_v2_configuration;
170-
PERFORM eql_v2.add_search_config('users', 'name', 'match');
170+
PERFORM eql_v2.add_search_config('users', 'name_encrypted', 'match');
171171
ASSERT (SELECT EXISTS (SELECT FROM eql_v2_configuration c WHERE c.state = 'active'));
172172
END;
173173
$$ LANGUAGE plpgsql;
@@ -177,7 +177,7 @@ $$ LANGUAGE plpgsql;
177177
DO $$
178178
BEGIN
179179
TRUNCATE TABLE eql_v2_configuration;
180-
PERFORM eql_v2.add_search_config('users', 'name', 'match');
180+
PERFORM eql_v2.add_search_config('users', 'name_encrypted', 'match');
181181

182182
PERFORM assert_exception(
183183
'eql_v2.migrate_config() should raise an exception when no pending configuration exists',
@@ -226,7 +226,7 @@ CREATE TABLE users
226226
-- An encrypting config should exist
227227
DO $$
228228
BEGIN
229-
PERFORM eql_v2.add_search_config('users', 'name', 'match', migrating => true);
229+
PERFORM eql_v2.add_search_config('users', 'name_encrypted', 'match', migrating => true);
230230
PERFORM eql_v2.migrate_config();
231231

232232
ASSERT (SELECT EXISTS (SELECT FROM eql_v2_configuration c WHERE c.state = 'active'));
@@ -276,7 +276,7 @@ CREATE TABLE users
276276
-- An encrypting config should exist
277277
DO $$
278278
BEGIN
279-
PERFORM eql_v2.add_search_config('users', 'name', 'match', migrating => true);
279+
PERFORM eql_v2.add_search_config('users', 'name_encrypted', 'match', migrating => true);
280280

281281
PERFORM eql_v2.migrate_config(); -- need to encrypt first
282282
PERFORM eql_v2.activate_config();

0 commit comments

Comments
 (0)