You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
EQL: write the same SQL out as eql_v3 and eql_v4, so Stack Encrypt columns are their own Postgres types #1141
EQL's SQL installs data types (domains such as eql_v3_text_eq, kept in the public schema) and the functions that compare them (in the disposable eql_v3 and eql_v3_internal schemas, per ADR-0001). Each domain checks the
payload's version field: VALUE->>'v' = '3'.
Problem
Stack Encrypt and cipherstash-client both write the same eql_v3_* domains,
but their search terms never match each other. A Go query against a column
the TypeScript SDK wrote returns no rows, and nothing warns. ADR-0002 (#1139)
separates them as EQL v4: identical SQL, but distinct Postgres types, so a
wrong-version write fails its domain check and typed clients see different
types. A plain = across versions still falls back to jsonb = jsonb and
returns no rows; #1160 covers that.
Proposal
Replace the literal schema name and version in the hand-written packages/eql/src/v3/** SQL with build-time placeholders, as eql-codegen's
templates already do ({{ schema }}). This covers about 24k lines that
mention eql_v3, and VALUE->>'v' = '3' in every domain check.
Have the build write out eql_v3 (version 3) and eql_v4 (version 4),
each with its own release manifest and digests.
Keep ADR-0001's split: public.eql_v4_* data domains survive reinstall,
and eql_v4 and eql_v4_internal stay disposable.
Run the SQLx suites against both. Add tests that pin what separate names
enforce with both bundles installed in one database. Inserting a payload of
the wrong version fails its domain check. The function form eql_v3.eq(v3col, v4term) fails as not unique. v3col = v4term returns
no rows without an error, because Postgres falls back to jsonb = jsonb. That last case is pinned so it can't change unnoticed; EQL: = between an eql_v3 column and an eql_v4 query term returns no rows silently — add cross-version blocker operators #1160 turns it into an error.
This can start now; it depends on nothing in vitaminc.
Activity
refactor(eql): write the SQL source with schema and version placeholders
chore(eql): regenerate the scalar SQL surface with placeholders
docs(adr): correct ADR-0002 on what EQL v4's separate names enforce
refactor(eql): write the SQL source with schema and version placeholders
chore(eql): regenerate the scalar SQL surface with placeholders