Encrypted JSONB operators and functions

Author: tobyhede

diagrams/overview-insert.drawio.svg

@@ -0,0 +1,40 @@
+-- REQUIRE: src/schema.sql
+-- REQUIRE: src/mac/types.sql
+
+
+-- extracts ste_vec index from a jsonb value
+DROP FUNCTION IF EXISTS  eql_v1.blake3(val jsonb);
+
+-- extracts blake3 index from a jsonb value
+DROP FUNCTION IF EXISTS  eql_v1.blake3(val jsonb);
+
+CREATE FUNCTION eql_v1.blake3(val jsonb)
+  RETURNS eql_v1.blake3
+  IMMUTABLE STRICT PARALLEL SAFE
+AS $$
+	BEGIN
+
+    IF NOT (val ? 'b') NULL THEN
+        RAISE 'Expected a blake3 index (b) value in json: %', val;
+    END IF;
+
+    IF val->>'b' IS NULL THEN
+      RETURN NULL;
+    END IF;
+
+    RETURN val->>'b';
+  END;
+$$ LANGUAGE plpgsql;
+
+
+-- extracts blake3 index from an eql_v1_encrypted value
+DROP FUNCTION IF EXISTS  eql_v1.blake3(val eql_v1_encrypted);
+
+CREATE FUNCTION eql_v1.blake3(val eql_v1_encrypted)
+  RETURNS eql_v1.blake3
+  IMMUTABLE STRICT PARALLEL SAFE
+AS $$
+  BEGIN
+    RETURN (SELECT eql_v1.blake3(val.data));
+  END;
+$$ LANGUAGE plpgsql;

diagrams/overview-select.drawio.svg

@@ -0,0 +1,4 @@
+-- REQUIRE: src/schema.sql
+
+DROP DOMAIN IF EXISTS eql_v1.blake3;
+CREATE DOMAIN eql_v1.blake3 AS text;

src/blake3/functions.sql

@@ -2,6 +2,54 @@
 -- REQUIRE: src/schema.sql
 
 
+-- Constant time comparison of 2 bytea values
+DROP FUNCTION IF EXISTS eql_v1.bytea_eq(a bytea, b bytea);
+
+CREATE FUNCTION eql_v1.bytea_eq(a bytea, b bytea) RETURNS boolean AS $$
+DECLARE
+    result boolean;
+    differing bytea;
+BEGIN
+
+    -- Check if the bytea values are the same length
+    IF LENGTH(a) != LENGTH(b) THEN
+        RETURN false;
+    END IF;
+
+    -- Compare each byte in the bytea values
+    result := true;
+    FOR i IN 1..LENGTH(a) LOOP
+        IF SUBSTRING(a FROM i FOR 1) != SUBSTRING(b FROM i FOR 1) THEN
+            result := result AND false;
+        END IF;
+    END LOOP;
+
+    RETURN result;
+END;
+$$ LANGUAGE plpgsql;
+
+
+DROP FUNCTION IF EXISTS eql_v1.jsonb_array_to_bytea_array(val jsonb);
+
+-- Casts a jsonb array of hex-encoded strings to an array of bytea.
+CREATE FUNCTION eql_v1.jsonb_array_to_bytea_array(val jsonb)
+RETURNS bytea[] AS $$
+DECLARE
+  terms_arr bytea[];
+BEGIN
+  IF jsonb_typeof(val) = 'null' THEN
+    RETURN NULL;
+  END IF;
+
+  SELECT array_agg(decode(value::text, 'hex')::bytea)
+    INTO terms_arr
+  FROM jsonb_array_elements_text(val) AS value;
+
+  RETURN terms_arr;
+END;
+$$ LANGUAGE plpgsql;
+
+
 
 --
 -- Convenience function to log a message

src/blake3/types.sql

@@ -18,6 +18,18 @@ AS $$
   END;
 $$ LANGUAGE plpgsql;
 
+DROP FUNCTION IF EXISTS eql_v1.ciphertext(val eql_v1_encrypted);
+
+CREATE FUNCTION eql_v1.ciphertext(val eql_v1_encrypted)
+  RETURNS text
+  IMMUTABLE STRICT PARALLEL SAFE
+AS $$
+	BEGIN
+    RETURN eql_v1.ciphertext(val.data);
+  END;
+$$ LANGUAGE plpgsql;
+
+
 
 DROP FUNCTION IF EXISTS eql_v1.to_jsonb(val eql_v1_encrypted);
 

src/common.sql

@@ -0,0 +1,234 @@
+-- REQUIRE: src/schema.sql
+-- REQUIRE: src/encrypted/types.sql
+
+-- The jsonpath operators @? and @@ suppress the following errors:
+--      missing object field or array element,
+--      unexpected JSON item type,
+--      datetime and numeric errors.
+-- The jsonpath-related functions described below can also be told to suppress these types of errors.
+-- This behavior might be helpful when searching JSON document collections of varying structure.
+
+
+
+--
+--
+-- Returns the stevec encrypted element matching the selector
+--
+-- If the
+
+DROP FUNCTION IF EXISTS eql_v1.jsonb_path_query(val jsonb, selector text);
+
+CREATE FUNCTION eql_v1.jsonb_path_query(val jsonb, selector text)
+  RETURNS SETOF eql_v1_encrypted
+  IMMUTABLE STRICT PARALLEL SAFE
+AS $$
+  DECLARE
+    e eql_v1_encrypted;
+    sv eql_v1_encrypted[];
+    found eql_v1_encrypted[];
+    ary boolean;
+  BEGIN
+
+    IF val IS NULL THEN
+      RETURN NEXT NULL;
+    END IF;
+
+    sv := eql_v1.ste_vec(val);
+
+    FOR idx IN 1..array_length(sv, 1) LOOP
+      e := sv[idx];
+
+      IF eql_v1.selector(e) = selector THEN
+        found := array_append(found, e);
+
+        IF eql_v1.is_ste_vec_array(e) THEN
+          ary := true;
+        END IF;
+
+      END IF;
+    END LOOP;
+
+    IF found IS NOT NULL THEN
+
+      IF ary THEN
+        RETURN NEXT jsonb_build_object(
+          'sv', found,
+          'a', 1
+        )::eql_v1_encrypted;
+
+      ELSE
+        RETURN NEXT found[1];
+      END IF;
+
+    END IF;
+
+    RETURN;
+  END;
+$$ LANGUAGE plpgsql;
+
+
+DROP FUNCTION IF EXISTS eql_v1.jsonb_path_query(val eql_v1_encrypted, selector text);
+
+CREATE FUNCTION eql_v1.jsonb_path_query(val eql_v1_encrypted, selector text)
+  RETURNS SETOF eql_v1_encrypted
+  IMMUTABLE STRICT PARALLEL SAFE
+AS $$
+  BEGIN
+    RETURN QUERY
+    SELECT * FROM eql_v1.jsonb_path_query(val.data, selector);
+  END;
+$$ LANGUAGE plpgsql;
+
+
+DROP FUNCTION IF EXISTS eql_v1.jsonb_path_exists(val jsonb, selector text);
+
+CREATE FUNCTION eql_v1.jsonb_path_exists(val jsonb, selector text)
+  RETURNS boolean
+  IMMUTABLE STRICT PARALLEL SAFE
+AS $$
+  BEGIN
+    RETURN EXISTS (
+      SELECT eql_v1.jsonb_path_query(val, selector)
+    );
+  END;
+$$ LANGUAGE plpgsql;
+
+
+DROP FUNCTION IF EXISTS eql_v1.jsonb_path_exists(val eql_v1_encrypted, selector text);
+
+CREATE FUNCTION eql_v1.jsonb_path_exists(val eql_v1_encrypted, selector text)
+  RETURNS boolean
+  IMMUTABLE STRICT PARALLEL SAFE
+AS $$
+  BEGIN
+    RETURN EXISTS (
+      SELECT eql_v1.jsonb_path_query(val, selector)
+    );
+  END;
+$$ LANGUAGE plpgsql;
+
+
+--
+--
+DROP FUNCTION IF EXISTS eql_v1.jsonb_path_query_first(val jsonb, selector text);
+
+CREATE FUNCTION eql_v1.jsonb_path_query_first(val jsonb, selector text)
+  RETURNS eql_v1_encrypted
+  IMMUTABLE STRICT PARALLEL SAFE
+AS $$
+  BEGIN
+    RETURN (
+      SELECT (
+        SELECT e
+        FROM eql_v1.jsonb_path_query(val.data, selector) AS e
+        LIMIT 1
+      )
+    );
+  END;
+$$ LANGUAGE plpgsql;
+
+
+DROP FUNCTION IF EXISTS eql_v1.jsonb_path_query_first(val eql_v1_encrypted, selector text);
+
+CREATE FUNCTION eql_v1.jsonb_path_query_first(val eql_v1_encrypted, selector text)
+  RETURNS eql_v1_encrypted
+  IMMUTABLE STRICT PARALLEL SAFE
+AS $$
+  BEGIN
+    RETURN (
+        SELECT e
+        FROM eql_v1.jsonb_path_query(val.data, selector) as e
+        LIMIT 1
+    );
+  END;
+$$ LANGUAGE plpgsql;
+
+
+
+--
+
+
+-- =====================================================================
+
+
+DROP FUNCTION IF EXISTS eql_v1.jsonb_array_length(val jsonb);
+
+CREATE FUNCTION eql_v1.jsonb_array_length(val jsonb)
+  RETURNS integer
+  IMMUTABLE STRICT PARALLEL SAFE
+AS $$
+  DECLARE
+    sv eql_v1_encrypted[];
+    found eql_v1_encrypted[];
+  BEGIN
+
+    -- PERFORM eql_v1.log('eql_v1.jsonb_array_length', val::text);
+
+    IF val IS NULL THEN
+      RETURN NULL;
+    END IF;
+
+    IF eql_v1.is_ste_vec_array(val) THEN
+      sv := eql_v1.ste_vec(val);
+      -- PERFORM eql_v1.log('eql_v1.jsonb_array_length', sv::text);
+      RETURN array_length(sv, 1);
+    END IF;
+
+    RAISE 'cannot get array length of a non-array';
+  END;
+$$ LANGUAGE plpgsql;
+
+
+DROP FUNCTION IF EXISTS eql_v1.jsonb_array_length(val eql_v1_encrypted);
+
+CREATE FUNCTION eql_v1.jsonb_array_length(val eql_v1_encrypted)
+  RETURNS integer
+  IMMUTABLE STRICT PARALLEL SAFE
+AS $$
+  BEGIN
+    RETURN (
+      SELECT eql_v1.jsonb_array_length(val.data)
+    );
+  END;
+$$ LANGUAGE plpgsql;
+
+
+
+
+
+
+-- DROP FUNCTION IF EXISTS eql_v1.jsonb_array_elements(val jsonb);
+
+-- CREATE FUNCTION eql_v1.jsonb_array_elements(val jsonb)
+--   RETURNS SETOF eql_v1_encrypted
+--   IMMUTABLE STRICT PARALLEL SAFE
+-- AS $$
+--   DECLARE
+--     sv eql_v1_encrypted[];
+--     found eql_v1_encrypted[];
+--   BEGIN
+
+--     IF val IS NULL THEN
+--       RETURN NEXT NULL;
+--     END IF;
+
+--     sv := eql_v1.ste_vec(val);
+
+--     FOR idx IN 1..array_length(sv, 1) LOOP
+--       IF eql_v1.selector(sv[idx]) = selector THEN
+--         found := array_append(found, sv[idx]);
+--       END IF;
+--     END LOOP;
+
+--     IF found IS NOT NULL THEN
+--       FOR idx IN 1..array_length(found, 1) LOOP
+--         IF found[idx] IS NOT NULL THEN
+--           RETURN NEXT found[idx];
+--         END IF;
+--       END LOOP;
+--     END IF;
+
+--     RETURN;
+--   END;
+-- $$ LANGUAGE plpgsql;
+