Skip to content

Commit a869981

Browse files
tobyhedetobyhede
authored
Merge pull request #306 from cipherstash/set-key-name-integration-test
Set key name integration test
2 parents 1a420bd + f2c058e commit a869981

File tree

10 files changed

+547
-94
lines changed

10 files changed

+547
-94
lines changed

‎.github/workflows/test.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,18 @@ jobs:
2828
CS_TENANT_KEYSET_ID_1: ${{ secrets.CS_TENANT_KEYSET_ID_1 }}
2929
CS_TENANT_KEYSET_ID_2: ${{ secrets.CS_TENANT_KEYSET_ID_2 }}
3030
CS_TENANT_KEYSET_ID_3: ${{ secrets.CS_TENANT_KEYSET_ID_3 }}
31+
CS_TENANT_KEYSET_NAME_1: ${{ secrets.CS_TENANT_KEYSET_NAME_1 }}
32+
CS_TENANT_KEYSET_NAME_2: ${{ secrets.CS_TENANT_KEYSET_NAME_2 }}
33+
CS_TENANT_KEYSET_NAME_3: ${{ secrets.CS_TENANT_KEYSET_NAME_3 }}
3134
CS_CLIENT_ID: ${{ secrets.CS_CLIENT_ID }}
3235
CS_CLIENT_KEY: ${{ secrets.CS_CLIENT_KEY }}
3336
CS_WORKSPACE_CRN: "crn:ap-southeast-2.aws:${{ secrets.CS_WORKSPACE_ID }}"
34-
3537
RUST_BACKTRACE: "1"
3638
run: |
37-
mise run --output prefix test
39+
mise run --output prefix test
40+
41+
# Always show the Proxy logs, for debugging
42+
- name: Show Proxy logs
43+
if: always()
44+
run: |
45+
docker logs --timestamps proxy-tls

‎docs/errors.md‎

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -311,13 +311,13 @@ A KeysetId could not be set using the `SET CIPHERSTASH.KEYSET_ID` command.
311311
### Error message
312312

313313
```
314-
A KeysetId could not be set using `SET CIPHERSTASH.KEYSET_ID`
314+
Keyset Id could not be set using `SET CIPHERSTASH.KEYSET_ID`
315315
```
316316

317317
### How to Fix
318318

319-
1. Check the syntax of the `SET CIPHERSTASH.KEYSET_ID` command. The `KeysetId` value should be in single quotes.
320-
2. Check that the `KeysetId` is a valid UUID.
319+
1. Check the syntax of the `SET CIPHERSTASH.KEYSET_ID` command. The `keyset_id` value should be in single quotes.
320+
2. Check that the `keyset_id` is a valid UUID.
321321
3. Check that the value is being set as a literal. The PostgreSQL `SET` statement does not support parameterised querying.
322322

323323

@@ -337,21 +337,40 @@ KeysetName could not be set using the `SET CIPHERSTASH.KEYSET_NAME` command.
337337
### Error message
338338

339339
```
340-
A KeysetName could not be set using `SET CIPHERSTASH.KEYSET_NAME`
340+
Keyset Name could not be set using `SET CIPHERSTASH.KEYSET_NAME`
341341
```
342342

343343
### How to Fix
344344

345-
1. Check the syntax of the `SET CIPHERSTASH.KEYSET_ID` command. The `KeysetName` value should be in single quotes.
346-
2. Check that the provided `KeysetName` is a valid UUID.
345+
1. Check the syntax of the `SET CIPHERSTASH.KEYSET_ID` command. The `keyset_name` value should be in single quotes.
347346
2. Check that the value is being set as a literal. The PostgreSQL `SET` statement does not support parameterised querying.
348347

349348

350349
```
351-
SET [ SESSION ] CIPHERSTASH.KEYSET_NAME { TO | = } '{KeysetName}'
350+
SET [ SESSION ] CIPHERSTASH.KEYSET_NAME { TO | = } '{keyset_name}'
352351
```
353352

354353

354+
<!-- ---------------------------------------------------------------------------------------------------- -->
355+
356+
357+
## Unknown Keyset Identifier <a id='encrypt-unknown-keyset'></a>
358+
359+
The specified keyset could not be loaded.
360+
361+
362+
### Error message
363+
364+
```
365+
Unknown keyset name or id '{keyset}'
366+
```
367+
368+
### How to Fix
369+
370+
1. Check that the active `keyset_name` or `keyset_id` is associated with a keyset in the configured workspace.
371+
2. Check that the configured client credentials have access to the keyset and workspace.
372+
3. Keyset names are case sensitive. If setting the active keyset by name, check that the `keyset_name` is an exact match.
373+
355374

356375
<!-- ---------------------------------------------------------------------------------------------------- -->
357376

@@ -567,7 +586,7 @@ If the error persists, please contact CipherStash [support](https://cipherstash.
567586

568587
### How to Fix
569588

570-
1. Check that the data in the encrypted column is in correct format [EQL](https://github.com/cipherstash/encrypt-query-language).
589+
1. Check that the data in the encrypted column is in the correct format [EQL](https://github.com/cipherstash/encrypt-query-language).
571590

572591
<!-- TODO: Link to EQL Doc on storage format-->
573592

‎mise.toml‎

Lines changed: 48 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ mise run rust:version
136136
mise run test:check
137137
mise run test:format
138138
mise run test:clippy
139-
# mise run test:unit
139+
mise run test:unit
140140
mise run test:integration
141141
"""
142142

@@ -278,76 +278,75 @@ description = "Runs integration test/s"
278278
run = """
279279
set -e
280280
281-
# echo
282-
# echo '###############################################'
283-
# echo '# Preflight'
284-
# echo '###############################################'
285-
# echo
281+
echo
282+
echo '###############################################'
283+
echo '# Preflight'
284+
echo '###############################################'
285+
echo
286286
287287
# Ensure Postgres instances are running
288288
mise run test:integration:preflight
289289
290-
# echo
291-
# echo '###############################################'
292-
# echo '# Test: unconfigured proxy'
293-
# echo '###############################################'
294-
# echo
290+
echo
291+
echo '###############################################'
292+
echo '# Test: unconfigured proxy'
293+
echo '###############################################'
294+
echo
295295
296296
mise --env tcp run postgres:eql:teardown
297297
mise --env tcp run proxy:up proxy --extra-args "--detach --wait"
298298
mise --env tcp run test:wait_for_postgres_to_quack --port 6432 --max-retries 20
299299
mise --env tcp run test:integration:psql-passthrough
300300
mise --env tcp run proxy:down
301301
302-
# echo
303-
# echo '###############################################'
304-
# echo '# Setup'
305-
# echo '###############################################'
306-
# echo
302+
echo
303+
echo '###############################################'
304+
echo '# Setup'
305+
echo '###############################################'
306+
echo
307307
308-
# # Ensure EQL is set up before we try and start Proxy
308+
# Ensure EQL is set up before we try and start Proxy
309309
mise --env tcp run postgres:setup
310310
mise --env tls run postgres:setup
311311
312-
# echo
313-
# echo '###############################################'
314-
# echo '# Test: Prometheus'
315-
# echo '###############################################'
316-
# echo
312+
echo
313+
echo '###############################################'
314+
echo '# Test: Prometheus'
315+
echo '###############################################'
316+
echo
317317
318318
mise --env tcp run proxy:up proxy --extra-args "--detach --wait"
319319
mise --env tcp run test:wait_for_postgres_to_quack --port 6432 --max-retries 20
320320
mise --env tcp run test:integration:prometheus
321321
mise --env tcp run proxy:down
322322
323-
# echo
324-
# echo '###############################################'
325-
# echo '# Test: non-TLS'
326-
# echo '###############################################'
327-
# echo
323+
echo
324+
echo '###############################################'
325+
echo '# Test: non-TLS'
326+
echo '###############################################'
327+
echo
328328
329329
mise --env tcp run proxy:up proxy --extra-args "--detach --wait"
330330
mise --env tcp run test:wait_for_postgres_to_quack --port 6432 --max-retries 20
331331
mise --env tcp run test:integration:psql-tcp
332332
mise --env tcp run proxy:down
333333
334-
# echo
335-
# echo '###############################################'
336-
# echo '# Test: TLS'
337-
# echo '###############################################'
338-
# echo
334+
echo
335+
echo '###############################################'
336+
echo '# Test: TLS'
337+
echo '###############################################'
338+
echo
339339
340340
mise --env tls run proxy:up proxy-tls --extra-args "--detach --wait"
341341
mise --env tls run test:wait_for_postgres_to_quack --port 6432 --max-retries 20 --tls
342342
mise --env tls run test:integration:psql-tls
343343
mise --env tls run proxy:down
344344
345-
346-
# echo
347-
# echo '###############################################'
348-
# echo '# Test: Integration'
349-
# echo '###############################################'
350-
# echo
345+
echo
346+
echo '###############################################'
347+
echo '# Test: Integration'
348+
echo '###############################################'
349+
echo
351350
352351
mise --env tls run proxy:up proxy-tls --extra-args "--detach --wait"
353352
mise --env tls run test:wait_for_postgres_to_quack --port 6432 --max-retries 20 --tls
@@ -373,23 +372,24 @@ export CS_DEFAULT_KEYSET_ID="{{default_keyset_id}}"
373372
374373
mise --env tls run proxy:down
375374
376-
# echo
377-
# echo '###############################################'
378-
# echo '# Test: Showcase'
379-
# echo '###############################################'
380-
# echo
375+
echo
376+
echo '###############################################'
377+
echo '# Test: Showcase'
378+
echo '###############################################'
379+
echo
381380
mise --env tls run proxy:up proxy-tls --extra-args "--detach --wait"
382381
mise --env tls run test:wait_for_postgres_to_quack --port 6432 --max-retries 20 --tls
383382
RUST_BACKTRACE=full cargo run -p showcase
384383
mise --env tls run proxy:down
385384
386-
# echo
387-
# echo '###############################################'
388-
# echo '# Test: Language-specific integration'
389-
# echo '###############################################'
390-
# echo
385+
echo
386+
echo '###############################################'
387+
echo '# Test: Language-specific integration'
388+
echo '###############################################'
389+
echo
391390
mise run test:integration:lang:golang
392391
mise run test:integration:lang:python
392+
393393
# Commented out pending fix of the root cause of the test flake
394394
# mise run test:integration:lang:elixir
395395
"""

‎packages/cipherstash-proxy-integration/src/multitenant/mod.rs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
mod set_keyset_id;
2+
mod set_keyset_name;

‎packages/cipherstash-proxy-integration/src/multitenant/set_keyset_id.rs‎

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ mod tests {
8484
async fn set_keyset_id_with_simple_query() {
8585
trace();
8686

87-
// clear().await;
87+
clear().await;
8888

8989
let tenant_keyset_id_1 = std::env::var("CS_TENANT_KEYSET_ID_1")
9090
.map(|s| Uuid::parse_str(&s).unwrap())
@@ -246,6 +246,52 @@ mod tests {
246246
assert!(result.is_err());
247247
}
248248

249+
///
250+
/// Tests error handling of unknown keyset id
251+
///
252+
#[tokio::test]
253+
async fn set_keyset_id_unknown() {
254+
trace();
255+
256+
clear().await;
257+
258+
let client = connect_with_tls(PROXY).await;
259+
260+
let tenant_keyset_id_1 = std::env::var("CS_TENANT_KEYSET_ID_1")
261+
.map(|s| Uuid::parse_str(&s).unwrap())
262+
.unwrap();
263+
// Can set unknown name
264+
let sql = "SET CIPHERSTASH.KEYSET_ID = '2cace9db-3a2a-4b46-a184-ba412b3e0730'";
265+
let result = client.query(sql, &[]).await;
266+
assert!(result.is_ok());
267+
268+
// Error on encrypt
269+
let id = random_id();
270+
let text = "TEST UNKNOWN";
271+
272+
let insert_sql = "INSERT INTO encrypted (id, encrypted_text) VALUES ($1, $2)";
273+
let result = client.query(insert_sql, &[&id, &text]).await;
274+
assert!(result.is_err());
275+
276+
if let Err(err) = result {
277+
let msg = err.to_string();
278+
279+
assert_eq!(msg, "db error: FATAL: Unknown keyset name or id '2cace9db-3a2a-4b46-a184-ba412b3e0730'. For help visit https://github.com/cipherstash/proxy/blob/main/docs/errors.md#encrypt-unknown-keyset");
280+
} else {
281+
unreachable!();
282+
}
283+
284+
// --------
285+
// Switch back to TENANT_1
286+
let sql = format!("SET CIPHERSTASH.KEYSET_ID = '{tenant_keyset_id_1}'");
287+
let result = client.query(&sql, &[]).await;
288+
assert!(result.is_ok());
289+
290+
let insert_sql = "INSERT INTO encrypted (id, encrypted_text) VALUES ($1, $2)";
291+
let result = client.query(insert_sql, &[&id, &text]).await;
292+
assert!(result.is_ok());
293+
}
294+
249295
///
250296
/// Tests various string literal formats for keyset_id values
251297
///

0 commit comments

Comments
 (0)