Skip to content

Commit 33d7ee4

Browse files
ajewellamzajewellamz
authored
fix: revert change in error type (#1304)
1 parent 30dfaa8 commit 33d7ee4

File tree

3 files changed

+23
-190
lines changed

3 files changed

+23
-190
lines changed

‎DynamoDbEncryption/dafny/DynamoDbEncryptionTransforms/src/QueryTransform.dfy

+4-19
Original file line numberDiff line numberDiff line change
@@ -81,29 +81,16 @@ module QueryTransform {
8181
if keyId.KeyId? {
8282
keyIdUtf8 :- UTF8.Encode(keyId.value).MapFailure(e => E(e));
8383
}
84-
85-
var decryptErrors : seq<Error> := [];
86-
var lastRealError := -1;
87-
84+
ghost var originalHistory := tableConfig.itemEncryptor.History.DecryptItem;
85+
ghost var historySize := |originalHistory|;
8886
for x := 0 to |encryptedItems|
89-
invariant lastRealError == -1 || lastRealError < |decryptErrors|
9087
{
9188
//= specification/dynamodb-encryption-client/ddb-sdk-integration.md#decrypt-after-query
9289
//# Each of these entries on the original response MUST be replaced
9390
//# with the resulting decrypted [DynamoDB Item](./decrypt-item.md#dynamodb-item-1).
9491
var decryptInput := EncTypes.DecryptItemInput(encryptedItem := encryptedItems[x]);
9592
var decryptRes := tableConfig.itemEncryptor.DecryptItem(decryptInput);
96-
if decryptRes.Failure? {
97-
var error := AwsCryptographyDbEncryptionSdkDynamoDbItemEncryptor(decryptRes.error);
98-
var context := E(KeyString(tableConfig, encryptedItems[x]));
99-
if lastRealError == -1 || error != decryptErrors[lastRealError] {
100-
lastRealError := |decryptErrors|;
101-
decryptErrors := decryptErrors + [error];
102-
}
103-
decryptErrors := decryptErrors + [context];
104-
continue;
105-
}
106-
var decrypted := decryptRes.value;
93+
var decrypted :- MapError(decryptRes);
10794

10895
// If the decrypted result was plaintext, i.e. has no parsedHeader
10996
// then this is expected IFF the table config allows plaintext read
@@ -124,9 +111,7 @@ module QueryTransform {
124111
decryptedItems := decryptedItems + [decrypted.plaintextItem];
125112
}
126113
}
127-
if |decryptErrors| != 0 {
128-
return Failure(CollectionOfErrors(decryptErrors, message := "Error(s) found decrypting Query results."));
129-
}
114+
130115
//= specification/dynamodb-encryption-client/ddb-sdk-integration.md#decrypt-after-query
131116
//# The resulting decrypted response MUST be [filtered](ddb-support.md#queryoutputforbeacons) from the result.
132117
var decryptedOutput := input.sdkOutput.(Items := Some(decryptedItems));

‎DynamoDbEncryption/dafny/DynamoDbEncryptionTransforms/src/ScanTransform.dfy

+1-18
Original file line numberDiff line numberDiff line change
@@ -79,11 +79,7 @@ module ScanTransform {
7979
if keyId.KeyId? {
8080
keyIdUtf8 :- UTF8.Encode(keyId.value).MapFailure(e => E(e));
8181
}
82-
var decryptErrors : seq<Error> := [];
83-
var lastRealError := -1;
84-
8582
for x := 0 to |encryptedItems|
86-
invariant lastRealError == -1 || lastRealError < |decryptErrors|
8783
{
8884
//= specification/dynamodb-encryption-client/ddb-sdk-integration.md#decrypt-after-scan
8985
//# Each of these entries on the original response MUST be replaced
@@ -92,17 +88,7 @@ module ScanTransform {
9288

9389
var decryptInput := EncTypes.DecryptItemInput(encryptedItem := encryptedItems[x]);
9490
var decryptRes := tableConfig.itemEncryptor.DecryptItem(decryptInput);
95-
if decryptRes.Failure? {
96-
var error := AwsCryptographyDbEncryptionSdkDynamoDbItemEncryptor(decryptRes.error);
97-
var context := E(KeyString(tableConfig, encryptedItems[x]));
98-
if lastRealError == -1 || error != decryptErrors[lastRealError] {
99-
lastRealError := |decryptErrors|;
100-
decryptErrors := decryptErrors + [error];
101-
}
102-
decryptErrors := decryptErrors + [context];
103-
continue;
104-
}
105-
var decrypted := decryptRes.value;
91+
var decrypted :- MapError(decryptRes);
10692

10793
// If the decrypted result was plaintext, i.e. has no parsedHeader
10894
// then this is expected IFF the table config allows plaintext read
@@ -123,9 +109,6 @@ module ScanTransform {
123109
decryptedItems := decryptedItems + [decrypted.plaintextItem];
124110
}
125111
}
126-
if |decryptErrors| != 0 {
127-
return Failure(CollectionOfErrors(decryptErrors, message := "Error(s) found decrypting Scan results."));
128-
}
129112

130113
//= specification/dynamodb-encryption-client/ddb-sdk-integration.md#decrypt-after-scan
131114
//# The resulting decrypted response MUST be [filtered](ddb-support.md#scanoutputforbeacons) from the result.

‎DynamoDbEncryption/dafny/DynamoDbEncryptionTransforms/test/QueryTransform.dfy

+18-153
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,7 @@ module QueryTransformTest {
88
import opened DynamoDbEncryptionTransforms
99
import opened TestFixtures
1010
import DDB = ComAmazonawsDynamodbTypes
11-
import DBT = AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes
12-
import DBE = AwsCryptographyDbEncryptionSdkDynamoDbTypes
13-
import Types = AwsCryptographyDbEncryptionSdkDynamoDbItemEncryptorTypes
14-
import AwsCryptographyDbEncryptionSdkStructuredEncryptionTypes
11+
import AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes
1512

1613
method {:test} TestQueryInputPassthrough() {
1714
var middlewareUnderTest := TestFixtures.GetDynamoDbEncryptionTransforms();
@@ -56,7 +53,23 @@ module QueryTransformTest {
5653
);
5754
var tableName := GetTableName("no_such_table");
5855
var input := DDB.QueryInput(
59-
TableName := tableName
56+
TableName := tableName,
57+
IndexName := None(),
58+
Select := None(),
59+
AttributesToGet := None(),
60+
Limit := None(),
61+
ConsistentRead := None(),
62+
KeyConditions := None(),
63+
QueryFilter := None(),
64+
ConditionalOperator := None(),
65+
ScanIndexForward := None(),
66+
ExclusiveStartKey := None(),
67+
ReturnConsumedCapacity := None(),
68+
ProjectionExpression := None(),
69+
FilterExpression := None(),
70+
KeyConditionExpression := None(),
71+
ExpressionAttributeNames := None(),
72+
ExpressionAttributeValues := None()
6073
);
6174
var transformed := middlewareUnderTest.QueryOutputTransform(
6275
AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes.QueryOutputTransformInput(
@@ -68,152 +81,4 @@ module QueryTransformTest {
6881
expect_ok("QueryOutput", transformed);
6982
expect_equal("QueryOutput", transformed.value.transformedOutput, output);
7083
}
71-
72-
function method DDBS(x : string) : DDB.AttributeValue {
73-
DDB.AttributeValue.S(x)
74-
}
75-
76-
const Actions1 : DBE.AttributeActions := map[
77-
GetAttrName("bar") := CSE.SIGN_ONLY,
78-
GetAttrName("sortKey") := CSE.SIGN_ONLY,
79-
GetAttrName("encrypt1") := CSE.ENCRYPT_AND_SIGN,
80-
GetAttrName("encrypt2") := CSE.ENCRYPT_AND_SIGN,
81-
GetAttrName("sign1") := CSE.SIGN_ONLY,
82-
GetAttrName("sign2") := CSE.SIGN_ONLY
83-
]
84-
85-
method {:test} TestDecryptErrorWithSortKey() {
86-
var config := TestFixtures.GetEncryptorConfigFromActions(Actions1, Some("sortKey"));
87-
var encryptor := TestFixtures.GetDynamoDbItemEncryptorFrom(config);
88-
89-
var inputItem : map<DDB.AttributeName, DDB.AttributeValue> := map[
90-
"bar" := DDB.AttributeValue.N("00001234"),
91-
"sortKey" := DDB.AttributeValue.B([1,2,3,4]),
92-
"encrypt1" := DDBS("some text"),
93-
"encrypt2" := DDBS("more text"),
94-
"sign1" := DDBS("stuff"),
95-
"sign2" := DDB.AttributeValue.BOOL(false)
96-
];
97-
98-
var encryptRes :- expect encryptor.EncryptItem(
99-
Types.EncryptItemInput(
100-
plaintextItem:=inputItem
101-
)
102-
);
103-
var item1 := encryptRes.encryptedItem;
104-
expect "encrypt1" in item1;
105-
expect item1["encrypt1"] != DDBS("some text");
106-
107-
inputItem := map[
108-
"bar" := DDB.AttributeValue.N("567"),
109-
"sortKey" := DDB.AttributeValue.B([5,6,7]),
110-
"encrypt1" := DDBS("some text"),
111-
"encrypt2" := DDBS("more text"),
112-
"sign1" := DDBS("stuff"),
113-
"sign2" := DDB.AttributeValue.BOOL(false)
114-
];
115-
encryptRes :- expect encryptor.EncryptItem(
116-
Types.EncryptItemInput(
117-
plaintextItem:=inputItem
118-
)
119-
);
120-
var item2 := encryptRes.encryptedItem;
121-
expect "encrypt1" in item2;
122-
expect item2["encrypt1"] != DDBS("some text");
123-
124-
inputItem := map[
125-
"bar" := DDB.AttributeValue.N("890"),
126-
"sortKey" := DDB.AttributeValue.B([3,1,4]),
127-
"encrypt1" := DDBS("some text"),
128-
"encrypt2" := DDBS("more text"),
129-
"sign1" := DDBS("stuff"),
130-
"sign2" := DDB.AttributeValue.BOOL(false)
131-
];
132-
encryptRes :- expect encryptor.EncryptItem(
133-
Types.EncryptItemInput(
134-
plaintextItem:=inputItem
135-
)
136-
);
137-
var item3 := encryptRes.encryptedItem;
138-
expect "encrypt1" in item3;
139-
expect item3["encrypt1"] != DDBS("some text");
140-
141-
var middlewareUnderTest := TestFixtures.GetDynamoDbEncryptionTransforms2(Actions1, Some("sortKey"));
142-
var tableName := GetTableName("foo");
143-
var input := DDB.QueryInput(
144-
TableName := tableName
145-
);
146-
147-
var transformed := middlewareUnderTest.QueryOutputTransform(
148-
AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes.QueryOutputTransformInput(
149-
sdkOutput := DDB.QueryOutput(Items := Some([item1, item2, item3])),
150-
originalInput := input
151-
)
152-
);
153-
154-
TestFixtures.expect_ok("QueryOutput", transformed);
155-
expect transformed.value.transformedOutput.Items.Some?;
156-
var itemList := transformed.value.transformedOutput.Items.value;
157-
expect |itemList| == 3;
158-
expect "encrypt1" in itemList[0];
159-
expect itemList[0]["encrypt1"] == DDBS("some text");
160-
161-
162-
/// now do some damage
163-
item1 := item1["encrypt1" := item2["encrypt1"]];
164-
transformed := middlewareUnderTest.QueryOutputTransform(
165-
AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes.QueryOutputTransformInput(
166-
sdkOutput := DDB.QueryOutput(Items := Some([item1, item2, item3])),
167-
originalInput := input
168-
)
169-
);
170-
expect transformed.Failure?;
171-
print "\n", transformed.error, "\n";
172-
expect transformed.error ==
173-
AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes.Error.CollectionOfErrors(
174-
[
175-
AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes.Error.AwsCryptographyDbEncryptionSdkDynamoDbItemEncryptor(AwsCryptographyDbEncryptionSdkDynamoDbItemEncryptorTypes.Error.AwsCryptographyDbEncryptionSdkDynamoDb(AwsCryptographyDbEncryptionSdkDynamoDbTypes.Error.AwsCryptographyDbEncryptionSdkStructuredEncryption(AwsCryptographyDbEncryptionSdkStructuredEncryptionTypes.Error.StructuredEncryptionException(message := "Signature of record does not match the signature computed when the record was encrypted.")))),
176-
AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes.Error.DynamoDbEncryptionTransformsException(message := "bar = 1234; sortKey = 01020304")
177-
],
178-
message := "Error(s) found decrypting Query results."
179-
);
180-
181-
/// do more damage
182-
item3 := item3["encrypt1" := item2["encrypt1"]];
183-
transformed := middlewareUnderTest.QueryOutputTransform(
184-
AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes.QueryOutputTransformInput(
185-
sdkOutput := DDB.QueryOutput(Items := Some([item1, item2, item3])),
186-
originalInput := input
187-
)
188-
);
189-
expect transformed.Failure?;
190-
print "\n", transformed.error, "\n";
191-
expect transformed.error ==
192-
AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes.Error.CollectionOfErrors(
193-
[
194-
AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes.Error.AwsCryptographyDbEncryptionSdkDynamoDbItemEncryptor(AwsCryptographyDbEncryptionSdkDynamoDbItemEncryptorTypes.Error.AwsCryptographyDbEncryptionSdkDynamoDb(AwsCryptographyDbEncryptionSdkDynamoDbTypes.Error.AwsCryptographyDbEncryptionSdkStructuredEncryption(AwsCryptographyDbEncryptionSdkStructuredEncryptionTypes.Error.StructuredEncryptionException(message := "Signature of record does not match the signature computed when the record was encrypted.")))),
195-
AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes.Error.DynamoDbEncryptionTransformsException(message := "bar = 1234; sortKey = 01020304"),
196-
AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes.Error.DynamoDbEncryptionTransformsException(message := "bar = 890; sortKey = 030104")
197-
],
198-
message := "Error(s) found decrypting Query results."
199-
);
200-
201-
var transformed_scan := middlewareUnderTest.ScanOutputTransform(
202-
AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes.ScanOutputTransformInput(
203-
sdkOutput := DDB.ScanOutput(Items := Some([item1, item2, item3])),
204-
originalInput := DDB.ScanInput(TableName := tableName)
205-
)
206-
);
207-
expect transformed_scan.Failure?;
208-
print "\n", transformed_scan.error, "\n";
209-
expect transformed_scan.error ==
210-
AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes.Error.CollectionOfErrors(
211-
[
212-
AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes.Error.AwsCryptographyDbEncryptionSdkDynamoDbItemEncryptor(AwsCryptographyDbEncryptionSdkDynamoDbItemEncryptorTypes.Error.AwsCryptographyDbEncryptionSdkDynamoDb(AwsCryptographyDbEncryptionSdkDynamoDbTypes.Error.AwsCryptographyDbEncryptionSdkStructuredEncryption(AwsCryptographyDbEncryptionSdkStructuredEncryptionTypes.Error.StructuredEncryptionException(message := "Signature of record does not match the signature computed when the record was encrypted.")))),
213-
AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes.Error.DynamoDbEncryptionTransformsException(message := "bar = 1234; sortKey = 01020304"),
214-
AwsCryptographyDbEncryptionSdkDynamoDbTransformsTypes.Error.DynamoDbEncryptionTransformsException(message := "bar = 890; sortKey = 030104")
215-
],
216-
message := "Error(s) found decrypting Scan results."
217-
);
218-
}
21984
}

0 commit comments

Comments
 (0)