fix null nonce bug, fix bug where role has more than one table labele…

…d, install script for 3.0.2.

.github/workflows/release.yml

@@ -19,17 +19,17 @@ jobs:
       run: pgxn-bundle
     - name: Release on PGXN
       run: pgxn-release
-    - name: Create GitHub Release
-      id: release
-      uses: actions/create-release@v1
-      with:
-        tag_name: ${{ github.ref }}
-        release_name: Release ${{ github.ref }}
-        body_path: latest-changes.md
-    - name: Upload Release Asset
-      uses: actions/upload-release-asset@v1
-      with:
-        upload_url: ${{ steps.release.outputs.upload_url }}
-        asset_path: ./${{ steps.bundle.outputs.bundle }}
-        asset_name: ${{ steps.bundle.outputs.bundle }}
-        asset_content_type: application/zip
+    # - name: Create GitHub Release
+    #   id: release
+    #   uses: actions/create-release@v1
+    #   with:
+    #     tag_name: ${{ github.ref }}
+    #     release_name: Release ${{ github.ref }}
+    #     body_path: latest-changes.md
+    # - name: Upload Release Asset
+    #   uses: actions/upload-release-asset@v1
+    #   with:
+    #     upload_url: ${{ steps.release.outputs.upload_url }}
+    #     asset_path: ./${{ steps.bundle.outputs.bundle }}
+    #     asset_name: ${{ steps.bundle.outputs.bundle }}
+    #     asset_content_type: application/zip

META.json

@@ -2,7 +2,7 @@
     "name": "pgsodium",
     "abstract": "Postgres extension for libsodium functions",
     "description": "pgsodium is a PostgreSQL extension that exposes modern libsodium based cryptographic functions to SQL.",
-    "version": "3.0.0",
+    "version": "3.0.2",
     "maintainer": [
         "Michel Pelletier <[email protected]>"
     ],
@@ -13,7 +13,7 @@
             "abstract": "Postgres extension for libsodium functions",
             "file": "src/pgsodium.h",
             "docfile": "README.md",
-            "version": "3.0.0"
+            "version": "3.0.2"
         }
     },
     "prereqs": {

example/tce.sql

@@ -2,6 +2,10 @@ CREATE SCHEMA IF NOT EXISTS pgsodium;
 CREATE EXTENSION IF NOT EXISTS pgsodium WITH SCHEMA pgsodium CASCADE;
 
 CREATE TABLE test (
+  secret text
+);
+
+CREATE TABLE test2 (
   secret text,
   associated text,
   nonce bytea,
@@ -13,21 +17,24 @@ CREATE TABLE test (
 
 CREATE ROLE bob with login password 'foo';
 
-SECURITY LABEL FOR pgsodium ON ROLE bob is 'ACCESS public.test';
+SECURITY LABEL FOR pgsodium ON ROLE bob is 'ACCESS public.test2';
+
+SELECT format('ENCRYPT WITH KEY ID %s', (pgsodium.create_key('Optional Comment for Secret Key')).id) AS seclabel \gset
 
-SELECT format('ENCRYPT WITH KEY ID %s ASSOCIATED associated NONCE nonce',
-              (pgsodium.create_key('Optional Comment for Secret Key')).id) AS seclabel \gset
+SELECT format('ENCRYPT WITH KEY ID %s ASSOCIATED associated NONCE nonce', (pgsodium.create_key('Optional Comment for Secret Key')).id) AS seclabel2 \gset
 
 SELECT id AS secret2_key_id FROM pgsodium.create_key('Comment for Secret2 Key') \gset
 
 SECURITY LABEL FOR pgsodium	ON COLUMN test.secret IS :'seclabel';
 
-SECURITY LABEL FOR pgsodium	ON COLUMN test.secret2 IS
-                 'ENCRYPT WITH KEY COLUMN secret2_key_id ASSOCIATED associated2 NONCE nonce2';
+SECURITY LABEL FOR pgsodium	ON COLUMN test2.secret IS :'seclabel2';
+
+SECURITY LABEL FOR pgsodium	ON COLUMN test2.secret2 IS 'ENCRYPT WITH KEY COLUMN secret2_key_id ASSOCIATED associated2 NONCE nonce2';
 
 SELECT pgsodium.crypto_aead_det_noncegen() aead_nonce \gset
 SELECT pgsodium.crypto_aead_det_noncegen() aead_nonce2 \gset
 
-INSERT INTO public.test (secret, associated, nonce, secret2, associated2, nonce2, secret2_key_id)
-    VALUES ('sssh', 'bob was here', :'aead_nonce', 'aaahh', 'alice association', :'aead_nonce2', :'secret2_key_id'::uuid);
+INSERT INTO public.test (secret) VALUES ('noice');
+
+INSERT INTO public.test2 (secret, associated, nonce, secret2, associated2, nonce2, secret2_key_id) VALUES ('sssh', 'bob was here', :'aead_nonce', 'aaahh', 'alice association', :'aead_nonce2', :'secret2_key_id'::uuid);
 

pgsodium.control

@@ -1,5 +1,5 @@
 # pgsodium extension
 comment = 'Postgres extension for libsodium functions'
-default_version = '3.0.0'
+default_version = '3.0.2'
 relocatable = false
 requires = '"uuid-ossp"'

sql/pgsodium--2.0.2--3.0.0.sql

@@ -285,7 +285,7 @@ CREATE FUNCTION @[email protected]_mask(role regrole, source_name text)
       FROM pg_shseclabel
      WHERE  objoid = role
        AND provider = 'pgsodium'
-       AND label SIMILAR TO 'ACCESS +' || source_name)
+       AND label ilike 'ACCESS%' || source_name || '%')
   );
 
 -- Display all columns of the relation with the masking function (if any)

sql/pgsodium--3.0.0--3.0.2.sql

@@ -0,0 +1,3 @@
+
+ALTER FUNCTION @[email protected]_aead_det_encrypt(message bytea, additional bytea, key_uuid uuid, nonce bytea) CALLED ON NULL INPUT;
+ALTER FUNCTION @[email protected]_aead_det_decrypt(message bytea, additional bytea, key_uuid uuid, nonce bytea) CALLED ON NULL INPUT;  

test/tce.sql

@@ -12,11 +12,16 @@ SELECT throws_ok(
   'pgsodium provider does not support labels on this object',
   'schemas cannot be labled');
 
+CREATE TABLE private.foo(
+  secret text,
+  associated text
+);
+
 CREATE TABLE private.bar(
   secret text,
   associated text,
-  secret2 text,
   nonce bytea,
+  secret2 text,
   associated2 text,
   secret2_key_id uuid,
   nonce2 bytea
@@ -37,6 +42,13 @@ SELECT id AS secret_key_id FROM pgsodium.create_key('Optional Comment') \gset
 SELECT id AS secret2_key_id
   FROM pgsodium.create_key('Optional Comment 2') \gset
 
+SELECT lives_ok(
+  format($test$
+         SECURITY LABEL FOR pgsodium ON COLUMN private.foo.secret
+         IS 'ENCRYPT WITH KEY ID %s'
+         $test$, :'secret_key_id'),
+  'can label column for encryption');
+
 SELECT lives_ok(
   format($test$
          SECURITY LABEL FOR pgsodium ON COLUMN private.bar.secret
@@ -47,11 +59,12 @@ SELECT lives_ok(
 CREATE ROLE bobo with login password 'foo';
 
 GRANT USAGE ON SCHEMA private to bobo;
+GRANT SELECT ON TABLE private.foo to bobo;
 GRANT SELECT ON TABLE private.bar to bobo;
 
 SELECT lives_ok(
   $test$
-  SECURITY LABEL FOR pgsodium ON ROLE bobo is 'ACCESS private.bar'
+  SECURITY LABEL FOR pgsodium ON ROLE bobo is 'ACCESS private.foo, private.bar'
   $test$,
   'can label roles ACCESS');
 
@@ -68,11 +81,18 @@ COMMIT;
 \c postgres bobo
 
 BEGIN;
-SELECT plan(2);
+SELECT plan(4);
 
 SELECT pgsodium.crypto_aead_det_noncegen() nonce \gset
 SELECT pgsodium.crypto_aead_det_noncegen() nonce2 \gset
 
+SELECT lives_ok(
+  format(
+    $test$
+    INSERT INTO foo (secret) VALUES ('s3kr3t');
+    $test$),
+    'can insert into foo table');
+
 SELECT lives_ok(
   format(
     $test$
@@ -82,7 +102,12 @@ SELECT lives_ok(
     :'nonce',
     :'nonce2',
     :'secret2_key_id'),
-    'can insert into base table');
+    'can insert into bar table');
+
+SELECT results_eq(
+    $$SELECT decrypted_secret = 's3kr3t' FROM foo$$,
+    $$VALUES (true)$$,
+    'can select from masking view');
 
 SELECT results_eq(
     $$SELECT decrypted_secret = 's3kr3t' FROM bar$$,