Repository navigation
stack-encrypt: a second .extend() replaces the first, so Rust builds a different context than Go and a query silently misses #1120
Description
Background
A context is extra data bound into every ciphertext and search term (for example a tenant ID). The same context must be given to encrypt, to decrypt and to query. In stack-encrypt (Rust) a plan chain adds context parts with .extend(parts). The Go SDK adds them with ExtendContext(...).
Problem
The two APIs combine several parts differently:
| spelling | context |
|---|---|
Go ExtendContext(a, b), or ExtendContext(a), ExtendContext(b) |
((label)/a)/b |
Rust .extend(a).extend(b) |
(label)/b: the second call replaces the first |
Rust .extend(NonEmpty::from(a).with(b)) |
(label)/(a/b) |
Rust .extend(DeclaredContext::default().with(a).with(b)) |
((label)/a)/b, the same as Go |
The doc comment on .extend() in packages/stack-encrypt/src/plan/chain.rs says "A second call replaces the first". DeclaredContext::with appends instead.
If a Rust developer writes the natural spelling, .extend(tenant).extend(region), against rows that Go wrote, then decrypting fails. That failure is safe. But a query term built that way matches no rows and returns no error, so the application silently gets an empty result.
Proposal
- Make
.extend()append its parts after any earlier parts, asDeclaredContext::withand Go do. - Add a case to the test
several_parts_nest_to_the_left: encrypt with.extend(7u64).extend("eu")and decrypt the row through a data plan. - Note the behaviour change in the CHANGELOG, because a caller relying on "replaces" would get a different context.
Found in the review of #1093.
Activity
coderdan commentedon Oct 7, 2026
From the #1093 review thread: #1093 (comment)