Skip to content

refactor(client): __interop_read awaits one shared read, opens ciphertext synchronously (LAB-12943) #229

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
27Bslash6 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

refactor(client): __interop_read awaits one shared read, opens ciphertext synchronously (LAB-12943) #229

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c97dad0
refactor(client): __interop_read awaits one shared read, opens cipher…
27Bslash6 Nov 7, 2026
b4a64d5
docs(client): encrypting() states the branch-before-encode/decode rul…
27Bslash6 Nov 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 17 additions & 27 deletions crates/cachekit/src/client.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1254,16 +1254,23 @@ impl CacheKit {
&self,
key: &str,
) -> Result<Option<(T, ReadOutcome)>, CachekitError> {
#[cfg(feature = "encryption")]
if let Some(secure) = self.encrypting() {
return secure.__interop_read(key).await;
}
self.reject_namespaced_interop()?;
let full_key = self.resolve_key(key)?;
match self.read_bytes(&full_key, None).await? {
Some((payload, by)) => Ok(Some((crate::interop::deserialize_payload(&payload)?, by))),
None => Ok(None),
let Some((payload, by)) = self.read_bytes(&full_key, None).await? else {
return Ok(None);
};
// Branch after the await, synchronously, as `interop_read_swr` does.
#[cfg(feature = "encryption")]
if let Some(secure) = self.encrypting() {
let value = secure.open(
&payload,
by,
&full_key,
crate::interop::deserialize_decrypted,
)?;
return Ok(Some((value, by)));
}
Ok(Some((crate::interop::deserialize_payload(&payload)?, by)))
}

/// [`Self::interop_get_swr`] for a `#[cachekit]` call, uncounted like
Expand Down Expand Up @@ -1383,9 +1390,9 @@ impl CacheKit {
}

/// The encrypting handle when encryption is configured. Every value
/// method routes through it first, so a configured key leaves no
/// plaintext path (protocol `spec/intent-presets.md` § Encryption
/// Activation, rule 1).
/// method branches on it before it encodes or decodes a value, so a
/// configured key leaves no plaintext path (protocol
/// `spec/intent-presets.md` § Encryption Activation, rule 1).
#[cfg(feature = "encryption")]
fn encrypting(&self) -> Option<SecureCache<'_>> {
self.encryption.as_deref().map(|encryption| SecureCache {
Expand Down Expand Up @@ -1619,23 +1626,6 @@ impl SecureCache<'_> {
Ok(read)
}

/// The secure twin of [`CacheKit::__interop_read`], which hands an
/// encrypting client's reads here.
async fn __interop_read<T: DeserializeOwned>(
&self,
key: &str,
) -> Result<Option<(T, ReadOutcome)>, CachekitError> {
self.client.reject_namespaced_interop()?;
let full_key = self.client.resolve_key(key)?;
match self.client.read_bytes(&full_key, None).await? {
Some((ct, by)) => Ok(Some((
self.open(&ct, by, &full_key, crate::interop::deserialize_decrypted)?,
by,
))),
None => Ok(None),
}
}

/// [`Self::open`] over `read`, what an encrypting client's
/// [`CacheKit::__interop_read_swr`] or
/// [`CacheKit::__interop_read_swr_leading`] read for `full_key`.
Expand Down
Loading