Help us shape the future of Go! Take the 2026 Go Developer Survey

testusers

package
v0.1.0-rc.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 2, 2026 License: MIT Imports: 9 Imported by: 0

Documentation

Overview

Package testusers holds the tagged structs the encrypt tests encrypt through the generated API: a record in separate columns, an opaque struct, and a probe struct with one field of each scalar type for the term ordering tests. The *_stash.go files beside them are what stashgen writes from the tags; `go generate ./...` rewrites them, and CI fails when that changes a file.

Index

Constants

This section is empty.

Variables

View Source 
var AccountFields = struct {
	Email AccountEmailField
}{
	Email: AccountEmailField{gensupport.NewField[string](accountDeclaration, "email")},
}
View Source 
var BirthdayFields = struct {
	DOB BirthdayDOBField
}{
	DOB: BirthdayDOBField{gensupport.NewField[encrypt.Date](birthdayDeclaration, "dob")},
}
View Source 
var ContactFields = struct {
	Email ContactEmailField
	Notes ContactNotesField
}{
	Email: ContactEmailField{gensupport.NewField[string](contactDeclaration, "email")},
	Notes: ContactNotesField{gensupport.NewField[string](contactDeclaration, "notes")},
}
View Source 
var CustomerFields = struct {
	Profile CustomerProfileField
	Prefs   CustomerPrefsField
}{
	Profile: newCustomerProfileField(gensupport.NewField[json.RawMessage](customerDeclaration, "profile")),
	Prefs:   newCustomerPrefsField(gensupport.NewField[json.RawMessage](customerDeclaration, "prefs")),
}

CustomerFields provides operations for the sealed fields of Customer. Each entry binds queries and encrypts updates using its field's declaration.

View Source 
var CustomerPaths = func() (paths struct {
	Profile struct {
		Visits struct {
			At encrypt.Path[CustomerProfileFieldElementsVisits, any] // $.visits[*].at
		}
	}
}) {
	paths.Profile.Visits.At = encrypt.NewPath[CustomerProfileFieldElementsVisits, any]("$.visits[*]", "at")
	return paths
}()

CustomerPaths names the ordered members of the arrays of Customer's documents, nested as the JSON nests them, for the element match: encrypt.AtPath(CustomerPaths.Profile.Visits.At) makes the predicates CustomerFields.Profile.Elements.Visits.Match takes. Each path's type names its array and the member's Go type, so a predicate on another array's member, or with a value of another type, does not compile.

View Source 
var EntityFields = struct {
	CustomFieldValues EntityCustomFieldValuesField
}{
	CustomFieldValues: newEntityCustomFieldValuesField(gensupport.NewDocumentField[CustomFieldValues](entityDeclaration, "custom_field_values")),
}

EntityFields provides operations for the sealed fields of Entity. Each entry binds queries and encrypts updates using its field's declaration.

View Source 
var EntityPaths = func() (paths struct {
	CustomFieldValues struct {
		Extra struct {
			EmergencyContacts struct {
				Relationship      encrypt.Path[EntityCustomFieldValuesFieldElementsExtraEmergencyContacts, string] // $.extra.emergency_contacts[*].relationship
				PreviousCallCount encrypt.Path[EntityCustomFieldValuesFieldElementsExtraEmergencyContacts, int64]  // $.extra.emergency_contacts[*].previous_call_count
				Age               encrypt.Path[EntityCustomFieldValuesFieldElementsExtraEmergencyContacts, int64]  // $.extra.emergency_contacts[*].age
			}
		}
	}
}) {
	paths.CustomFieldValues.Extra.EmergencyContacts.Relationship = encrypt.NewPath[EntityCustomFieldValuesFieldElementsExtraEmergencyContacts, string]("$.extra.emergency_contacts[*]", "relationship")
	paths.CustomFieldValues.Extra.EmergencyContacts.PreviousCallCount = encrypt.NewPath[EntityCustomFieldValuesFieldElementsExtraEmergencyContacts, int64]("$.extra.emergency_contacts[*]", "previous_call_count")
	paths.CustomFieldValues.Extra.EmergencyContacts.Age = encrypt.NewPath[EntityCustomFieldValuesFieldElementsExtraEmergencyContacts, int64]("$.extra.emergency_contacts[*]", "age")
	return paths
}()

EntityPaths names the ordered members of the arrays of Entity's documents, nested as the JSON nests them, for the element match: encrypt.AtPath(EntityPaths.CustomFieldValues.Extra.EmergencyContacts.Relationship) makes the predicates EntityFields.CustomFieldValues.Elements.ExtraEmergencyContacts.Match takes. Each path's type names its array and the member's Go type, so a predicate on another array's member, or with a value of another type, does not compile.

View Source 
var EntryFields = struct {
	Name EntryNameField
}{
	Name: EntryNameField{gensupport.NewField[string](entryDeclaration, "name")},
}
View Source 
var Fields = struct {
	Age   AgeField
	Email EmailField
	Notes NotesField
}{
	Age:   AgeField{gensupport.NewField[uint32](declaration, "age")},
	Email: EmailField{gensupport.NewField[string](declaration, "email")},
	Notes: NotesField{gensupport.NewField[string](declaration, "notes")},
}
View Source 
var KindsFields = struct {
	S   KindsSField
	E   KindsEField
	Bo  KindsBoField
	I8  KindsI8Field
	I16 KindsI16Field
	I32 KindsI32Field
	I   KindsIField
	I64 KindsI64Field
	U8  KindsU8Field
	U16 KindsU16Field
	U32 KindsU32Field
	U   KindsUField
	U64 KindsU64Field
	F32 KindsF32Field
	F64 KindsF64Field
	By  KindsByField
	Bl  KindsBlField
	Sc  KindsScField
	St  KindsStField
	D   KindsDField
}{
	S:   KindsSField{gensupport.NewField[string](kindsDeclaration, "s")},
	E:   KindsEField{gensupport.NewField[Email](kindsDeclaration, "e")},
	Bo:  KindsBoField{gensupport.NewField[bool](kindsDeclaration, "bo")},
	I8:  KindsI8Field{gensupport.NewField[int8](kindsDeclaration, "i8")},
	I16: KindsI16Field{gensupport.NewField[int16](kindsDeclaration, "i16")},
	I32: KindsI32Field{gensupport.NewField[int32](kindsDeclaration, "i32")},
	I:   KindsIField{gensupport.NewField[int](kindsDeclaration, "i")},
	I64: KindsI64Field{gensupport.NewField[int64](kindsDeclaration, "i64")},
	U8:  KindsU8Field{gensupport.NewField[uint8](kindsDeclaration, "u8")},
	U16: KindsU16Field{gensupport.NewField[uint16](kindsDeclaration, "u16")},
	U32: KindsU32Field{gensupport.NewField[uint32](kindsDeclaration, "u32")},
	U:   KindsUField{gensupport.NewField[uint](kindsDeclaration, "u")},
	U64: KindsU64Field{gensupport.NewField[uint64](kindsDeclaration, "u64")},
	F32: KindsF32Field{gensupport.NewField[float32](kindsDeclaration, "f32")},
	F64: KindsF64Field{gensupport.NewField[float64](kindsDeclaration, "f64")},
	By:  KindsByField{gensupport.NewField[[]byte](kindsDeclaration, "by")},
	Bl:  KindsBlField{gensupport.NewField[Blob](kindsDeclaration, "bl")},
	Sc:  KindsScField{gensupport.NewField[Score](kindsDeclaration, "sc")},
	St:  KindsStField{gensupport.NewField[Status](kindsDeclaration, "st")},
	D:   KindsDField{gensupport.NewField[time.Duration](kindsDeclaration, "d")},
}
View Source 
var LedgerFields = struct {
	Opened  LedgerOpenedField
	Due     LedgerDueField
	Created LedgerCreatedField
	Posted  LedgerPostedField
	Total   LedgerTotalField
	Amount  LedgerAmountField
}{
	Opened:  LedgerOpenedField{gensupport.NewField[encrypt.Date](ledgerDeclaration, "opened")},
	Due:     LedgerDueField{gensupport.NewField[encrypt.Date](ledgerDeclaration, "due")},
	Created: LedgerCreatedField{gensupport.NewField[time.Time](ledgerDeclaration, "created")},
	Posted:  LedgerPostedField{gensupport.NewField[time.Time](ledgerDeclaration, "posted")},
	Total:   LedgerTotalField{gensupport.NewField[encrypt.Decimal](ledgerDeclaration, "total")},
	Amount:  LedgerAmountField{gensupport.NewField[encrypt.Decimal](ledgerDeclaration, "amount")},
}
View Source 
var LookupFields = struct {
	Email LookupEmailField
	Score LookupScoreField
	Code  LookupCodeField
}{
	Email: LookupEmailField{gensupport.NewField[string](lookupDeclaration, "email")},
	Score: LookupScoreField{gensupport.NewField[int32](lookupDeclaration, "score")},
	Code:  LookupCodeField{gensupport.NewField[Status](lookupDeclaration, "code")},
}
View Source 
var MemberFields = struct {
	Age   MemberAgeField
	Email MemberEmailField
	Notes MemberNotesField
}{
	Age:   MemberAgeField{gensupport.NewField[uint32](memberDeclaration, "age")},
	Email: MemberEmailField{gensupport.NewField[string](memberDeclaration, "email")},
	Notes: MemberNotesField{gensupport.NewField[string](memberDeclaration, "notes")},
}
View Source 
var NoteFields = struct {
	Text NoteTextField
}{
	Text: NoteTextField{gensupport.NewField[string](noteDeclaration, "text")},
}
View Source 
var PersonFields = struct {
	DOB    PersonDOBField
	Born   PersonBornField
	Joined PersonJoinedField
	Age    PersonAgeField
	Score  PersonScoreField
	Nick   PersonNickField
}{
	DOB:    PersonDOBField{gensupport.NewField[encrypt.Date](personDeclaration, "dob")},
	Born:   PersonBornField{gensupport.NewField[encrypt.Date](personDeclaration, "born")},
	Joined: PersonJoinedField{gensupport.NewField[encrypt.Date](personDeclaration, "joined")},
	Age:    PersonAgeField{gensupport.NewField[int32](personDeclaration, "age")},
	Score:  PersonScoreField{gensupport.NewField[int64](personDeclaration, "score")},
	Nick:   PersonNickField{gensupport.NewField[string](personDeclaration, "nick")},
}
View Source 
var ProbeFields = struct {
	U32 ProbeU32Field
	U64 ProbeU64Field
	I64 ProbeI64Field
	S   ProbeSField
	B   ProbeBField
	F64 ProbeF64Field
	F32 ProbeF32Field
}{
	U32: ProbeU32Field{gensupport.NewField[uint32](probeDeclaration, "u32")},
	U64: ProbeU64Field{gensupport.NewField[uint64](probeDeclaration, "u64")},
	I64: ProbeI64Field{gensupport.NewField[int64](probeDeclaration, "i64")},
	S:   ProbeSField{gensupport.NewField[string](probeDeclaration, "s")},
	B:   ProbeBField{gensupport.NewField[[]byte](probeDeclaration, "b")},
	F64: ProbeF64Field{gensupport.NewField[float64](probeDeclaration, "f64")},
	F32: ProbeF32Field{gensupport.NewField[float32](probeDeclaration, "f32")},
}
View Source 
var ProfileFields = struct {
	Visits  ProfileVisitsField
	Balance ProfileBalanceField
	Active  ProfileActiveField
	Ratio   ProfileRatioField
	Score   ProfileScoreField
	Note    ProfileNoteField
	Name    ProfileNameField
	Age     ProfileAgeField
	Rank    ProfileRankField
	Weight  ProfileWeightField
	Price   ProfilePriceField
	Email   ProfileEmailField
}{
	Visits:  ProfileVisitsField{gensupport.NewField[int32](profileDeclaration, "visits")},
	Balance: ProfileBalanceField{gensupport.NewField[int64](profileDeclaration, "balance")},
	Active:  ProfileActiveField{gensupport.NewField[bool](profileDeclaration, "active")},
	Ratio:   ProfileRatioField{gensupport.NewField[float32](profileDeclaration, "ratio")},
	Score:   ProfileScoreField{gensupport.NewField[float64](profileDeclaration, "score")},
	Note:    ProfileNoteField{gensupport.NewField[string](profileDeclaration, "note")},
	Name:    ProfileNameField{gensupport.NewField[string](profileDeclaration, "name")},
	Age:     ProfileAgeField{gensupport.NewField[int32](profileDeclaration, "age")},
	Rank:    ProfileRankField{gensupport.NewField[int64](profileDeclaration, "rank")},
	Weight:  ProfileWeightField{gensupport.NewField[float32](profileDeclaration, "weight")},
	Price:   ProfilePriceField{gensupport.NewField[float64](profileDeclaration, "price")},
	Email:   ProfileEmailField{gensupport.NewField[string](profileDeclaration, "email")},
}
View Source 
var QueryProfileFields = struct {
	Email QueryProfileEmailField
	Age   QueryProfileAgeField
	Name  QueryProfileNameField
	Score QueryProfileScoreField
}{
	Email: QueryProfileEmailField{gensupport.NewField[string](queryProfileDeclaration, "email")},
	Age:   QueryProfileAgeField{gensupport.NewField[uint32](queryProfileDeclaration, "age")},
	Name:  QueryProfileNameField{gensupport.NewField[string](queryProfileDeclaration, "name")},
	Score: QueryProfileScoreField{gensupport.NewField[float64](queryProfileDeclaration, "score")},
}
View Source 
var RankingFields = struct {
	Level  RankingLevelField
	Floor  RankingFloorField
	Points RankingPointsField
	Total  RankingTotalField
	Speed  RankingSpeedField
	Pace   RankingPaceField
	Score  RankingScoreField
	Mean   RankingMeanField
	Title  RankingTitleField
	Handle RankingHandleField
}{
	Level:  RankingLevelField{gensupport.NewField[int32](rankingDeclaration, "level")},
	Floor:  RankingFloorField{gensupport.NewField[int32](rankingDeclaration, "floor")},
	Points: RankingPointsField{gensupport.NewField[int64](rankingDeclaration, "points")},
	Total:  RankingTotalField{gensupport.NewField[int64](rankingDeclaration, "total")},
	Speed:  RankingSpeedField{gensupport.NewField[float32](rankingDeclaration, "speed")},
	Pace:   RankingPaceField{gensupport.NewField[float32](rankingDeclaration, "pace")},
	Score:  RankingScoreField{gensupport.NewField[float64](rankingDeclaration, "score")},
	Mean:   RankingMeanField{gensupport.NewField[float64](rankingDeclaration, "mean")},
	Title:  RankingTitleField{gensupport.NewField[string](rankingDeclaration, "title")},
	Handle: RankingHandleField{gensupport.NewField[string](rankingDeclaration, "handle")},
}
View Source 
var SecretFields = struct {
	Value SecretValueField
}{
	Value: SecretValueField{gensupport.NewField[string](secretDeclaration, "value")},
}
View Source 
var SubscriberFields = struct {
	Profile SubscriberProfileField
	Prefs   SubscriberPrefsField
	Labels  SubscriberLabelsField
}{
	Profile: newSubscriberProfileField(gensupport.NewDocumentField[SubscriberProfile](subscriberDeclaration, "profile")),
	Prefs:   newSubscriberPrefsField(gensupport.NewDocumentField[SubscriberPrefs](subscriberDeclaration, "prefs")),
	Labels:  newSubscriberLabelsField(gensupport.NewField[map[string]string](subscriberDeclaration, "labels")),
}

SubscriberFields provides operations for the sealed fields of Subscriber. Each entry binds queries and encrypts updates using its field's declaration.

View Source 
var SubscriberPaths = func() (paths struct {
	Profile struct {
		Visits struct {
			At encrypt.Path[SubscriberProfileFieldElementsVisits, int64] // $.visits[*].at
		}
	}
}) {
	paths.Profile.Visits.At = encrypt.NewPath[SubscriberProfileFieldElementsVisits, int64]("$.visits[*]", "at")
	return paths
}()

SubscriberPaths names the ordered members of the arrays of Subscriber's documents, nested as the JSON nests them, for the element match: encrypt.AtPath(SubscriberPaths.Profile.Visits.At) makes the predicates SubscriberFields.Profile.Elements.Visits.Match takes. Each path's type names its array and the member's Go type, so a predicate on another array's member, or with a value of another type, does not compile.

View Source 
var TallyFields = struct {
	Small TallySmallField
	Count TallyCountField
	Wide  TallyWideField
}{
	Small: TallySmallField{gensupport.NewField[int16](tallyDeclaration, "small")},
	Count: TallyCountField{gensupport.NewField[int16](tallyDeclaration, "tally")},
	Wide:  TallyWideField{gensupport.NewField[int32](tallyDeclaration, "wide")},
}
View Source 
var ValueKindsFields = struct {
	I8     ValueKindsI8Field
	I16    ValueKindsI16Field
	U8     ValueKindsU8Field
	U16    ValueKindsU16Field
	I128   ValueKindsI128Field
	U128   ValueKindsU128Field
	Date   ValueKindsDateField
	At     ValueKindsAtField
	Amount ValueKindsAmountField
}{
	I8:     ValueKindsI8Field{gensupport.NewField[int8](valueKindsDeclaration, "i8")},
	I16:    ValueKindsI16Field{gensupport.NewField[int16](valueKindsDeclaration, "i16")},
	U8:     ValueKindsU8Field{gensupport.NewField[uint8](valueKindsDeclaration, "u8")},
	U16:    ValueKindsU16Field{gensupport.NewField[uint16](valueKindsDeclaration, "u16")},
	I128:   ValueKindsI128Field{gensupport.NewField[encrypt.Int128](valueKindsDeclaration, "i128")},
	U128:   ValueKindsU128Field{gensupport.NewField[encrypt.Uint128](valueKindsDeclaration, "u128")},
	Date:   ValueKindsDateField{gensupport.NewField[encrypt.Date](valueKindsDeclaration, "date")},
	At:     ValueKindsAtField{gensupport.NewField[time.Time](valueKindsDeclaration, "at")},
	Amount: ValueKindsAmountField{gensupport.NewField[encrypt.Decimal](valueKindsDeclaration, "amount")},
}
View Source 
var WidenedFields = struct {
	Visits  WidenedVisitsField
	Balance WidenedBalanceField
	Age     WidenedAgeField
	Rank    WidenedRankField
	Count   WidenedCountField
}{
	Visits:  WidenedVisitsField{gensupport.NewField[uint8](widenedDeclaration, "visits")},
	Balance: WidenedBalanceField{gensupport.NewField[int](widenedDeclaration, "balance")},
	Age:     WidenedAgeField{gensupport.NewField[int16](widenedDeclaration, "age")},
	Rank:    WidenedRankField{gensupport.NewField[uint32](widenedDeclaration, "rank")},
	Count:   WidenedCountField{gensupport.NewField[int64](widenedDeclaration, "count")},
}

Functions

func DecryptMember 

func DecryptMember(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedMember) ([]testmember.Member, error)

DecryptMember opens each EncryptedMember, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

Types

type Account 

type Account struct {
	ID        uint         `stash:"id,passthrough"`
	CreatedAt time.Time    `stash:"created_at,passthrough"`
	DeletedAt sql.NullTime `stash:"deleted_at,passthrough"`
	Email     string       `stash:"email,encrypt,index=equality"`
	// contains filtered or unexported fields
}

Account is the shape of the plan's accounts example: passthrough fields (a time.Time, a driver.Valuer) kept on the host and returned as they are.

func DecryptAccount 

func DecryptAccount(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedAccount) ([]Account, error)

DecryptAccount opens each EncryptedAccount, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type AccountEmailField 

type AccountEmailField struct {
	// contains filtered or unexported fields
}

func (AccountEmailField) Encrypt 

func (f AccountEmailField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (EncryptedAccountEmail, error)

func (AccountEmailField) Eq 

func (f AccountEmailField) Eq(ctx context.Context, c *encrypt.Cipher, v string) (encrypt.EqualityTerm, error)

type AgeField 

type AgeField struct {
	// contains filtered or unexported fields
}

func (AgeField) Between 

func (f AgeField) Between(ctx context.Context, c *encrypt.Cipher, lo, hi uint32) (encrypt.Range[encrypt.OreTerm], error)

func (AgeField) Encrypt 

func (f AgeField) Encrypt(ctx context.Context, c *encrypt.Cipher, v uint32) (EncryptedUserAge, error)

func (AgeField) Eq 

func (f AgeField) Eq(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.EqualityTerm, error)

func (AgeField) Gt 

func (f AgeField) Gt(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

func (AgeField) Gte 

func (f AgeField) Gte(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

func (AgeField) Lt 

func (f AgeField) Lt(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

func (AgeField) Lte 

func (f AgeField) Lte(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

type Birthday 

type Birthday struct {
	DOB encrypt.Date `stash:"dob,encrypt_into=Date"`
	// contains filtered or unexported fields
}

Birthday reads Person's dob column into a field that is not a pointer, so a stored null has nowhere to go.

func DecryptBirthday 

func DecryptBirthday(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedBirthday) ([]Birthday, error)

DecryptBirthday opens each EncryptedBirthday, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type BirthdayDOBField 

type BirthdayDOBField struct {
	// contains filtered or unexported fields
}

func (BirthdayDOBField) Encrypt 

func (f BirthdayDOBField) Encrypt(ctx context.Context, c *encrypt.Cipher, v encrypt.Date) (eql.Date, error)

type Blob 

type Blob []byte

Defined types over scalars: the engine returns the underlying type and the generated code converts.

type Contact 

type Contact struct {
	ID    int64  `stash:"id,passthrough"`
	Email string `stash:"email,encrypt_into=TextEq"`
	Notes string `stash:"notes,encrypt"`
	// contains filtered or unexported fields
}

Contact is one row with an email stored as an EQL value, the shape the cross-language fixture packages/eql/tests/encryption/fixtures/text_eq_query.json is derived under (table users, column email). Its generated file imports encrypt/eql, so the encrypt test binary links the guest build with the EQL types; the tests that want the build without them load it by name.

func DecryptContact 

func DecryptContact(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedContact) ([]Contact, error)

DecryptContact opens each EncryptedContact, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type ContactEmailField 

type ContactEmailField struct {
	// contains filtered or unexported fields
}

func (ContactEmailField) Encrypt 

func (f ContactEmailField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextEq, error)

func (ContactEmailField) Eq 

func (f ContactEmailField) Eq(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextEqQuery, error)

type ContactNotesField 

type ContactNotesField struct {
	// contains filtered or unexported fields
}

func (ContactNotesField) Encrypt 

func (f ContactNotesField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (EncryptedContactNotes, error)

type CustomAddress 

type CustomAddress struct {
	Postcode *string `json:"postcode"`
}

CustomAddress is an entity's address. A nil Postcode is JSON null.

type CustomFieldExtra 

type CustomFieldExtra struct {
	Country            string             `json:"country,omitempty"`
	PreferredLanguages []string           `json:"preferred_languages,omitempty"`
	EmergencyContacts  []EmergencyContact `json:"emergency_contacts"`
}

CustomFieldExtra holds an entity's country, preferred languages and emergency contacts.

type CustomFieldValues 

type CustomFieldValues struct {
	Score   *float64         `json:"score,omitempty"`
	Weight  *float64         `json:"weight,omitempty"`
	Address *CustomAddress   `json:"address,omitempty"`
	Extra   CustomFieldExtra `json:"extra"`
}

CustomFieldValues is an entity's custom field values document. Every member but Extra is left out of the document when it is nil, so a document holds only the values an entity has.

type Customer 

type Customer struct {
	ID      int64            `stash:"id,passthrough"`
	Profile json.RawMessage  `stash:"profile,encrypt_into=JsonSearch(ordered=$.age;$.visits[*].at)"`
	Prefs   *json.RawMessage `stash:"prefs,encrypt_into=JsonSearch,null=sql"`
	// contains filtered or unexported fields
}

Customer holds two encrypted JSON documents (the EQL type JsonSearch, stored in public.eql_v4_json_search): a profile whose $.age and every visit's $.at order, and optional preferences, stored as SQL NULL when nil.

func DecryptCustomer 

func DecryptCustomer(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedCustomer) ([]Customer, error)

DecryptCustomer opens each EncryptedCustomer, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type CustomerPrefsField 

type CustomerPrefsField struct {
	// contains filtered or unexported fields
}

CustomerPrefsField provides document queries and reads for the Prefs field.

func (CustomerPrefsField) ChildCount 

func (f CustomerPrefsField) ChildCount(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONToken, error)

ChildCount derives the token of the node at path, which eql_v4.json_tree_child_count(col, $1::text) takes: zero for a scalar or an empty container, NULL where the row has no node there or for the sealed root.

func (CustomerPrefsField) Children 

func (f CustomerPrefsField) Children(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONToken, error)

Children derives the token of the node at path, a path with no wildcard, which eql_v4.json_tree_children(col, $1::text) takes. Its rows are encrypted entries one level down.

func (CustomerPrefsField) ContainedBy 

func (f CustomerPrefsField) ContainedBy(ctx context.Context, c *encrypt.Cipher, needle any) (eql.JSONSearchQuery, error)

ContainedBy derives the query for documents contained by needle: col <@ query. needle is a json.RawMessage of JSON text, or a map, struct or slice that encoding/json writes (not a Go string or a pointer to one, nor a needle that writes JSON null); here a zero-valued field widens the query, admitting documents that hold that zero.

func (CustomerPrefsField) Contains 

func (f CustomerPrefsField) Contains(ctx context.Context, c *encrypt.Cipher, needle any) (eql.JSONSearchQuery, error)

Contains derives the query for documents that contain needle: col @> query. needle is a json.RawMessage of JSON text, or a map, struct or slice that encoding/json writes; a Go string or a pointer to one is refused, as one JSON string is not JSON text, and so is a needle that writes JSON null (nil, or a nil pointer, map or slice). Each member it writes must be in the document, so a zero-valued struct field narrows the query to documents holding that zero: give a needle struct pointer fields, or omitempty, or use a map. Each array element of the needle must sit inside one element of the document's array.

func (CustomerPrefsField) Encrypt 

func (f CustomerPrefsField) Encrypt(ctx context.Context, c *encrypt.Cipher, v json.RawMessage) (eql.JSONSearch, error)

Encrypt seals one Prefs document for an update of its stored column.

func (CustomerPrefsField) EqAt 

func (f CustomerPrefsField) EqAt(ctx context.Context, c *encrypt.Cipher, path string, v any) (eql.JSONSearchQuery, error)

EqAt derives the query for documents holding the scalar v at path: col @> query. v is a Go string, number or bool, nil for JSON null, or a json.RawMessage of JSON text; a Go string is the JSON string it holds, never parsed as JSON. A wildcard step matches when any element holds it; a position ([2]) is refused, since the stored selector reads every position as the wildcard.

func (CustomerPrefsField) Match 

func (f CustomerPrefsField) Match(ctx context.Context, c *encrypt.Cipher, predicate string, vars any, opts encrypt.JSONReadOptions) (eql.JSONSearchPredicateQuery, error)

Match derives the operand for a jsonpath predicate over the document, as plaintext jsonb_path_match(col, predicate, vars) takes one: bind it as col @@ $1::eql_v4.query_json_predicate, or eql_v4.json_tree_match(col, $1::eql_v4.query_json_predicate). vars are the predicate's variables ($name): a map, a struct or a json.RawMessage that writes a JSON object, and an empty map when there are none. A nil vars is SQL NULL, as pgx and database/sql bind it over plaintext: the operand is empty, binds as NULL, and matches no row, as jsonb_path_match does with NULL vars.

The engine reads the predicate, and nothing in Go does: paths of .key, ."quoted key" and [*] steps; ==, !=, <, <=, > and >= between a path and a variable or a JSON literal; exists(path), and exists(path ? (@.m == $v && @.n > $w)) for several members of one array element; &&, || and !(…). Anything else is refused, before any term is derived, as an *encrypt.Diagnostic wrapping encrypt.ErrEncoding whose Reason, Construct and At name the refusal and the byte offset in predicate where it starts. An ordering at a path the tag does not order, or a member of a filter of more than one condition that it does not order, is refused wrapping encrypt.ErrTerm.

The tree is evaluated inside eql_v4.json_tree_match, which engages no index: every row the scan gives it is opened and tested. The per-operator methods engage the GIN index for @> (EqAt, Contains) and a btree on an ordered path's term (At.<Path>), so a query that needs an index writes those leaves with them, or narrows the rows with one beside Match.

A query returns jsonb_path_match's rows over the plaintext, and each row answers as it does, true, false or NULL, save five cases. Lax mode's unwrapping of an array the path names no [*] for is not applied: write [*]. Nor is its wrapping of a value that is not an array under [*]. A string compared with a number is false under == and true under !=, where jsonpath says unknown. Orderings, and filters of more than one condition, compare folded ordering terms: text case- and accent-folded, numbers as float64, so such a filter's == is of folded values; == elsewhere is exact. An ordering of a JSON null is NULL where jsonpath says false, except under an odd number of !, which returns the same rows; there the operand also asks that the node is not null, which tells the database which rows hold null at the path.

A filter of more than one condition reads each array to opts.WildcardBound elements, 64 when it is 0. A row whose array is longer fails the query with SQLSTATE 22023 (invalid_parameter_value) rather than answer over part of it: raise the bound past the longest array.

func (CustomerPrefsField) Selector 

func (f CustomerPrefsField) Selector(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONSelection[eql.JSONEntry], error)

Selector prepares `->` at path: bind Selector() as col -> $1::text, and open the entries it returns with Open; encrypt.DecodeJSON reads each value into a Go type. A position ([2]) is refused; read one with Subtree.

func (CustomerPrefsField) Subtree 

func (f CustomerPrefsField) Subtree(ctx context.Context, c *encrypt.Cipher, path string, opts encrypt.JSONReadOptions) (encrypt.JSONRead[eql.JSONEntry], error)

Subtree prepares a read of the value at path: bind Tokens() as eql_v4.json_tree_subtree(col, $1::text[], budget), and open the rows it returns with Open or OpenOne; encrypt.DecodeJSON reads each value into a Go type.

type CustomerProfileField 

type CustomerProfileField struct {

	// At has one accessor per path the field orders, whose methods
	// are the orderings there.
	At CustomerProfileFieldAt
	// Elements has one accessor per array whose elements have ordered
	// members, whose Match tests the members of one element together.
	Elements CustomerProfileFieldElements
	// contains filtered or unexported fields
}

CustomerProfileField provides document queries and reads for the Profile field.

func (CustomerProfileField) ChildCount 

func (f CustomerProfileField) ChildCount(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONToken, error)

ChildCount derives the token of the node at path, which eql_v4.json_tree_child_count(col, $1::text) takes: zero for a scalar or an empty container, NULL where the row has no node there or for the sealed root.

func (CustomerProfileField) Children 

func (f CustomerProfileField) Children(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONToken, error)

Children derives the token of the node at path, a path with no wildcard, which eql_v4.json_tree_children(col, $1::text) takes. Its rows are encrypted entries one level down.

func (CustomerProfileField) ContainedBy 

func (f CustomerProfileField) ContainedBy(ctx context.Context, c *encrypt.Cipher, needle any) (eql.JSONSearchQuery, error)

ContainedBy derives the query for documents contained by needle: col <@ query. needle is a json.RawMessage of JSON text, or a map, struct or slice that encoding/json writes (not a Go string or a pointer to one, nor a needle that writes JSON null); here a zero-valued field widens the query, admitting documents that hold that zero.

func (CustomerProfileField) Contains 

func (f CustomerProfileField) Contains(ctx context.Context, c *encrypt.Cipher, needle any) (eql.JSONSearchQuery, error)

Contains derives the query for documents that contain needle: col @> query. needle is a json.RawMessage of JSON text, or a map, struct or slice that encoding/json writes; a Go string or a pointer to one is refused, as one JSON string is not JSON text, and so is a needle that writes JSON null (nil, or a nil pointer, map or slice). Each member it writes must be in the document, so a zero-valued struct field narrows the query to documents holding that zero: give a needle struct pointer fields, or omitempty, or use a map. Each array element of the needle must sit inside one element of the document's array.

func (CustomerProfileField) Encrypt 

func (f CustomerProfileField) Encrypt(ctx context.Context, c *encrypt.Cipher, v json.RawMessage) (eql.JSONSearch, error)

Encrypt seals one Profile document for an update of its stored column.

func (CustomerProfileField) EqAt 

func (f CustomerProfileField) EqAt(ctx context.Context, c *encrypt.Cipher, path string, v any) (eql.JSONSearchQuery, error)

EqAt derives the query for documents holding the scalar v at path: col @> query. v is a Go string, number or bool, nil for JSON null, or a json.RawMessage of JSON text; a Go string is the JSON string it holds, never parsed as JSON. A wildcard step matches when any element holds it; a position ([2]) is refused, since the stored selector reads every position as the wildcard.

func (CustomerProfileField) Match 

func (f CustomerProfileField) Match(ctx context.Context, c *encrypt.Cipher, predicate string, vars any, opts encrypt.JSONReadOptions) (eql.JSONSearchPredicateQuery, error)

Match derives the operand for a jsonpath predicate over the document, as plaintext jsonb_path_match(col, predicate, vars) takes one: bind it as col @@ $1::eql_v4.query_json_predicate, or eql_v4.json_tree_match(col, $1::eql_v4.query_json_predicate). vars are the predicate's variables ($name): a map, a struct or a json.RawMessage that writes a JSON object, and an empty map when there are none. A nil vars is SQL NULL, as pgx and database/sql bind it over plaintext: the operand is empty, binds as NULL, and matches no row, as jsonb_path_match does with NULL vars.

The engine reads the predicate, and nothing in Go does: paths of .key, ."quoted key" and [*] steps; ==, !=, <, <=, > and >= between a path and a variable or a JSON literal; exists(path), and exists(path ? (@.m == $v && @.n > $w)) for several members of one array element; &&, || and !(…). Anything else is refused, before any term is derived, as an *encrypt.Diagnostic wrapping encrypt.ErrEncoding whose Reason, Construct and At name the refusal and the byte offset in predicate where it starts. An ordering at a path the tag does not order, or a member of a filter of more than one condition that it does not order, is refused wrapping encrypt.ErrTerm.

The tree is evaluated inside eql_v4.json_tree_match, which engages no index: every row the scan gives it is opened and tested. The per-operator methods engage the GIN index for @> (EqAt, Contains) and a btree on an ordered path's term (At.<Path>), so a query that needs an index writes those leaves with them, or narrows the rows with one beside Match.

A query returns jsonb_path_match's rows over the plaintext, and each row answers as it does, true, false or NULL, save five cases. Lax mode's unwrapping of an array the path names no [*] for is not applied: write [*]. Nor is its wrapping of a value that is not an array under [*]. A string compared with a number is false under == and true under !=, where jsonpath says unknown. Orderings, and filters of more than one condition, compare folded ordering terms: text case- and accent-folded, numbers as float64, so such a filter's == is of folded values; == elsewhere is exact. An ordering of a JSON null is NULL where jsonpath says false, except under an odd number of !, which returns the same rows; there the operand also asks that the node is not null, which tells the database which rows hold null at the path.

A filter of more than one condition reads each array to opts.WildcardBound elements, 64 when it is 0. A row whose array is longer fails the query with SQLSTATE 22023 (invalid_parameter_value) rather than answer over part of it: raise the bound past the longest array.

func (CustomerProfileField) Selector 

func (f CustomerProfileField) Selector(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONSelection[eql.JSONEntry], error)

Selector prepares `->` at path: bind Selector() as col -> $1::text, and open the entries it returns with Open; encrypt.DecodeJSON reads each value into a Go type. A position ([2]) is refused; read one with Subtree.

func (CustomerProfileField) Subtree 

func (f CustomerProfileField) Subtree(ctx context.Context, c *encrypt.Cipher, path string, opts encrypt.JSONReadOptions) (encrypt.JSONRead[eql.JSONEntry], error)

Subtree prepares a read of the value at path: bind Tokens() as eql_v4.json_tree_subtree(col, $1::text[], budget), and open the rows it returns with Open or OpenOne; encrypt.DecodeJSON reads each value into a Go type.

type CustomerProfileFieldArray 

type CustomerProfileFieldArray[E any] struct {
	// contains filtered or unexported fields
}

CustomerProfileFieldArray is one array of Profile whose elements have ordered members. E is the array's own type, which the predicates its Match takes carry.

func (CustomerProfileFieldArray[E]) Match 

func (a CustomerProfileFieldArray[E]) Match(ctx context.Context, c *encrypt.Cipher, opts encrypt.JSONReadOptions, predicates ...encrypt.ElementPredicate[E]) (eql.JSONSearchElementsQuery, error)

Match derives the operand that finds a row where one element of this array passes every predicate: eql_v4.json_tree_element_match(col, $1::eql_v4.query_json_elements). An EqAt and an ordering at the array's paths can each be answered by a different element; Match is answered by one. Make each predicate with encrypt.AtPath and a member of this array under CustomerPaths, so a member of another array, or a value of another type, does not compile; or with Member, for a member named at run time. No predicates, and a zero ElementPredicate, are refused before the engine is asked.

Each comparison is of the member's ordering term, so Eq is an equality of folded values: text compares case- and accent-folded ("sibling" equals "Sibling"), and integers past 2^53 can tie. EqAt at a member's full path is exact, of any element.

The operand reads each array to opts.WildcardBound elements, 64 when it is 0. A row whose array is longer fails the query with SQLSTATE 22023 (invalid_parameter_value) rather than answer over part of it: raise the bound past the longest array. The function filters the rows a scan gives it, so narrow them with an indexed predicate first, such as @> on the same values.

func (CustomerProfileFieldArray[E]) Member 

func (a CustomerProfileFieldArray[E]) Member(member string) encrypt.MemberTest[E, any]

Member is the comparisons of the member of this array's elements that member names, for a filter whose members are known only at run time: relationship, or address.city, written as the member is written below the array in the field's ordered paths. Its values are not checked by the compiler, and Match refuses a member the field does not order beneath this array, naming it, the array and the members the field orders there, before the engine is asked. Where the member is known when the program is written, use encrypt.AtPath and CustomerPaths.

type CustomerProfileFieldAt 

type CustomerProfileFieldAt struct {
	Age      CustomerProfileFieldPath // $.age
	VisitsAt CustomerProfileFieldPath // $.visits[*].at
}

CustomerProfileFieldAt names the declared ordered paths of Profile. Use an accessor's Selector with its ordering query.

type CustomerProfileFieldElements 

type CustomerProfileFieldElements struct {
	Visits CustomerProfileFieldArray[CustomerProfileFieldElementsVisits] // $.visits[*]: at
}

CustomerProfileFieldElements names the arrays of Profile whose elements have ordered members. Each accessor's Match tests the members of one element together.

type CustomerProfileFieldElementsVisits 

type CustomerProfileFieldElementsVisits struct{}

CustomerProfileFieldElementsVisits is the array $.visits[*] of Profile, as a type: Elements.Visits.Match takes an encrypt.ElementPredicate[CustomerProfileFieldElementsVisits], which encrypt.AtPath makes from a member under CustomerPaths.Profile.Visits.

type CustomerProfileFieldPath 

type CustomerProfileFieldPath struct {
	// contains filtered or unexported fields
}

CustomerProfileFieldPath is one ordered path of Profile. Its orderings derive the leaf operand (eql_v4.query_json_leaf) a stored leaf's ordering term is compared with, and Selector the path's selector. At a path with no array step, compare col -> Selector() with the operand, and order by eql_v4.ord_term(col -> Selector()). At a wildcard path ([*]) col -> Selector() is an unspecified element of each row, so write the comparison over every match, EXISTS (SELECT 1 FROM eql_v4.json_tree_path_query(col, $sel) e WHERE e < $1::eql_v4.query_json_leaf), and order by the least or greatest match's term: (SELECT eql_v4.ord_term(e) FROM eql_v4.json_tree_path_query(col, $sel) e ORDER BY 1 LIMIT 1). Each operand is a Go number or string, or a json.RawMessage of JSON text. Numbers order as float64, so integers past 2^53 can tie; text orders case- and accent-folded.

func (CustomerProfileFieldPath) Between 

func (p CustomerProfileFieldPath) Between(ctx context.Context, c *encrypt.Cipher, lo, hi any) (encrypt.JSONRange[eql.JSONSearchLeafQuery], error)

Between derives the two operands that find a leaf at this path from lo to hi, inclusive: (col -> $sel) >= Low AND (col -> $sel) <= High, or at a wildcard path the same over every match, with both bounds on one element (see CustomerProfileFieldPath).

func (CustomerProfileFieldPath) Gt 

func (p CustomerProfileFieldPath) Gt(ctx context.Context, c *encrypt.Cipher, v any) (eql.JSONSearchLeafQuery, error)

Gt derives the operand that finds a leaf at this path greater than v: (col -> $sel) > $1::eql_v4.query_json_leaf, or at a wildcard path the same comparison over every match (see CustomerProfileFieldPath).

func (CustomerProfileFieldPath) Gte 

func (p CustomerProfileFieldPath) Gte(ctx context.Context, c *encrypt.Cipher, v any) (eql.JSONSearchLeafQuery, error)

Gte derives the operand that finds a leaf at this path at least v: (col -> $sel) >= $1::eql_v4.query_json_leaf, or at a wildcard path the same comparison over every match (see CustomerProfileFieldPath).

func (CustomerProfileFieldPath) Lt 

func (p CustomerProfileFieldPath) Lt(ctx context.Context, c *encrypt.Cipher, v any) (eql.JSONSearchLeafQuery, error)

Lt derives the operand that finds a leaf at this path less than v: (col -> $sel) < $1::eql_v4.query_json_leaf, or at a wildcard path the same comparison over every match (see CustomerProfileFieldPath).

func (CustomerProfileFieldPath) Lte 

func (p CustomerProfileFieldPath) Lte(ctx context.Context, c *encrypt.Cipher, v any) (eql.JSONSearchLeafQuery, error)

Lte derives the operand that finds a leaf at this path at most v: (col -> $sel) <= $1::eql_v4.query_json_leaf, or at a wildcard path the same comparison over every match (see CustomerProfileFieldPath).

func (CustomerProfileFieldPath) Selector 

func (p CustomerProfileFieldPath) Selector(ctx context.Context, c *encrypt.Cipher) (encrypt.JSONSelection[eql.JSONEntry], error)

Selector prepares `->` at this path: bind Selector() beside the ordering's operand, from the same path, as col -> $sel, or at a wildcard path as eql_v4.json_tree_path_query(col, $sel), whose matches are every element.

type Document 

type Document struct {
	Title string
	Body  string
	Tags  []string
	// contains filtered or unexported fields
}

Document is sealed as one value.

func DecryptDocument 

func DecryptDocument(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedDocument) ([]Document, error)

DecryptDocument opens each EncryptedDocument, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type Email 

type Email string

Defined types over scalars: the engine returns the underlying type and the generated code converts.

type EmailField 

type EmailField struct {
	// contains filtered or unexported fields
}

func (EmailField) Encrypt 

func (f EmailField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (EncryptedUserEmail, error)

func (EmailField) Eq 

func (f EmailField) Eq(ctx context.Context, c *encrypt.Cipher, v string) (encrypt.EqualityTerm, error)

func (EmailField) Matches 

func (f EmailField) Matches(ctx context.Context, c *encrypt.Cipher, v string) (encrypt.MatchQuery[string], error)

Matches derives the matches query for v. Its answer can hold rows that do not match: decrypt the rows it fetches and keep those Verify reports true.

type EmergencyContact 

type EmergencyContact struct {
	Name              string `json:"name"`
	Relationship      string `json:"relationship"`
	PreviousCallCount int64  `json:"previous_call_count"`
	Age               int64  `json:"age"`
}

EmergencyContact is one emergency contact of an entity.

type EncryptedAccount 

type EncryptedAccount struct {
	ID        uint
	CreatedAt time.Time
	DeletedAt sql.NullTime
	Email     EncryptedAccountEmail
}

func EncryptAccount 

func EncryptAccount(ctx context.Context, cipher *encrypt.Cipher, values []Account) ([]EncryptedAccount, error)

EncryptAccount seals each Account, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedAccount) LogValue 

func (e EncryptedAccount) LogValue() slog.Value

func (EncryptedAccount) String 

func (e EncryptedAccount) String() string

type EncryptedAccountEmail 

type EncryptedAccountEmail struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
}

type EncryptedBirthday 

type EncryptedBirthday struct {
	DOB eql.Date
}

func EncryptBirthday 

func EncryptBirthday(ctx context.Context, cipher *encrypt.Cipher, values []Birthday) ([]EncryptedBirthday, error)

EncryptBirthday seals each Birthday, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedBirthday) LogValue 

func (e EncryptedBirthday) LogValue() slog.Value

func (EncryptedBirthday) String 

func (e EncryptedBirthday) String() string

type EncryptedContact 

type EncryptedContact struct {
	ID    int64
	Email eql.TextEq
	Notes EncryptedContactNotes
}

func EncryptContact 

func EncryptContact(ctx context.Context, cipher *encrypt.Cipher, values []Contact) ([]EncryptedContact, error)

EncryptContact seals each Contact, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedContact) LogValue 

func (e EncryptedContact) LogValue() slog.Value

func (EncryptedContact) String 

func (e EncryptedContact) String() string

type EncryptedContactNotes 

type EncryptedContactNotes struct {
	Ciphertext encrypt.Ciphertext
}

type EncryptedCustomer 

type EncryptedCustomer struct {
	ID      int64
	Profile eql.JSONSearch
	Prefs   *eql.JSONSearch
}

func EncryptCustomer 

func EncryptCustomer(ctx context.Context, cipher *encrypt.Cipher, values []Customer) ([]EncryptedCustomer, error)

EncryptCustomer seals each Customer, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedCustomer) LogValue 

func (e EncryptedCustomer) LogValue() slog.Value

func (EncryptedCustomer) String 

func (e EncryptedCustomer) String() string

type EncryptedDocument 

type EncryptedDocument struct {
	Sealed encrypt.Ciphertext
}

func EncryptDocument 

func EncryptDocument(ctx context.Context, cipher *encrypt.Cipher, values []Document) ([]EncryptedDocument, error)

EncryptDocument seals each Document, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedDocument) LogValue 

func (e EncryptedDocument) LogValue() slog.Value

func (EncryptedDocument) String 

func (e EncryptedDocument) String() string

type EncryptedEntity 

type EncryptedEntity struct {
	ID                int64
	CustomFieldValues eql.JSONSearch
}

func EncryptEntity 

func EncryptEntity(ctx context.Context, cipher *encrypt.Cipher, values []Entity) ([]EncryptedEntity, error)

EncryptEntity seals each Entity, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedEntity) LogValue 

func (e EncryptedEntity) LogValue() slog.Value

func (EncryptedEntity) String 

func (e EncryptedEntity) String() string

type EncryptedEntry 

type EncryptedEntry struct {
	ID   int64
	Name eql.TextSearch
}

func EncryptEntry 

func EncryptEntry(ctx context.Context, cipher *encrypt.Cipher, values []Entry) ([]EncryptedEntry, error)

EncryptEntry seals each Entry, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedEntry) LogValue 

func (e EncryptedEntry) LogValue() slog.Value

func (EncryptedEntry) String 

func (e EncryptedEntry) String() string

type EncryptedEverything 

type EncryptedEverything struct {
	Sealed encrypt.Ciphertext
}

func EncryptEverything 

func EncryptEverything(ctx context.Context, cipher *encrypt.Cipher, values []Everything) ([]EncryptedEverything, error)

EncryptEverything seals each Everything, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedEverything) LogValue 

func (e EncryptedEverything) LogValue() slog.Value

func (EncryptedEverything) String 

func (e EncryptedEverything) String() string

type EncryptedKinds 

type EncryptedKinds struct {
	S   EncryptedKindsS
	E   EncryptedKindsE
	Bo  EncryptedKindsBo
	I8  EncryptedKindsI8
	I16 EncryptedKindsI16
	I32 EncryptedKindsI32
	I   EncryptedKindsI
	I64 EncryptedKindsI64
	U8  EncryptedKindsU8
	U16 EncryptedKindsU16
	U32 EncryptedKindsU32
	U   EncryptedKindsU
	U64 EncryptedKindsU64
	F32 EncryptedKindsF32
	F64 EncryptedKindsF64
	By  EncryptedKindsBy
	Bl  EncryptedKindsBl
	Sc  EncryptedKindsSc
	St  EncryptedKindsSt
	D   EncryptedKindsD
	P   *int
	M   map[string]string
	T   time.Time
	N   sql.NullTime
	In  Inner
	Sk  []Inner
	A   any
	Er  error
}

func EncryptKinds 

func EncryptKinds(ctx context.Context, cipher *encrypt.Cipher, values []Kinds) ([]EncryptedKinds, error)

EncryptKinds seals each Kinds, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedKinds) LogValue 

func (e EncryptedKinds) LogValue() slog.Value

func (EncryptedKinds) String 

func (e EncryptedKinds) String() string

type EncryptedKindsBl 

type EncryptedKindsBl struct {
	Ciphertext encrypt.Ciphertext
}

type EncryptedKindsBo 

type EncryptedKindsBo struct {
	Ciphertext encrypt.Ciphertext
}

type EncryptedKindsBy 

type EncryptedKindsBy struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
}

type EncryptedKindsD 

type EncryptedKindsD struct {
	Ciphertext encrypt.Ciphertext
	Ore        encrypt.OreTerm
}

type EncryptedKindsE 

type EncryptedKindsE struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
	Match      encrypt.MatchTerm
	Ore        encrypt.OreTerm
}

type EncryptedKindsF32 

type EncryptedKindsF32 struct {
	Ciphertext encrypt.Ciphertext
}

type EncryptedKindsF64 

type EncryptedKindsF64 struct {
	Ciphertext encrypt.Ciphertext
	Ore        encrypt.OreTerm
}

type EncryptedKindsI 

type EncryptedKindsI struct {
	Ciphertext encrypt.Ciphertext
	Ore        encrypt.OreTerm
}

type EncryptedKindsI8 

type EncryptedKindsI8 struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
}

type EncryptedKindsI16 

type EncryptedKindsI16 struct {
	Ciphertext encrypt.Ciphertext
	Ope        encrypt.OpeTerm
}

type EncryptedKindsI32 

type EncryptedKindsI32 struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
}

type EncryptedKindsI64 

type EncryptedKindsI64 struct {
	Ciphertext encrypt.Ciphertext
}

type EncryptedKindsS 

type EncryptedKindsS struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
	Match      encrypt.MatchTerm
}

type EncryptedKindsSc 

type EncryptedKindsSc struct {
	Ciphertext encrypt.Ciphertext
	Ore        encrypt.OreTerm
}

type EncryptedKindsSt 

type EncryptedKindsSt struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
}

type EncryptedKindsU 

type EncryptedKindsU struct {
	Ciphertext encrypt.Ciphertext
}

type EncryptedKindsU8 

type EncryptedKindsU8 struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
}

type EncryptedKindsU16 

type EncryptedKindsU16 struct {
	Ciphertext encrypt.Ciphertext
}

type EncryptedKindsU32 

type EncryptedKindsU32 struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
	Ore        encrypt.OreTerm
}

type EncryptedKindsU64 

type EncryptedKindsU64 struct {
	Ciphertext encrypt.Ciphertext
	Ope        encrypt.OpeTerm
}

type EncryptedLedger 

type EncryptedLedger struct {
	ID      int64
	Opened  eql.Date
	Due     eql.DateEq
	Created eql.Timestamp
	Posted  eql.TimestampEq
	Total   eql.Numeric
	Amount  eql.NumericEq
}

func EncryptLedger 

func EncryptLedger(ctx context.Context, cipher *encrypt.Cipher, values []Ledger) ([]EncryptedLedger, error)

EncryptLedger seals each Ledger, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedLedger) LogValue 

func (e EncryptedLedger) LogValue() slog.Value

func (EncryptedLedger) String 

func (e EncryptedLedger) String() string

type EncryptedLookup 

type EncryptedLookup struct {
	ID    int64
	Email EncryptedLookupEmail
	Score EncryptedLookupScore
	Code  EncryptedLookupCode
}

func EncryptLookup 

func EncryptLookup(ctx context.Context, cipher *encrypt.Cipher, values []Lookup) ([]EncryptedLookup, error)

EncryptLookup seals each Lookup, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedLookup) LogValue 

func (e EncryptedLookup) LogValue() slog.Value

func (EncryptedLookup) String 

func (e EncryptedLookup) String() string

type EncryptedLookupCode 

type EncryptedLookupCode struct {
	Equality encrypt.EqualityTerm
}

type EncryptedLookupEmail 

type EncryptedLookupEmail struct {
	Ciphertext encrypt.Ciphertext
}

type EncryptedLookupScore 

type EncryptedLookupScore struct {
	Ore encrypt.OreTerm
}

type EncryptedMember 

type EncryptedMember struct {
	ID    int64
	Age   EncryptedMemberAge
	Email EncryptedMemberEmail
	Notes EncryptedMemberNotes
}

func EncryptMember 

func EncryptMember(ctx context.Context, cipher *encrypt.Cipher, values []testmember.Member) ([]EncryptedMember, error)

EncryptMember seals each testmember.Member, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedMember) LogValue 

func (e EncryptedMember) LogValue() slog.Value

func (EncryptedMember) String 

func (e EncryptedMember) String() string

type EncryptedMemberAge 

type EncryptedMemberAge struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
	Ore        encrypt.OreTerm
}

type EncryptedMemberEmail 

type EncryptedMemberEmail struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
	Match      encrypt.MatchTerm
}

type EncryptedMemberNotes 

type EncryptedMemberNotes struct {
	Ciphertext encrypt.Ciphertext
}

type EncryptedNote 

type EncryptedNote struct {
	Tenant string
	Text   EncryptedNoteText
	ID     uint32
}

func EncryptNote 

func EncryptNote(ctx context.Context, cipher *encrypt.Cipher, values []Note) ([]EncryptedNote, error)

EncryptNote seals each Note, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedNote) LogValue 

func (e EncryptedNote) LogValue() slog.Value

func (EncryptedNote) String 

func (e EncryptedNote) String() string

type EncryptedNoteText 

type EncryptedNoteText struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
}

type EncryptedPerson 

type EncryptedPerson struct {
	ID     int64
	DOB    eql.Date
	Born   eql.DateEq
	Joined *eql.DateEq
	Age    EncryptedPersonAge
	Score  *EncryptedPersonScore
	Nick   *EncryptedPersonNick
}

func EncryptPerson 

func EncryptPerson(ctx context.Context, cipher *encrypt.Cipher, values []Person) ([]EncryptedPerson, error)

EncryptPerson seals each Person, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedPerson) LogValue 

func (e EncryptedPerson) LogValue() slog.Value

func (EncryptedPerson) String 

func (e EncryptedPerson) String() string

type EncryptedPersonAge 

type EncryptedPersonAge struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
}

type EncryptedPersonNick 

type EncryptedPersonNick struct {
	Ciphertext encrypt.Ciphertext
}

type EncryptedPersonScore 

type EncryptedPersonScore struct {
	Ciphertext encrypt.Ciphertext
	Ore        encrypt.OreTerm
}

type EncryptedProbe 

type EncryptedProbe struct {
	U32 EncryptedProbeU32
	U64 EncryptedProbeU64
	I64 EncryptedProbeI64
	S   EncryptedProbeS
	B   EncryptedProbeB
	F64 EncryptedProbeF64
	F32 EncryptedProbeF32
}

func EncryptProbe 

func EncryptProbe(ctx context.Context, cipher *encrypt.Cipher, values []Probe) ([]EncryptedProbe, error)

EncryptProbe seals each Probe, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedProbe) LogValue 

func (e EncryptedProbe) LogValue() slog.Value

func (EncryptedProbe) String 

func (e EncryptedProbe) String() string

type EncryptedProbeB 

type EncryptedProbeB struct {
	Ciphertext encrypt.Ciphertext
	Ore        encrypt.OreTerm
	Ope        encrypt.OpeTerm
}

type EncryptedProbeF32 

type EncryptedProbeF32 struct {
	Ciphertext encrypt.Ciphertext
	Ore        encrypt.OreTerm
	Ope        encrypt.OpeTerm
}

type EncryptedProbeF64 

type EncryptedProbeF64 struct {
	Ciphertext encrypt.Ciphertext
	Ore        encrypt.OreTerm
	Ope        encrypt.OpeTerm
}

type EncryptedProbeI64 

type EncryptedProbeI64 struct {
	Ciphertext encrypt.Ciphertext
	Ore        encrypt.OreTerm
	Ope        encrypt.OpeTerm
}

type EncryptedProbeS 

type EncryptedProbeS struct {
	Ciphertext encrypt.Ciphertext
	Ore        encrypt.OreTerm
	Ope        encrypt.OpeTerm
}

type EncryptedProbeU32 

type EncryptedProbeU32 struct {
	Ciphertext encrypt.Ciphertext
	Ore        encrypt.OreTerm
	Ope        encrypt.OpeTerm
}

type EncryptedProbeU64 

type EncryptedProbeU64 struct {
	Ciphertext encrypt.Ciphertext
	Ore        encrypt.OreTerm
	Ope        encrypt.OpeTerm
}

type EncryptedProfile 

type EncryptedProfile struct {
	ID      int64
	Visits  eql.Integer
	Balance eql.Bigint
	Active  eql.Boolean
	Ratio   eql.Real
	Score   eql.Double
	Note    eql.Text
	Name    eql.TextMatch
	Age     eql.IntegerEq
	Rank    eql.BigintEq
	Weight  eql.RealEq
	Price   eql.DoubleEq
	Email   eql.TextEq
}

func EncryptProfile 

func EncryptProfile(ctx context.Context, cipher *encrypt.Cipher, values []Profile) ([]EncryptedProfile, error)

EncryptProfile seals each Profile, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedProfile) LogValue 

func (e EncryptedProfile) LogValue() slog.Value

func (EncryptedProfile) String 

func (e EncryptedProfile) String() string

type EncryptedQueryProfile 

type EncryptedQueryProfile struct {
	Email EncryptedQueryProfileEmail
	Age   EncryptedQueryProfileAge
	Name  EncryptedQueryProfileName
	Score EncryptedQueryProfileScore
}

func EncryptQueryProfile 

func EncryptQueryProfile(ctx context.Context, cipher *encrypt.Cipher, values []QueryProfile) ([]EncryptedQueryProfile, error)

EncryptQueryProfile seals each QueryProfile, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedQueryProfile) LogValue 

func (e EncryptedQueryProfile) LogValue() slog.Value

func (EncryptedQueryProfile) String 

func (e EncryptedQueryProfile) String() string

type EncryptedQueryProfileAge 

type EncryptedQueryProfileAge struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
	Ore        encrypt.OreTerm
}

type EncryptedQueryProfileEmail 

type EncryptedQueryProfileEmail struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
}

type EncryptedQueryProfileName 

type EncryptedQueryProfileName struct {
	Ciphertext encrypt.Ciphertext
	Match      encrypt.MatchTerm
}

type EncryptedQueryProfileScore 

type EncryptedQueryProfileScore struct {
	Ciphertext encrypt.Ciphertext
	Ore        encrypt.OreTerm
}

type EncryptedRanking 

type EncryptedRanking struct {
	ID     int64
	Level  eql.IntegerOrd
	Floor  eql.IntegerOrdOpe
	Points eql.BigintOrd
	Total  eql.BigintOrdOpe
	Speed  eql.RealOrd
	Pace   eql.RealOrdOpe
	Score  eql.DoubleOrd
	Mean   eql.DoubleOrdOpe
	Title  eql.TextOrd
	Handle eql.TextOrdOpe
}

func EncryptRanking 

func EncryptRanking(ctx context.Context, cipher *encrypt.Cipher, values []Ranking) ([]EncryptedRanking, error)

EncryptRanking seals each Ranking, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedRanking) LogValue 

func (e EncryptedRanking) LogValue() slog.Value

func (EncryptedRanking) String 

func (e EncryptedRanking) String() string

type EncryptedSecret 

type EncryptedSecret struct {
	ID    int64
	Value EncryptedSecretValue
}

func EncryptSecret 

func EncryptSecret(ctx context.Context, cipher *encrypt.Cipher, values []Secret) ([]EncryptedSecret, error)

EncryptSecret seals each Secret, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedSecret) LogValue 

func (e EncryptedSecret) LogValue() slog.Value

func (EncryptedSecret) String 

func (e EncryptedSecret) String() string

type EncryptedSecretValue 

type EncryptedSecretValue struct {
	Ciphertext encrypt.Ciphertext
}

type EncryptedSubscriber 

type EncryptedSubscriber struct {
	ID      int64
	Profile eql.JSONSearch
	Prefs   *eql.JSONSearch
	Labels  eql.JSONSearch
}

func EncryptSubscriber 

func EncryptSubscriber(ctx context.Context, cipher *encrypt.Cipher, values []Subscriber) ([]EncryptedSubscriber, error)

EncryptSubscriber seals each Subscriber, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedSubscriber) LogValue 

func (e EncryptedSubscriber) LogValue() slog.Value

func (EncryptedSubscriber) String 

func (e EncryptedSubscriber) String() string

type EncryptedTally 

type EncryptedTally struct {
	ID    int64
	Small eql.Smallint
	Count eql.SmallintEq
	Wide  eql.SmallintEq
}

func EncryptTally 

func EncryptTally(ctx context.Context, cipher *encrypt.Cipher, values []Tally) ([]EncryptedTally, error)

EncryptTally seals each Tally, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedTally) LogValue 

func (e EncryptedTally) LogValue() slog.Value

func (EncryptedTally) String 

func (e EncryptedTally) String() string

type EncryptedUser 

type EncryptedUser struct {
	ID    int64
	Age   EncryptedUserAge
	Email EncryptedUserEmail
	Notes EncryptedUserNotes
}

func Encrypt 

func Encrypt(ctx context.Context, cipher *encrypt.Cipher, testusers []User) ([]EncryptedUser, error)

Encrypt seals each User, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedUser) LogValue 

func (e EncryptedUser) LogValue() slog.Value

func (EncryptedUser) String 

func (e EncryptedUser) String() string

type EncryptedUserAge 

type EncryptedUserAge struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
	Ore        encrypt.OreTerm
}

type EncryptedUserEmail 

type EncryptedUserEmail struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
	Match      encrypt.MatchTerm
}

type EncryptedUserNotes 

type EncryptedUserNotes struct {
	Ciphertext encrypt.Ciphertext
}

type EncryptedValueKinds 

type EncryptedValueKinds struct {
	I8     EncryptedValueKindsI8
	I16    EncryptedValueKindsI16
	U8     EncryptedValueKindsU8
	U16    EncryptedValueKindsU16
	I128   EncryptedValueKindsI128
	U128   EncryptedValueKindsU128
	Date   EncryptedValueKindsDate
	At     EncryptedValueKindsAt
	Amount EncryptedValueKindsAmount
}

func EncryptValueKinds 

func EncryptValueKinds(ctx context.Context, cipher *encrypt.Cipher, values []ValueKinds) ([]EncryptedValueKinds, error)

EncryptValueKinds seals each ValueKinds, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedValueKinds) LogValue 

func (e EncryptedValueKinds) LogValue() slog.Value

func (EncryptedValueKinds) String 

func (e EncryptedValueKinds) String() string

type EncryptedValueKindsAmount 

type EncryptedValueKindsAmount struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
	Ore        encrypt.OreTerm
}

type EncryptedValueKindsAt 

type EncryptedValueKindsAt struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
	Ope        encrypt.OpeTerm
}

type EncryptedValueKindsDate 

type EncryptedValueKindsDate struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
	Ore        encrypt.OreTerm
}

type EncryptedValueKindsI8 

type EncryptedValueKindsI8 struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
}

type EncryptedValueKindsI16 

type EncryptedValueKindsI16 struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
	Ore        encrypt.OreTerm
}

type EncryptedValueKindsI128 

type EncryptedValueKindsI128 struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
	Ore        encrypt.OreTerm
}

type EncryptedValueKindsU8 

type EncryptedValueKindsU8 struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
}

type EncryptedValueKindsU16 

type EncryptedValueKindsU16 struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
	Ope        encrypt.OpeTerm
}

type EncryptedValueKindsU128 

type EncryptedValueKindsU128 struct {
	Ciphertext encrypt.Ciphertext
	Equality   encrypt.EqualityTerm
	Ope        encrypt.OpeTerm
}

type EncryptedWidened 

type EncryptedWidened struct {
	Visits  eql.Integer
	Balance eql.Bigint
	Age     eql.IntegerEq
	Rank    eql.BigintEq
	Count   eql.IntegerEq
}

func EncryptWidened 

func EncryptWidened(ctx context.Context, cipher *encrypt.Cipher, values []Widened) ([]EncryptedWidened, error)

EncryptWidened seals each Widened, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used. The result has one element for each input, in the same order.

func (EncryptedWidened) LogValue 

func (e EncryptedWidened) LogValue() slog.Value

func (EncryptedWidened) String 

func (e EncryptedWidened) String() string

type Entity 

type Entity struct {
	ID                int64             `stash:"id,passthrough"`
	CustomFieldValues CustomFieldValues `` /* 196-byte string literal not displayed */
	// contains filtered or unexported fields
}

Entity holds its custom field values as an encrypted JSON document (the EQL type JsonSearch). Its weight orders, and so does each emergency contact's relationship, call count and age, so the generated EntityFields.CustomFieldValues has At.Weight and Elements.ExtraEmergencyContacts, whose Match tests a contact's members together. A contact's name is not ordered.

func DecryptEntity 

func DecryptEntity(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedEntity) ([]Entity, error)

DecryptEntity opens each EncryptedEntity, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type EntityCustomFieldValuesField 

type EntityCustomFieldValuesField struct {

	// At has one accessor per path the field orders, whose methods
	// are the orderings there.
	At EntityCustomFieldValuesFieldAt
	// Elements has one accessor per array whose elements have ordered
	// members, whose Match tests the members of one element together.
	Elements EntityCustomFieldValuesFieldElements
	// contains filtered or unexported fields
}

EntityCustomFieldValuesField provides document queries and reads for the CustomFieldValues field.

func (EntityCustomFieldValuesField) ChildCount 

func (f EntityCustomFieldValuesField) ChildCount(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONToken, error)

ChildCount derives the token of the node at path, which eql_v4.json_tree_child_count(col, $1::text) takes: zero for a scalar or an empty container, NULL where the row has no node there or for the sealed root.

func (EntityCustomFieldValuesField) Children 

func (f EntityCustomFieldValuesField) Children(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONToken, error)

Children derives the token of the node at path, a path with no wildcard, which eql_v4.json_tree_children(col, $1::text) takes. Its rows are encrypted entries one level down.

func (EntityCustomFieldValuesField) ContainedBy 

func (f EntityCustomFieldValuesField) ContainedBy(ctx context.Context, c *encrypt.Cipher, needle any) (eql.JSONSearchQuery, error)

ContainedBy derives the query for documents contained by needle: col <@ query. needle is a json.RawMessage of JSON text, or a map, struct or slice that encoding/json writes (not a Go string or a pointer to one, nor a needle that writes JSON null); here a zero-valued field widens the query, admitting documents that hold that zero.

func (EntityCustomFieldValuesField) Contains 

func (f EntityCustomFieldValuesField) Contains(ctx context.Context, c *encrypt.Cipher, needle any) (eql.JSONSearchQuery, error)

Contains derives the query for documents that contain needle: col @> query. needle is a json.RawMessage of JSON text, or a map, struct or slice that encoding/json writes; a Go string or a pointer to one is refused, as one JSON string is not JSON text, and so is a needle that writes JSON null (nil, or a nil pointer, map or slice). Each member it writes must be in the document, so a zero-valued struct field narrows the query to documents holding that zero: give a needle struct pointer fields, or omitempty, or use a map. Each array element of the needle must sit inside one element of the document's array. A needle of the field's own type, CustomFieldValues, is refused for that reason, and so is a pointer to it: write a needle type whose fields are pointers with omitempty, or use a map.

func (EntityCustomFieldValuesField) Encrypt 

func (f EntityCustomFieldValuesField) Encrypt(ctx context.Context, c *encrypt.Cipher, v CustomFieldValues) (eql.JSONSearch, error)

Encrypt seals one CustomFieldValues document for an update of its stored column.

func (EntityCustomFieldValuesField) EqAt 

func (f EntityCustomFieldValuesField) EqAt(ctx context.Context, c *encrypt.Cipher, path string, v any) (eql.JSONSearchQuery, error)

EqAt derives the query for documents holding the scalar v at path: col @> query. v is a Go string, number or bool, nil for JSON null, or a json.RawMessage of JSON text; a Go string is the JSON string it holds, never parsed as JSON. A wildcard step matches when any element holds it; a position ([2]) is refused, since the stored selector reads every position as the wildcard.

func (EntityCustomFieldValuesField) Match 

func (f EntityCustomFieldValuesField) Match(ctx context.Context, c *encrypt.Cipher, predicate string, vars any, opts encrypt.JSONReadOptions) (eql.JSONSearchPredicateQuery, error)

Match derives the operand for a jsonpath predicate over the document, as plaintext jsonb_path_match(col, predicate, vars) takes one: bind it as col @@ $1::eql_v4.query_json_predicate, or eql_v4.json_tree_match(col, $1::eql_v4.query_json_predicate). vars are the predicate's variables ($name): a map, a struct or a json.RawMessage that writes a JSON object, and an empty map when there are none. A nil vars is SQL NULL, as pgx and database/sql bind it over plaintext: the operand is empty, binds as NULL, and matches no row, as jsonb_path_match does with NULL vars.

The engine reads the predicate, and nothing in Go does: paths of .key, ."quoted key" and [*] steps; ==, !=, <, <=, > and >= between a path and a variable or a JSON literal; exists(path), and exists(path ? (@.m == $v && @.n > $w)) for several members of one array element; &&, || and !(…). Anything else is refused, before any term is derived, as an *encrypt.Diagnostic wrapping encrypt.ErrEncoding whose Reason, Construct and At name the refusal and the byte offset in predicate where it starts. An ordering at a path the tag does not order, or a member of a filter of more than one condition that it does not order, is refused wrapping encrypt.ErrTerm.

The tree is evaluated inside eql_v4.json_tree_match, which engages no index: every row the scan gives it is opened and tested. The per-operator methods engage the GIN index for @> (EqAt, Contains) and a btree on an ordered path's term (At.<Path>), so a query that needs an index writes those leaves with them, or narrows the rows with one beside Match.

A query returns jsonb_path_match's rows over the plaintext, and each row answers as it does, true, false or NULL, save five cases. Lax mode's unwrapping of an array the path names no [*] for is not applied: write [*]. Nor is its wrapping of a value that is not an array under [*]. A string compared with a number is false under == and true under !=, where jsonpath says unknown. Orderings, and filters of more than one condition, compare folded ordering terms: text case- and accent-folded, numbers as float64, so such a filter's == is of folded values; == elsewhere is exact. An ordering of a JSON null is NULL where jsonpath says false, except under an odd number of !, which returns the same rows; there the operand also asks that the node is not null, which tells the database which rows hold null at the path.

A filter of more than one condition reads each array to opts.WildcardBound elements, 64 when it is 0. A row whose array is longer fails the query with SQLSTATE 22023 (invalid_parameter_value) rather than answer over part of it: raise the bound past the longest array.

func (EntityCustomFieldValuesField) Selector 

func (f EntityCustomFieldValuesField) Selector(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONSelection[eql.JSONEntry], error)

Selector prepares `->` at path: bind Selector() as col -> $1::text, and open the entries it returns with Open; encrypt.DecodeJSON reads each value into a Go type. A position ([2]) is refused; read one with Subtree.

func (EntityCustomFieldValuesField) Subtree 

func (f EntityCustomFieldValuesField) Subtree(ctx context.Context, c *encrypt.Cipher, path string, opts encrypt.JSONReadOptions) (encrypt.JSONRead[eql.JSONEntry], error)

Subtree prepares a read of the value at path: bind Tokens() as eql_v4.json_tree_subtree(col, $1::text[], budget), and open the rows it returns with Open or OpenOne; encrypt.DecodeJSON reads each value into a Go type.

type EntityCustomFieldValuesFieldArray 

type EntityCustomFieldValuesFieldArray[E any] struct {
	// contains filtered or unexported fields
}

EntityCustomFieldValuesFieldArray is one array of CustomFieldValues whose elements have ordered members. E is the array's own type, which the predicates its Match takes carry.

func (EntityCustomFieldValuesFieldArray[E]) Match 

func (a EntityCustomFieldValuesFieldArray[E]) Match(ctx context.Context, c *encrypt.Cipher, opts encrypt.JSONReadOptions, predicates ...encrypt.ElementPredicate[E]) (eql.JSONSearchElementsQuery, error)

Match derives the operand that finds a row where one element of this array passes every predicate: eql_v4.json_tree_element_match(col, $1::eql_v4.query_json_elements). An EqAt and an ordering at the array's paths can each be answered by a different element; Match is answered by one. Make each predicate with encrypt.AtPath and a member of this array under EntityPaths, so a member of another array, or a value of another type, does not compile; or with Member, for a member named at run time. No predicates, and a zero ElementPredicate, are refused before the engine is asked.

Each comparison is of the member's ordering term, so Eq is an equality of folded values: text compares case- and accent-folded ("sibling" equals "Sibling"), and integers past 2^53 can tie. EqAt at a member's full path is exact, of any element.

The operand reads each array to opts.WildcardBound elements, 64 when it is 0. A row whose array is longer fails the query with SQLSTATE 22023 (invalid_parameter_value) rather than answer over part of it: raise the bound past the longest array. The function filters the rows a scan gives it, so narrow them with an indexed predicate first, such as @> on the same values.

func (EntityCustomFieldValuesFieldArray[E]) Member 

func (a EntityCustomFieldValuesFieldArray[E]) Member(member string) encrypt.MemberTest[E, any]

Member is the comparisons of the member of this array's elements that member names, for a filter whose members are known only at run time: relationship, or address.city, written as the member is written below the array in the field's ordered paths. Its values are not checked by the compiler, and Match refuses a member the field does not order beneath this array, naming it, the array and the members the field orders there, before the engine is asked. Where the member is known when the program is written, use encrypt.AtPath and EntityPaths.

type EntityCustomFieldValuesFieldAt 

type EntityCustomFieldValuesFieldAt struct {
	Weight                                  EntityCustomFieldValuesFieldPath // $.weight
	ExtraEmergencyContactsRelationship      EntityCustomFieldValuesFieldPath // $.extra.emergency_contacts[*].relationship
	ExtraEmergencyContactsPreviousCallCount EntityCustomFieldValuesFieldPath // $.extra.emergency_contacts[*].previous_call_count
	ExtraEmergencyContactsAge               EntityCustomFieldValuesFieldPath // $.extra.emergency_contacts[*].age
}

EntityCustomFieldValuesFieldAt names the declared ordered paths of CustomFieldValues. Use an accessor's Selector with its ordering query.

type EntityCustomFieldValuesFieldElements 

type EntityCustomFieldValuesFieldElements struct {
	ExtraEmergencyContacts EntityCustomFieldValuesFieldArray[EntityCustomFieldValuesFieldElementsExtraEmergencyContacts] // $.extra.emergency_contacts[*]: relationship, previous_call_count, age
}

EntityCustomFieldValuesFieldElements names the arrays of CustomFieldValues whose elements have ordered members. Each accessor's Match tests the members of one element together.

type EntityCustomFieldValuesFieldElementsExtraEmergencyContacts 

type EntityCustomFieldValuesFieldElementsExtraEmergencyContacts struct{}

EntityCustomFieldValuesFieldElementsExtraEmergencyContacts is the array $.extra.emergency_contacts[*] of CustomFieldValues, as a type: Elements.ExtraEmergencyContacts.Match takes an encrypt.ElementPredicate[EntityCustomFieldValuesFieldElementsExtraEmergencyContacts], which encrypt.AtPath makes from a member under EntityPaths.CustomFieldValues.Extra.EmergencyContacts.

type EntityCustomFieldValuesFieldPath 

type EntityCustomFieldValuesFieldPath struct {
	// contains filtered or unexported fields
}

EntityCustomFieldValuesFieldPath is one ordered path of CustomFieldValues. Its orderings derive the leaf operand (eql_v4.query_json_leaf) a stored leaf's ordering term is compared with, and Selector the path's selector. At a path with no array step, compare col -> Selector() with the operand, and order by eql_v4.ord_term(col -> Selector()). At a wildcard path ([*]) col -> Selector() is an unspecified element of each row, so write the comparison over every match, EXISTS (SELECT 1 FROM eql_v4.json_tree_path_query(col, $sel) e WHERE e < $1::eql_v4.query_json_leaf), and order by the least or greatest match's term: (SELECT eql_v4.ord_term(e) FROM eql_v4.json_tree_path_query(col, $sel) e ORDER BY 1 LIMIT 1). Each operand is a Go number or string, or a json.RawMessage of JSON text. Numbers order as float64, so integers past 2^53 can tie; text orders case- and accent-folded.

func (EntityCustomFieldValuesFieldPath) Between 

func (p EntityCustomFieldValuesFieldPath) Between(ctx context.Context, c *encrypt.Cipher, lo, hi any) (encrypt.JSONRange[eql.JSONSearchLeafQuery], error)

Between derives the two operands that find a leaf at this path from lo to hi, inclusive: (col -> $sel) >= Low AND (col -> $sel) <= High, or at a wildcard path the same over every match, with both bounds on one element (see EntityCustomFieldValuesFieldPath).

func (EntityCustomFieldValuesFieldPath) Gt 

func (p EntityCustomFieldValuesFieldPath) Gt(ctx context.Context, c *encrypt.Cipher, v any) (eql.JSONSearchLeafQuery, error)

Gt derives the operand that finds a leaf at this path greater than v: (col -> $sel) > $1::eql_v4.query_json_leaf, or at a wildcard path the same comparison over every match (see EntityCustomFieldValuesFieldPath).

func (EntityCustomFieldValuesFieldPath) Gte 

func (p EntityCustomFieldValuesFieldPath) Gte(ctx context.Context, c *encrypt.Cipher, v any) (eql.JSONSearchLeafQuery, error)

Gte derives the operand that finds a leaf at this path at least v: (col -> $sel) >= $1::eql_v4.query_json_leaf, or at a wildcard path the same comparison over every match (see EntityCustomFieldValuesFieldPath).

func (EntityCustomFieldValuesFieldPath) Lt 

func (p EntityCustomFieldValuesFieldPath) Lt(ctx context.Context, c *encrypt.Cipher, v any) (eql.JSONSearchLeafQuery, error)

Lt derives the operand that finds a leaf at this path less than v: (col -> $sel) < $1::eql_v4.query_json_leaf, or at a wildcard path the same comparison over every match (see EntityCustomFieldValuesFieldPath).

func (EntityCustomFieldValuesFieldPath) Lte 

func (p EntityCustomFieldValuesFieldPath) Lte(ctx context.Context, c *encrypt.Cipher, v any) (eql.JSONSearchLeafQuery, error)

Lte derives the operand that finds a leaf at this path at most v: (col -> $sel) <= $1::eql_v4.query_json_leaf, or at a wildcard path the same comparison over every match (see EntityCustomFieldValuesFieldPath).

func (EntityCustomFieldValuesFieldPath) Selector 

func (p EntityCustomFieldValuesFieldPath) Selector(ctx context.Context, c *encrypt.Cipher) (encrypt.JSONSelection[eql.JSONEntry], error)

Selector prepares `->` at this path: bind Selector() beside the ordering's operand, from the same path, as col -> $sel, or at a wildcard path as eql_v4.json_tree_path_query(col, $sel), whose matches are every element.

type Entry 

type Entry struct {
	ID   int64  `stash:"id,passthrough"`
	Name string `stash:"name,encrypt_into=TextSearch"`
	// contains filtered or unexported fields
}

Entry stores a name as EQL v4's TextSearch: one column that answers `=`, the orderings and `@@`. Its query carries only the term its operator reads, so `=` and `<` work on a one-letter name while `@@` on one is refused (ADR-0002, amended 2026-10-19).

func DecryptEntry 

func DecryptEntry(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedEntry) ([]Entry, error)

DecryptEntry opens each EncryptedEntry, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type EntryNameField 

type EntryNameField struct {
	// contains filtered or unexported fields
}

func (EntryNameField) Encrypt 

func (f EntryNameField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextSearch, error)

func (EntryNameField) Eq 

func (f EntryNameField) Eq(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextSearchQuery, error)

func (EntryNameField) Gt 

func (f EntryNameField) Gt(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextSearchQuery, error)

func (EntryNameField) Gte 

func (f EntryNameField) Gte(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextSearchQuery, error)

func (EntryNameField) Lt 

func (f EntryNameField) Lt(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextSearchQuery, error)

func (EntryNameField) Lte 

func (f EntryNameField) Lte(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextSearchQuery, error)

func (EntryNameField) Matches 

func (f EntryNameField) Matches(ctx context.Context, c *encrypt.Cipher, v string) (encrypt.EQLMatchQuery[eql.TextSearchQuery, string], error)

Matches derives the matches query for v. Its answer can hold rows that do not match: decrypt the rows it fetches and keep those Verify reports true.

type Everything 

type Everything struct {
	S      string
	E      Email
	Bo     bool
	I8     int8
	I      int
	U64    uint64
	F32    float32
	F64    float64
	By     []byte
	Bl     Blob
	Sc     Score
	Tags   []string
	Ints   []int
	F32s   []float32
	St     Status
	D      time.Duration
	Emails []Email
	Counts map[string]int
	Labels map[string]string
	ByKey  map[int]string
	In     Inner
	Ins    []Inner
	P      *string
	PI     *Inner
	T      time.Time
	N      sql.NullTime
	Nested [][]byte
	Arr    [2]uint8
	// contains filtered or unexported fields
}

Everything is an opaque struct with a field of every type the storage profile and JSON carry both ways. It crosses as one storage blob and comes back as it was, save that a nil slice or map comes back empty.

func DecryptEverything 

func DecryptEverything(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedEverything) ([]Everything, error)

DecryptEverything opens each EncryptedEverything, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type Inner 

type Inner struct {
	Name string
	N    int32
}

Inner is a struct carried through a passthrough field and inside an opaque struct.

type Kinds 

type Kinds struct {
	S   string        `stash:"s,encrypt,index=equality;match"`
	E   Email         `stash:"e,encrypt,index=equality;match;ore"`
	Bo  bool          `stash:"bo,encrypt"`
	I8  int8          `stash:"i8,encrypt,index=equality"`
	I16 int16         `stash:"i16,encrypt,index=ope"`
	I32 int32         `stash:"i32,encrypt,index=equality"`
	I   int           `stash:"i,encrypt,index=ore"`
	I64 int64         `stash:"i64,encrypt"`
	U8  uint8         `stash:"u8,encrypt,index=equality"`
	U16 uint16        `stash:"u16,encrypt"`
	U32 uint32        `stash:"u32,encrypt,index=equality;ore"`
	U   uint          `stash:"u,encrypt"`
	U64 uint64        `stash:"u64,encrypt,index=ope"`
	F32 float32       `stash:"f32,encrypt"`
	F64 float64       `stash:"f64,encrypt,index=ore"`
	By  []byte        `stash:"by,encrypt,index=equality"`
	Bl  Blob          `stash:"bl,encrypt"`
	Sc  Score         `stash:"sc,encrypt,index=ore"`
	St  Status        `stash:"st,encrypt,index=equality"`
	D   time.Duration `stash:"d,encrypt,index=ore"`

	P  *int              `stash:"p,passthrough"`
	M  map[string]string `stash:"m,passthrough"`
	T  time.Time         `stash:"t,passthrough"`
	N  sql.NullTime      `stash:"n,passthrough"`
	In Inner             `stash:"in,passthrough"`
	Sk []Inner           `stash:"sk,passthrough"`
	A  any               `stash:"a,passthrough"`
	Er error             `stash:"er,passthrough"`
	// contains filtered or unexported fields
}

Kinds has one sealed field of every scalar kind stashgen accepts outside an opaque struct, with defined types among them, and passthrough fields of types the codec cannot carry. Everything it accepts round-trips.

func DecryptKinds 

func DecryptKinds(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedKinds) ([]Kinds, error)

DecryptKinds opens each EncryptedKinds, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type KindsBlField 

type KindsBlField struct {
	// contains filtered or unexported fields
}

func (KindsBlField) Encrypt 

func (f KindsBlField) Encrypt(ctx context.Context, c *encrypt.Cipher, v Blob) (EncryptedKindsBl, error)

type KindsBoField 

type KindsBoField struct {
	// contains filtered or unexported fields
}

func (KindsBoField) Encrypt 

func (f KindsBoField) Encrypt(ctx context.Context, c *encrypt.Cipher, v bool) (EncryptedKindsBo, error)

type KindsByField 

type KindsByField struct {
	// contains filtered or unexported fields
}

func (KindsByField) Encrypt 

func (f KindsByField) Encrypt(ctx context.Context, c *encrypt.Cipher, v []byte) (EncryptedKindsBy, error)

func (KindsByField) Eq 

func (f KindsByField) Eq(ctx context.Context, c *encrypt.Cipher, v []byte) (encrypt.EqualityTerm, error)

type KindsDField 

type KindsDField struct {
	// contains filtered or unexported fields
}

func (KindsDField) Between 

func (f KindsDField) Between(ctx context.Context, c *encrypt.Cipher, lo, hi time.Duration) (encrypt.Range[encrypt.OreTerm], error)

func (KindsDField) Encrypt 

func (f KindsDField) Encrypt(ctx context.Context, c *encrypt.Cipher, v time.Duration) (EncryptedKindsD, error)

func (KindsDField) Gt 

func (f KindsDField) Gt(ctx context.Context, c *encrypt.Cipher, v time.Duration) (encrypt.OreTerm, error)

func (KindsDField) Gte 

func (f KindsDField) Gte(ctx context.Context, c *encrypt.Cipher, v time.Duration) (encrypt.OreTerm, error)

func (KindsDField) Lt 

func (f KindsDField) Lt(ctx context.Context, c *encrypt.Cipher, v time.Duration) (encrypt.OreTerm, error)

func (KindsDField) Lte 

func (f KindsDField) Lte(ctx context.Context, c *encrypt.Cipher, v time.Duration) (encrypt.OreTerm, error)

type KindsEField 

type KindsEField struct {
	// contains filtered or unexported fields
}

func (KindsEField) Between 

func (f KindsEField) Between(ctx context.Context, c *encrypt.Cipher, lo, hi Email) (encrypt.Range[encrypt.OreTerm], error)

func (KindsEField) Encrypt 

func (f KindsEField) Encrypt(ctx context.Context, c *encrypt.Cipher, v Email) (EncryptedKindsE, error)

func (KindsEField) Eq 

func (f KindsEField) Eq(ctx context.Context, c *encrypt.Cipher, v Email) (encrypt.EqualityTerm, error)

func (KindsEField) Gt 

func (f KindsEField) Gt(ctx context.Context, c *encrypt.Cipher, v Email) (encrypt.OreTerm, error)

func (KindsEField) Gte 

func (f KindsEField) Gte(ctx context.Context, c *encrypt.Cipher, v Email) (encrypt.OreTerm, error)

func (KindsEField) Lt 

func (f KindsEField) Lt(ctx context.Context, c *encrypt.Cipher, v Email) (encrypt.OreTerm, error)

func (KindsEField) Lte 

func (f KindsEField) Lte(ctx context.Context, c *encrypt.Cipher, v Email) (encrypt.OreTerm, error)

func (KindsEField) Matches 

func (f KindsEField) Matches(ctx context.Context, c *encrypt.Cipher, v Email) (encrypt.MatchQuery[Email], error)

Matches derives the matches query for v. Its answer can hold rows that do not match: decrypt the rows it fetches and keep those Verify reports true.

type KindsF32Field 

type KindsF32Field struct {
	// contains filtered or unexported fields
}

func (KindsF32Field) Encrypt 

func (f KindsF32Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v float32) (EncryptedKindsF32, error)

type KindsF64Field 

type KindsF64Field struct {
	// contains filtered or unexported fields
}

func (KindsF64Field) Between 

func (f KindsF64Field) Between(ctx context.Context, c *encrypt.Cipher, lo, hi float64) (encrypt.Range[encrypt.OreTerm], error)

func (KindsF64Field) Encrypt 

func (f KindsF64Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v float64) (EncryptedKindsF64, error)

func (KindsF64Field) Gt 

func (f KindsF64Field) Gt(ctx context.Context, c *encrypt.Cipher, v float64) (encrypt.OreTerm, error)

func (KindsF64Field) Gte 

func (f KindsF64Field) Gte(ctx context.Context, c *encrypt.Cipher, v float64) (encrypt.OreTerm, error)

func (KindsF64Field) Lt 

func (f KindsF64Field) Lt(ctx context.Context, c *encrypt.Cipher, v float64) (encrypt.OreTerm, error)

func (KindsF64Field) Lte 

func (f KindsF64Field) Lte(ctx context.Context, c *encrypt.Cipher, v float64) (encrypt.OreTerm, error)

type KindsI8Field 

type KindsI8Field struct {
	// contains filtered or unexported fields
}

func (KindsI8Field) Encrypt 

func (f KindsI8Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v int8) (EncryptedKindsI8, error)

func (KindsI8Field) Eq 

func (f KindsI8Field) Eq(ctx context.Context, c *encrypt.Cipher, v int8) (encrypt.EqualityTerm, error)

type KindsI16Field 

type KindsI16Field struct {
	// contains filtered or unexported fields
}

func (KindsI16Field) Between 

func (f KindsI16Field) Between(ctx context.Context, c *encrypt.Cipher, lo, hi int16) (encrypt.Range[encrypt.OpeTerm], error)

func (KindsI16Field) Encrypt 

func (f KindsI16Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v int16) (EncryptedKindsI16, error)

func (KindsI16Field) Gt 

func (f KindsI16Field) Gt(ctx context.Context, c *encrypt.Cipher, v int16) (encrypt.OpeTerm, error)

func (KindsI16Field) Gte 

func (f KindsI16Field) Gte(ctx context.Context, c *encrypt.Cipher, v int16) (encrypt.OpeTerm, error)

func (KindsI16Field) Lt 

func (f KindsI16Field) Lt(ctx context.Context, c *encrypt.Cipher, v int16) (encrypt.OpeTerm, error)

func (KindsI16Field) Lte 

func (f KindsI16Field) Lte(ctx context.Context, c *encrypt.Cipher, v int16) (encrypt.OpeTerm, error)

type KindsI32Field 

type KindsI32Field struct {
	// contains filtered or unexported fields
}

func (KindsI32Field) Encrypt 

func (f KindsI32Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v int32) (EncryptedKindsI32, error)

func (KindsI32Field) Eq 

func (f KindsI32Field) Eq(ctx context.Context, c *encrypt.Cipher, v int32) (encrypt.EqualityTerm, error)

type KindsI64Field 

type KindsI64Field struct {
	// contains filtered or unexported fields
}

func (KindsI64Field) Encrypt 

func (f KindsI64Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v int64) (EncryptedKindsI64, error)

type KindsIField 

type KindsIField struct {
	// contains filtered or unexported fields
}

func (KindsIField) Between 

func (f KindsIField) Between(ctx context.Context, c *encrypt.Cipher, lo, hi int) (encrypt.Range[encrypt.OreTerm], error)

func (KindsIField) Encrypt 

func (f KindsIField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int) (EncryptedKindsI, error)

func (KindsIField) Gt 

func (f KindsIField) Gt(ctx context.Context, c *encrypt.Cipher, v int) (encrypt.OreTerm, error)

func (KindsIField) Gte 

func (f KindsIField) Gte(ctx context.Context, c *encrypt.Cipher, v int) (encrypt.OreTerm, error)

func (KindsIField) Lt 

func (f KindsIField) Lt(ctx context.Context, c *encrypt.Cipher, v int) (encrypt.OreTerm, error)

func (KindsIField) Lte 

func (f KindsIField) Lte(ctx context.Context, c *encrypt.Cipher, v int) (encrypt.OreTerm, error)

type KindsSField 

type KindsSField struct {
	// contains filtered or unexported fields
}

func (KindsSField) Encrypt 

func (f KindsSField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (EncryptedKindsS, error)

func (KindsSField) Eq 

func (f KindsSField) Eq(ctx context.Context, c *encrypt.Cipher, v string) (encrypt.EqualityTerm, error)

func (KindsSField) Matches 

func (f KindsSField) Matches(ctx context.Context, c *encrypt.Cipher, v string) (encrypt.MatchQuery[string], error)

Matches derives the matches query for v. Its answer can hold rows that do not match: decrypt the rows it fetches and keep those Verify reports true.

type KindsScField 

type KindsScField struct {
	// contains filtered or unexported fields
}

func (KindsScField) Between 

func (f KindsScField) Between(ctx context.Context, c *encrypt.Cipher, lo, hi Score) (encrypt.Range[encrypt.OreTerm], error)

func (KindsScField) Encrypt 

func (f KindsScField) Encrypt(ctx context.Context, c *encrypt.Cipher, v Score) (EncryptedKindsSc, error)

func (KindsScField) Gt 

func (f KindsScField) Gt(ctx context.Context, c *encrypt.Cipher, v Score) (encrypt.OreTerm, error)

func (KindsScField) Gte 

func (f KindsScField) Gte(ctx context.Context, c *encrypt.Cipher, v Score) (encrypt.OreTerm, error)

func (KindsScField) Lt 

func (f KindsScField) Lt(ctx context.Context, c *encrypt.Cipher, v Score) (encrypt.OreTerm, error)

func (KindsScField) Lte 

func (f KindsScField) Lte(ctx context.Context, c *encrypt.Cipher, v Score) (encrypt.OreTerm, error)

type KindsStField 

type KindsStField struct {
	// contains filtered or unexported fields
}

func (KindsStField) Encrypt 

func (f KindsStField) Encrypt(ctx context.Context, c *encrypt.Cipher, v Status) (EncryptedKindsSt, error)

func (KindsStField) Eq 

func (f KindsStField) Eq(ctx context.Context, c *encrypt.Cipher, v Status) (encrypt.EqualityTerm, error)

type KindsU8Field 

type KindsU8Field struct {
	// contains filtered or unexported fields
}

func (KindsU8Field) Encrypt 

func (f KindsU8Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v uint8) (EncryptedKindsU8, error)

func (KindsU8Field) Eq 

func (f KindsU8Field) Eq(ctx context.Context, c *encrypt.Cipher, v uint8) (encrypt.EqualityTerm, error)

type KindsU16Field 

type KindsU16Field struct {
	// contains filtered or unexported fields
}

func (KindsU16Field) Encrypt 

func (f KindsU16Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v uint16) (EncryptedKindsU16, error)

type KindsU32Field 

type KindsU32Field struct {
	// contains filtered or unexported fields
}

func (KindsU32Field) Between 

func (f KindsU32Field) Between(ctx context.Context, c *encrypt.Cipher, lo, hi uint32) (encrypt.Range[encrypt.OreTerm], error)

func (KindsU32Field) Encrypt 

func (f KindsU32Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v uint32) (EncryptedKindsU32, error)

func (KindsU32Field) Eq 

func (f KindsU32Field) Eq(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.EqualityTerm, error)

func (KindsU32Field) Gt 

func (f KindsU32Field) Gt(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

func (KindsU32Field) Gte 

func (f KindsU32Field) Gte(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

func (KindsU32Field) Lt 

func (f KindsU32Field) Lt(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

func (KindsU32Field) Lte 

func (f KindsU32Field) Lte(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

type KindsU64Field 

type KindsU64Field struct {
	// contains filtered or unexported fields
}

func (KindsU64Field) Between 

func (f KindsU64Field) Between(ctx context.Context, c *encrypt.Cipher, lo, hi uint64) (encrypt.Range[encrypt.OpeTerm], error)

func (KindsU64Field) Encrypt 

func (f KindsU64Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v uint64) (EncryptedKindsU64, error)

func (KindsU64Field) Gt 

func (f KindsU64Field) Gt(ctx context.Context, c *encrypt.Cipher, v uint64) (encrypt.OpeTerm, error)

func (KindsU64Field) Gte 

func (f KindsU64Field) Gte(ctx context.Context, c *encrypt.Cipher, v uint64) (encrypt.OpeTerm, error)

func (KindsU64Field) Lt 

func (f KindsU64Field) Lt(ctx context.Context, c *encrypt.Cipher, v uint64) (encrypt.OpeTerm, error)

func (KindsU64Field) Lte 

func (f KindsU64Field) Lte(ctx context.Context, c *encrypt.Cipher, v uint64) (encrypt.OpeTerm, error)

type KindsUField 

type KindsUField struct {
	// contains filtered or unexported fields
}

func (KindsUField) Encrypt 

func (f KindsUField) Encrypt(ctx context.Context, c *encrypt.Cipher, v uint) (EncryptedKindsU, error)

type Ledger 

type Ledger struct {
	ID      int64           `stash:"id,passthrough"`
	Opened  encrypt.Date    `stash:"opened,encrypt_into=Date"`
	Due     encrypt.Date    `stash:"due,encrypt_into=DateEq"`
	Created time.Time       `stash:"created,encrypt_into=Timestamp"`
	Posted  time.Time       `stash:"posted,encrypt_into=TimestampEq"`
	Total   encrypt.Decimal `stash:"total,encrypt_into=Numeric"`
	Amount  encrypt.Decimal `stash:"amount,encrypt_into=NumericEq"`
	// contains filtered or unexported fields
}

Ledger stores the date, timestamp and numeric EQL v4 types: each family's storage-only type and its equality type, from the Go types ADR-0002 maps them to (encrypt.Date, time.Time, encrypt.Decimal). Its columns are under Profile's table, with names of their own, so its queries sit beside v4_queries.json's in v4_ledger_queries.json. It is a model of its own because Profile's rows are frozen in stored_v4_rows_v1.json: a new Profile field would change what those rows store.

func DecryptLedger 

func DecryptLedger(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedLedger) ([]Ledger, error)

DecryptLedger opens each EncryptedLedger, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type LedgerAmountField 

type LedgerAmountField struct {
	// contains filtered or unexported fields
}

func (LedgerAmountField) Encrypt 

func (f LedgerAmountField) Encrypt(ctx context.Context, c *encrypt.Cipher, v encrypt.Decimal) (eql.NumericEq, error)

func (LedgerAmountField) Eq 

func (f LedgerAmountField) Eq(ctx context.Context, c *encrypt.Cipher, v encrypt.Decimal) (eql.NumericEqQuery, error)

type LedgerCreatedField 

type LedgerCreatedField struct {
	// contains filtered or unexported fields
}

func (LedgerCreatedField) Encrypt 

func (f LedgerCreatedField) Encrypt(ctx context.Context, c *encrypt.Cipher, v time.Time) (eql.Timestamp, error)

type LedgerDueField 

type LedgerDueField struct {
	// contains filtered or unexported fields
}

func (LedgerDueField) Encrypt 

func (f LedgerDueField) Encrypt(ctx context.Context, c *encrypt.Cipher, v encrypt.Date) (eql.DateEq, error)

func (LedgerDueField) Eq 

func (f LedgerDueField) Eq(ctx context.Context, c *encrypt.Cipher, v encrypt.Date) (eql.DateEqQuery, error)

type LedgerOpenedField 

type LedgerOpenedField struct {
	// contains filtered or unexported fields
}

func (LedgerOpenedField) Encrypt 

func (f LedgerOpenedField) Encrypt(ctx context.Context, c *encrypt.Cipher, v encrypt.Date) (eql.Date, error)

type LedgerPostedField 

type LedgerPostedField struct {
	// contains filtered or unexported fields
}

func (LedgerPostedField) Encrypt 

func (f LedgerPostedField) Encrypt(ctx context.Context, c *encrypt.Cipher, v time.Time) (eql.TimestampEq, error)

func (LedgerPostedField) Eq 

func (f LedgerPostedField) Eq(ctx context.Context, c *encrypt.Cipher, v time.Time) (eql.TimestampEqQuery, error)

type LedgerTotalField 

type LedgerTotalField struct {
	// contains filtered or unexported fields
}

func (LedgerTotalField) Encrypt 

func (f LedgerTotalField) Encrypt(ctx context.Context, c *encrypt.Cipher, v encrypt.Decimal) (eql.Numeric, error)

type Lookup 

type Lookup struct {
	ID    int64  `stash:"id,passthrough"`
	Email string `stash:"email,encrypt"`
	Score int32  `stash:"score,index=ore"`
	Code  Status `stash:"code,index=equality"`
	// contains filtered or unexported fields
}

Lookup has index-only fields: each stores its terms and no ciphertext, so Decrypt leaves it at its zero value and still opens the sealed field.

func DecryptLookup 

func DecryptLookup(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedLookup) ([]Lookup, error)

DecryptLookup opens each EncryptedLookup, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

DecryptLookup leaves Score and Code at the zero value: an index-only field stores no ciphertext, so nothing opens for it. Do not pass a decrypted value back to EncryptLookup to update its row, because EncryptLookup would then store the term for zero. Derive the index-only terms again from the real values through LookupFields.

type LookupCodeField 

type LookupCodeField struct {
	// contains filtered or unexported fields
}

func (LookupCodeField) Encrypt 

func (f LookupCodeField) Encrypt(ctx context.Context, c *encrypt.Cipher, v Status) (EncryptedLookupCode, error)

func (LookupCodeField) Eq 

func (f LookupCodeField) Eq(ctx context.Context, c *encrypt.Cipher, v Status) (encrypt.EqualityTerm, error)

type LookupEmailField 

type LookupEmailField struct {
	// contains filtered or unexported fields
}

func (LookupEmailField) Encrypt 

func (f LookupEmailField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (EncryptedLookupEmail, error)

type LookupScoreField 

type LookupScoreField struct {
	// contains filtered or unexported fields
}

func (LookupScoreField) Between 

func (f LookupScoreField) Between(ctx context.Context, c *encrypt.Cipher, lo, hi int32) (encrypt.Range[encrypt.OreTerm], error)

func (LookupScoreField) Encrypt 

func (f LookupScoreField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int32) (EncryptedLookupScore, error)

func (LookupScoreField) Gt 

func (f LookupScoreField) Gt(ctx context.Context, c *encrypt.Cipher, v int32) (encrypt.OreTerm, error)

func (LookupScoreField) Gte 

func (f LookupScoreField) Gte(ctx context.Context, c *encrypt.Cipher, v int32) (encrypt.OreTerm, error)

func (LookupScoreField) Lt 

func (f LookupScoreField) Lt(ctx context.Context, c *encrypt.Cipher, v int32) (encrypt.OreTerm, error)

func (LookupScoreField) Lte 

func (f LookupScoreField) Lte(ctx context.Context, c *encrypt.Cipher, v int32) (encrypt.OreTerm, error)

type MemberAgeField 

type MemberAgeField struct {
	// contains filtered or unexported fields
}

func (MemberAgeField) Between 

func (f MemberAgeField) Between(ctx context.Context, c *encrypt.Cipher, lo, hi uint32) (encrypt.Range[encrypt.OreTerm], error)

func (MemberAgeField) Encrypt 

func (f MemberAgeField) Encrypt(ctx context.Context, c *encrypt.Cipher, v uint32) (EncryptedMemberAge, error)

func (MemberAgeField) Eq 

func (f MemberAgeField) Eq(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.EqualityTerm, error)

func (MemberAgeField) Gt 

func (f MemberAgeField) Gt(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

func (MemberAgeField) Gte 

func (f MemberAgeField) Gte(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

func (MemberAgeField) Lt 

func (f MemberAgeField) Lt(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

func (MemberAgeField) Lte 

func (f MemberAgeField) Lte(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

type MemberEmailField 

type MemberEmailField struct {
	// contains filtered or unexported fields
}

func (MemberEmailField) Encrypt 

func (f MemberEmailField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (EncryptedMemberEmail, error)

func (MemberEmailField) Eq 

func (f MemberEmailField) Eq(ctx context.Context, c *encrypt.Cipher, v string) (encrypt.EqualityTerm, error)

func (MemberEmailField) Matches 

func (f MemberEmailField) Matches(ctx context.Context, c *encrypt.Cipher, v string) (encrypt.MatchQuery[string], error)

Matches derives the matches query for v. Its answer can hold rows that do not match: decrypt the rows it fetches and keep those Verify reports true.

type MemberNotesField 

type MemberNotesField struct {
	// contains filtered or unexported fields
}

func (MemberNotesField) Encrypt 

func (f MemberNotesField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (EncryptedMemberNotes, error)

type Note 

type Note struct {
	Tenant string `stash:"tenant,context_field"`
	Text   string `stash:"text,encrypt,index=equality"`
	ID     uint32 `stash:"id,passthrough"`
}

Note takes its context from its own Tenant field, as the Rust record fixture's context-field case does (the `context_field` key of packages/stack-encrypt/tests/fixtures/record_lowering.json): the same field names, kinds and index, so the fixture's records open through the generated code and its term compares.

func DecryptNote 

func DecryptNote(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedNote) ([]Note, error)

DecryptNote opens each EncryptedNote, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type NoteTextField 

type NoteTextField struct {
	// contains filtered or unexported fields
}

func (NoteTextField) Encrypt 

func (f NoteTextField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (EncryptedNoteText, error)

func (NoteTextField) Eq 

func (f NoteTextField) Eq(ctx context.Context, c *encrypt.Cipher, v string) (encrypt.EqualityTerm, error)

type NotesField 

type NotesField struct {
	// contains filtered or unexported fields
}

func (NotesField) Encrypt 

func (f NotesField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (EncryptedUserNotes, error)

type Person 

type Person struct {
	ID     int64         `stash:"id,passthrough"`
	DOB    *encrypt.Date `stash:"dob,encrypt_into=Date"`
	Born   *encrypt.Date `stash:"born,encrypt_into=DateEq"`
	Joined *encrypt.Date `stash:"joined,encrypt_into=DateEq,null=sql"`
	Age    *int32        `stash:"age,encrypt,index=equality"`
	Score  *int64        `stash:"score,encrypt,index=ore,null=sql"`
	Nick   *string       `stash:"nick,encrypt,null=sql"`
	// contains filtered or unexported fields
}

Person has optional fields, each declared over a pointer, in both ways a field stores nil (#1298). DOB, Born and Age store it as a sealed null, as long as a value, which the generator picks for a type of fixed width whose only index is equality: Born's and Age's equality terms of nil are the one term every nil shares, which EqNull queries. Joined, Score and Nick store SQL NULL, which an order index and text have to ask for.

func DecryptPerson 

func DecryptPerson(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedPerson) ([]Person, error)

DecryptPerson opens each EncryptedPerson, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type PersonAgeField 

type PersonAgeField struct {
	// contains filtered or unexported fields
}

func (PersonAgeField) Encrypt 

func (f PersonAgeField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int32) (EncryptedPersonAge, error)

func (PersonAgeField) EncryptNull 

func (f PersonAgeField) EncryptNull(ctx context.Context, c *encrypt.Cipher) (EncryptedPersonAge, error)

EncryptNull seals nil for Age, as long as a value, for an update that sets the column to nil. Write what it returns, not SQL NULL: the field stores nil as a sealed null.

func (PersonAgeField) Eq 

func (f PersonAgeField) Eq(ctx context.Context, c *encrypt.Cipher, v int32) (encrypt.EqualityTerm, error)

func (PersonAgeField) EqNull 

func (f PersonAgeField) EqNull(ctx context.Context, c *encrypt.Cipher) (encrypt.EqualityTerm, error)

EqNull derives the eq query for nil: the term every stored nil of the field shares, so it finds the rows whose value is absent.

type PersonBornField 

type PersonBornField struct {
	// contains filtered or unexported fields
}

func (PersonBornField) Encrypt 

func (f PersonBornField) Encrypt(ctx context.Context, c *encrypt.Cipher, v encrypt.Date) (eql.DateEq, error)

func (PersonBornField) EncryptNull 

func (f PersonBornField) EncryptNull(ctx context.Context, c *encrypt.Cipher) (eql.DateEq, error)

EncryptNull seals nil for Born, as long as a value, for an update that sets the column to nil. Write what it returns, not SQL NULL: the field stores nil as a sealed null.

func (PersonBornField) Eq 

func (f PersonBornField) Eq(ctx context.Context, c *encrypt.Cipher, v encrypt.Date) (eql.DateEqQuery, error)

func (PersonBornField) EqNull 

func (f PersonBornField) EqNull(ctx context.Context, c *encrypt.Cipher) (eql.DateEqQuery, error)

EqNull derives the eq query for nil: the term every stored nil of the field shares, so it finds the rows whose value is absent.

type PersonDOBField 

type PersonDOBField struct {
	// contains filtered or unexported fields
}

func (PersonDOBField) Encrypt 

func (f PersonDOBField) Encrypt(ctx context.Context, c *encrypt.Cipher, v encrypt.Date) (eql.Date, error)

func (PersonDOBField) EncryptNull 

func (f PersonDOBField) EncryptNull(ctx context.Context, c *encrypt.Cipher) (eql.Date, error)

EncryptNull seals nil for DOB, as long as a value, for an update that sets the column to nil. Write what it returns, not SQL NULL: the field stores nil as a sealed null.

type PersonJoinedField 

type PersonJoinedField struct {
	// contains filtered or unexported fields
}

func (PersonJoinedField) Encrypt 

func (f PersonJoinedField) Encrypt(ctx context.Context, c *encrypt.Cipher, v encrypt.Date) (eql.DateEq, error)

func (PersonJoinedField) Eq 

func (f PersonJoinedField) Eq(ctx context.Context, c *encrypt.Cipher, v encrypt.Date) (eql.DateEqQuery, error)

type PersonNickField 

type PersonNickField struct {
	// contains filtered or unexported fields
}

func (PersonNickField) Encrypt 

func (f PersonNickField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (EncryptedPersonNick, error)

type PersonScoreField 

type PersonScoreField struct {
	// contains filtered or unexported fields
}

func (PersonScoreField) Between 

func (f PersonScoreField) Between(ctx context.Context, c *encrypt.Cipher, lo, hi int64) (encrypt.Range[encrypt.OreTerm], error)

func (PersonScoreField) Encrypt 

func (f PersonScoreField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int64) (EncryptedPersonScore, error)

func (PersonScoreField) Gt 

func (f PersonScoreField) Gt(ctx context.Context, c *encrypt.Cipher, v int64) (encrypt.OreTerm, error)

func (PersonScoreField) Gte 

func (f PersonScoreField) Gte(ctx context.Context, c *encrypt.Cipher, v int64) (encrypt.OreTerm, error)

func (PersonScoreField) Lt 

func (f PersonScoreField) Lt(ctx context.Context, c *encrypt.Cipher, v int64) (encrypt.OreTerm, error)

func (PersonScoreField) Lte 

func (f PersonScoreField) Lte(ctx context.Context, c *encrypt.Cipher, v int64) (encrypt.OreTerm, error)

type Probe 

type Probe struct {
	U32 uint32  `stash:"u32,encrypt,index=ore;ope"`
	U64 uint64  `stash:"u64,encrypt,index=ore;ope"`
	I64 int64   `stash:"i64,encrypt,index=ore;ope"`
	S   string  `stash:"s,encrypt,index=ore;ope"`
	B   []byte  `stash:"b,encrypt,index=ore;ope"`
	F64 float64 `stash:"f64,encrypt,index=ore;ope"`
	F32 float32 `stash:"f32,encrypt,index=ore;ope"`
	// contains filtered or unexported fields
}

Probe has one field of each scalar type the ORE and OPE indexes order, for the property tests of term ordering.

func DecryptProbe 

func DecryptProbe(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedProbe) ([]Probe, error)

DecryptProbe opens each EncryptedProbe, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type ProbeBField 

type ProbeBField struct {
	// contains filtered or unexported fields
}

func (ProbeBField) Encrypt 

func (f ProbeBField) Encrypt(ctx context.Context, c *encrypt.Cipher, v []byte) (EncryptedProbeB, error)

type ProbeF32Field 

type ProbeF32Field struct {
	// contains filtered or unexported fields
}

func (ProbeF32Field) Between 

func (f ProbeF32Field) Between(ctx context.Context, c *encrypt.Cipher, lo, hi float32) (encrypt.Range[encrypt.OreTerm], error)

func (ProbeF32Field) Encrypt 

func (f ProbeF32Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v float32) (EncryptedProbeF32, error)

func (ProbeF32Field) Gt 

func (f ProbeF32Field) Gt(ctx context.Context, c *encrypt.Cipher, v float32) (encrypt.OreTerm, error)

func (ProbeF32Field) Gte 

func (f ProbeF32Field) Gte(ctx context.Context, c *encrypt.Cipher, v float32) (encrypt.OreTerm, error)

func (ProbeF32Field) Lt 

func (f ProbeF32Field) Lt(ctx context.Context, c *encrypt.Cipher, v float32) (encrypt.OreTerm, error)

func (ProbeF32Field) Lte 

func (f ProbeF32Field) Lte(ctx context.Context, c *encrypt.Cipher, v float32) (encrypt.OreTerm, error)

type ProbeF64Field 

type ProbeF64Field struct {
	// contains filtered or unexported fields
}

func (ProbeF64Field) Between 

func (f ProbeF64Field) Between(ctx context.Context, c *encrypt.Cipher, lo, hi float64) (encrypt.Range[encrypt.OreTerm], error)

func (ProbeF64Field) Encrypt 

func (f ProbeF64Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v float64) (EncryptedProbeF64, error)

func (ProbeF64Field) Gt 

func (f ProbeF64Field) Gt(ctx context.Context, c *encrypt.Cipher, v float64) (encrypt.OreTerm, error)

func (ProbeF64Field) Gte 

func (f ProbeF64Field) Gte(ctx context.Context, c *encrypt.Cipher, v float64) (encrypt.OreTerm, error)

func (ProbeF64Field) Lt 

func (f ProbeF64Field) Lt(ctx context.Context, c *encrypt.Cipher, v float64) (encrypt.OreTerm, error)

func (ProbeF64Field) Lte 

func (f ProbeF64Field) Lte(ctx context.Context, c *encrypt.Cipher, v float64) (encrypt.OreTerm, error)

type ProbeI64Field 

type ProbeI64Field struct {
	// contains filtered or unexported fields
}

func (ProbeI64Field) Between 

func (f ProbeI64Field) Between(ctx context.Context, c *encrypt.Cipher, lo, hi int64) (encrypt.Range[encrypt.OreTerm], error)

func (ProbeI64Field) Encrypt 

func (f ProbeI64Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v int64) (EncryptedProbeI64, error)

func (ProbeI64Field) Gt 

func (f ProbeI64Field) Gt(ctx context.Context, c *encrypt.Cipher, v int64) (encrypt.OreTerm, error)

func (ProbeI64Field) Gte 

func (f ProbeI64Field) Gte(ctx context.Context, c *encrypt.Cipher, v int64) (encrypt.OreTerm, error)

func (ProbeI64Field) Lt 

func (f ProbeI64Field) Lt(ctx context.Context, c *encrypt.Cipher, v int64) (encrypt.OreTerm, error)

func (ProbeI64Field) Lte 

func (f ProbeI64Field) Lte(ctx context.Context, c *encrypt.Cipher, v int64) (encrypt.OreTerm, error)

type ProbeSField 

type ProbeSField struct {
	// contains filtered or unexported fields
}

func (ProbeSField) Between 

func (f ProbeSField) Between(ctx context.Context, c *encrypt.Cipher, lo, hi string) (encrypt.Range[encrypt.OreTerm], error)

func (ProbeSField) Encrypt 

func (f ProbeSField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (EncryptedProbeS, error)

func (ProbeSField) Gt 

func (f ProbeSField) Gt(ctx context.Context, c *encrypt.Cipher, v string) (encrypt.OreTerm, error)

func (ProbeSField) Gte 

func (f ProbeSField) Gte(ctx context.Context, c *encrypt.Cipher, v string) (encrypt.OreTerm, error)

func (ProbeSField) Lt 

func (f ProbeSField) Lt(ctx context.Context, c *encrypt.Cipher, v string) (encrypt.OreTerm, error)

func (ProbeSField) Lte 

func (f ProbeSField) Lte(ctx context.Context, c *encrypt.Cipher, v string) (encrypt.OreTerm, error)

type ProbeU32Field 

type ProbeU32Field struct {
	// contains filtered or unexported fields
}

func (ProbeU32Field) Between 

func (f ProbeU32Field) Between(ctx context.Context, c *encrypt.Cipher, lo, hi uint32) (encrypt.Range[encrypt.OreTerm], error)

func (ProbeU32Field) Encrypt 

func (f ProbeU32Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v uint32) (EncryptedProbeU32, error)

func (ProbeU32Field) Gt 

func (f ProbeU32Field) Gt(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

func (ProbeU32Field) Gte 

func (f ProbeU32Field) Gte(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

func (ProbeU32Field) Lt 

func (f ProbeU32Field) Lt(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

func (ProbeU32Field) Lte 

func (f ProbeU32Field) Lte(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

type ProbeU64Field 

type ProbeU64Field struct {
	// contains filtered or unexported fields
}

func (ProbeU64Field) Between 

func (f ProbeU64Field) Between(ctx context.Context, c *encrypt.Cipher, lo, hi uint64) (encrypt.Range[encrypt.OreTerm], error)

func (ProbeU64Field) Encrypt 

func (f ProbeU64Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v uint64) (EncryptedProbeU64, error)

func (ProbeU64Field) Gt 

func (f ProbeU64Field) Gt(ctx context.Context, c *encrypt.Cipher, v uint64) (encrypt.OreTerm, error)

func (ProbeU64Field) Gte 

func (f ProbeU64Field) Gte(ctx context.Context, c *encrypt.Cipher, v uint64) (encrypt.OreTerm, error)

func (ProbeU64Field) Lt 

func (f ProbeU64Field) Lt(ctx context.Context, c *encrypt.Cipher, v uint64) (encrypt.OreTerm, error)

func (ProbeU64Field) Lte 

func (f ProbeU64Field) Lte(ctx context.Context, c *encrypt.Cipher, v uint64) (encrypt.OreTerm, error)

type Profile 

type Profile struct {
	ID      int64   `stash:"id,passthrough"`
	Visits  int32   `stash:"visits,encrypt_into=Integer"`
	Balance int64   `stash:"balance,encrypt_into=Bigint"`
	Active  bool    `stash:"active,encrypt_into=Boolean"`
	Ratio   float32 `stash:"ratio,encrypt_into=Real"`
	Score   float64 `stash:"score,encrypt_into=Double"`
	Note    string  `stash:"note,encrypt_into=Text"`
	Name    string  `stash:"name,encrypt_into=TextMatch"`
	Age     int32   `stash:"age,encrypt_into=IntegerEq"`
	Rank    int64   `stash:"rank,encrypt_into=BigintEq"`
	Weight  float32 `stash:"weight,encrypt_into=RealEq"`
	Price   float64 `stash:"price,encrypt_into=DoubleEq"`
	Email   string  `stash:"email,encrypt_into=TextEq"`
	// contains filtered or unexported fields
}

Profile stores one field in each EQL v4 type the engine produces, the shape the cross-language fixtures under packages/eql/tests/encryption/fixtures (v4_queries.json, v4_rows.json, stored_v4_rows_v1.json) are derived under (table profiles).

func DecryptProfile 

func DecryptProfile(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedProfile) ([]Profile, error)

DecryptProfile opens each EncryptedProfile, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type ProfileActiveField 

type ProfileActiveField struct {
	// contains filtered or unexported fields
}

func (ProfileActiveField) Encrypt 

func (f ProfileActiveField) Encrypt(ctx context.Context, c *encrypt.Cipher, v bool) (eql.Boolean, error)

type ProfileAgeField 

type ProfileAgeField struct {
	// contains filtered or unexported fields
}

func (ProfileAgeField) Encrypt 

func (f ProfileAgeField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int32) (eql.IntegerEq, error)

func (ProfileAgeField) Eq 

func (f ProfileAgeField) Eq(ctx context.Context, c *encrypt.Cipher, v int32) (eql.IntegerEqQuery, error)

type ProfileBalanceField 

type ProfileBalanceField struct {
	// contains filtered or unexported fields
}

func (ProfileBalanceField) Encrypt 

func (f ProfileBalanceField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int64) (eql.Bigint, error)

type ProfileEmailField 

type ProfileEmailField struct {
	// contains filtered or unexported fields
}

func (ProfileEmailField) Encrypt 

func (f ProfileEmailField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextEq, error)

func (ProfileEmailField) Eq 

func (f ProfileEmailField) Eq(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextEqQuery, error)

type ProfileNameField 

type ProfileNameField struct {
	// contains filtered or unexported fields
}

func (ProfileNameField) Encrypt 

func (f ProfileNameField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextMatch, error)

func (ProfileNameField) Matches 

func (f ProfileNameField) Matches(ctx context.Context, c *encrypt.Cipher, v string) (encrypt.EQLMatchQuery[eql.TextMatchQuery, string], error)

Matches derives the matches query for v. Its answer can hold rows that do not match: decrypt the rows it fetches and keep those Verify reports true.

type ProfileNeedle 

type ProfileNeedle struct {
	Name   *string `json:"name,omitempty"`
	Age    *int64  `json:"age,omitempty"`
	Tier   *string `json:"tier,omitempty"`
	Visits []Visit `json:"visits,omitempty"`
}

ProfileNeedle is a containment needle for a subscriber's profile: every field is a pointer with omitempty, so a field left nil is not in the needle and does not narrow the query.

type ProfileNoteField 

type ProfileNoteField struct {
	// contains filtered or unexported fields
}

func (ProfileNoteField) Encrypt 

func (f ProfileNoteField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (eql.Text, error)

type ProfilePriceField 

type ProfilePriceField struct {
	// contains filtered or unexported fields
}

func (ProfilePriceField) Encrypt 

func (f ProfilePriceField) Encrypt(ctx context.Context, c *encrypt.Cipher, v float64) (eql.DoubleEq, error)

func (ProfilePriceField) Eq 

func (f ProfilePriceField) Eq(ctx context.Context, c *encrypt.Cipher, v float64) (eql.DoubleEqQuery, error)

type ProfileRankField 

type ProfileRankField struct {
	// contains filtered or unexported fields
}

func (ProfileRankField) Encrypt 

func (f ProfileRankField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int64) (eql.BigintEq, error)

func (ProfileRankField) Eq 

func (f ProfileRankField) Eq(ctx context.Context, c *encrypt.Cipher, v int64) (eql.BigintEqQuery, error)

type ProfileRatioField 

type ProfileRatioField struct {
	// contains filtered or unexported fields
}

func (ProfileRatioField) Encrypt 

func (f ProfileRatioField) Encrypt(ctx context.Context, c *encrypt.Cipher, v float32) (eql.Real, error)

type ProfileScoreField 

type ProfileScoreField struct {
	// contains filtered or unexported fields
}

func (ProfileScoreField) Encrypt 

func (f ProfileScoreField) Encrypt(ctx context.Context, c *encrypt.Cipher, v float64) (eql.Double, error)

type ProfileVisitsField 

type ProfileVisitsField struct {
	// contains filtered or unexported fields
}

func (ProfileVisitsField) Encrypt 

func (f ProfileVisitsField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int32) (eql.Integer, error)

type ProfileWeightField 

type ProfileWeightField struct {
	// contains filtered or unexported fields
}

func (ProfileWeightField) Encrypt 

func (f ProfileWeightField) Encrypt(ctx context.Context, c *encrypt.Cipher, v float32) (eql.RealEq, error)

func (ProfileWeightField) Eq 

func (f ProfileWeightField) Eq(ctx context.Context, c *encrypt.Cipher, v float32) (eql.RealEqQuery, error)

type QueryProfile 

type QueryProfile struct {
	Email string  `stash:"email,encrypt,index=equality"`
	Age   uint32  `stash:"age,encrypt,index=equality;ore"`
	Name  string  `stash:"name,encrypt,index=match"`
	Score float64 `stash:"score,encrypt,index=ore"`
	// contains filtered or unexported fields
}

QueryProfile is the declaration of the Rust query fixture (packages/stack-encrypt/tests/fixtures/query_operators.json): the same context, field names, kinds and indexes, so each query its generated methods derive compares with the term the fixture records.

func DecryptQueryProfile 

func DecryptQueryProfile(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedQueryProfile) ([]QueryProfile, error)

DecryptQueryProfile opens each EncryptedQueryProfile, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type QueryProfileAgeField 

type QueryProfileAgeField struct {
	// contains filtered or unexported fields
}

func (QueryProfileAgeField) Between 

func (f QueryProfileAgeField) Between(ctx context.Context, c *encrypt.Cipher, lo, hi uint32) (encrypt.Range[encrypt.OreTerm], error)

func (QueryProfileAgeField) Encrypt 

func (f QueryProfileAgeField) Encrypt(ctx context.Context, c *encrypt.Cipher, v uint32) (EncryptedQueryProfileAge, error)

func (QueryProfileAgeField) Eq 

func (f QueryProfileAgeField) Eq(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.EqualityTerm, error)

func (QueryProfileAgeField) Gt 

func (f QueryProfileAgeField) Gt(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

func (QueryProfileAgeField) Gte 

func (f QueryProfileAgeField) Gte(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

func (QueryProfileAgeField) Lt 

func (f QueryProfileAgeField) Lt(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

func (QueryProfileAgeField) Lte 

func (f QueryProfileAgeField) Lte(ctx context.Context, c *encrypt.Cipher, v uint32) (encrypt.OreTerm, error)

type QueryProfileEmailField 

type QueryProfileEmailField struct {
	// contains filtered or unexported fields
}

func (QueryProfileEmailField) Encrypt 

func (f QueryProfileEmailField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (EncryptedQueryProfileEmail, error)

func (QueryProfileEmailField) Eq 

func (f QueryProfileEmailField) Eq(ctx context.Context, c *encrypt.Cipher, v string) (encrypt.EqualityTerm, error)

type QueryProfileNameField 

type QueryProfileNameField struct {
	// contains filtered or unexported fields
}

func (QueryProfileNameField) Encrypt 

func (f QueryProfileNameField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (EncryptedQueryProfileName, error)

func (QueryProfileNameField) Matches 

func (f QueryProfileNameField) Matches(ctx context.Context, c *encrypt.Cipher, v string) (encrypt.MatchQuery[string], error)

Matches derives the matches query for v. Its answer can hold rows that do not match: decrypt the rows it fetches and keep those Verify reports true.

type QueryProfileScoreField 

type QueryProfileScoreField struct {
	// contains filtered or unexported fields
}

func (QueryProfileScoreField) Between 

func (f QueryProfileScoreField) Between(ctx context.Context, c *encrypt.Cipher, lo, hi float64) (encrypt.Range[encrypt.OreTerm], error)

func (QueryProfileScoreField) Encrypt 

func (f QueryProfileScoreField) Encrypt(ctx context.Context, c *encrypt.Cipher, v float64) (EncryptedQueryProfileScore, error)

func (QueryProfileScoreField) Gt 

func (f QueryProfileScoreField) Gt(ctx context.Context, c *encrypt.Cipher, v float64) (encrypt.OreTerm, error)

func (QueryProfileScoreField) Gte 

func (f QueryProfileScoreField) Gte(ctx context.Context, c *encrypt.Cipher, v float64) (encrypt.OreTerm, error)

func (QueryProfileScoreField) Lt 

func (f QueryProfileScoreField) Lt(ctx context.Context, c *encrypt.Cipher, v float64) (encrypt.OreTerm, error)

func (QueryProfileScoreField) Lte 

func (f QueryProfileScoreField) Lte(ctx context.Context, c *encrypt.Cipher, v float64) (encrypt.OreTerm, error)

type Ranking 

type Ranking struct {
	ID     int64   `stash:"id,passthrough"`
	Level  int32   `stash:"level,encrypt_into=IntegerOrd"`
	Floor  int32   `stash:"floor,encrypt_into=IntegerOrdOpe"`
	Points int64   `stash:"points,encrypt_into=BigintOrd"`
	Total  int64   `stash:"total,encrypt_into=BigintOrdOpe"`
	Speed  float32 `stash:"speed,encrypt_into=RealOrd"`
	Pace   float32 `stash:"pace,encrypt_into=RealOrdOpe"`
	Score  float64 `stash:"score,encrypt_into=DoubleOrd"`
	Mean   float64 `stash:"mean,encrypt_into=DoubleOrdOpe"`
	Title  string  `stash:"title,encrypt_into=TextOrd"`
	Handle string  `stash:"handle,encrypt_into=TextOrdOpe"`
	// contains filtered or unexported fields
}

Ranking stores one field in each OPE-ordered EQL v4 type the engine produces, the shape the ordered cross-language fixtures under packages/eql/tests/encryption/fixtures (v4_ordered_queries.json, v4_ordered_rows.json) are derived under (table rankings). The `Ord` and `OrdOpe` types of a family store the same terms; each gets a column so both plans run.

func DecryptRanking 

func DecryptRanking(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedRanking) ([]Ranking, error)

DecryptRanking opens each EncryptedRanking, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type RankingFloorField 

type RankingFloorField struct {
	// contains filtered or unexported fields
}

func (RankingFloorField) Encrypt 

func (f RankingFloorField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int32) (eql.IntegerOrdOpe, error)

func (RankingFloorField) Gt 

func (f RankingFloorField) Gt(ctx context.Context, c *encrypt.Cipher, v int32) (eql.IntegerOrdOpeQuery, error)

func (RankingFloorField) Gte 

func (f RankingFloorField) Gte(ctx context.Context, c *encrypt.Cipher, v int32) (eql.IntegerOrdOpeQuery, error)

func (RankingFloorField) Lt 

func (f RankingFloorField) Lt(ctx context.Context, c *encrypt.Cipher, v int32) (eql.IntegerOrdOpeQuery, error)

func (RankingFloorField) Lte 

func (f RankingFloorField) Lte(ctx context.Context, c *encrypt.Cipher, v int32) (eql.IntegerOrdOpeQuery, error)

type RankingHandleField 

type RankingHandleField struct {
	// contains filtered or unexported fields
}

func (RankingHandleField) Encrypt 

func (f RankingHandleField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextOrdOpe, error)

func (RankingHandleField) Eq 

func (f RankingHandleField) Eq(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextOrdOpeQuery, error)

func (RankingHandleField) Gt 

func (f RankingHandleField) Gt(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextOrdOpeQuery, error)

func (RankingHandleField) Gte 

func (f RankingHandleField) Gte(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextOrdOpeQuery, error)

func (RankingHandleField) Lt 

func (f RankingHandleField) Lt(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextOrdOpeQuery, error)

func (RankingHandleField) Lte 

func (f RankingHandleField) Lte(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextOrdOpeQuery, error)

type RankingLevelField 

type RankingLevelField struct {
	// contains filtered or unexported fields
}

func (RankingLevelField) Encrypt 

func (f RankingLevelField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int32) (eql.IntegerOrd, error)

func (RankingLevelField) Gt 

func (f RankingLevelField) Gt(ctx context.Context, c *encrypt.Cipher, v int32) (eql.IntegerOrdQuery, error)

func (RankingLevelField) Gte 

func (f RankingLevelField) Gte(ctx context.Context, c *encrypt.Cipher, v int32) (eql.IntegerOrdQuery, error)

func (RankingLevelField) Lt 

func (f RankingLevelField) Lt(ctx context.Context, c *encrypt.Cipher, v int32) (eql.IntegerOrdQuery, error)

func (RankingLevelField) Lte 

func (f RankingLevelField) Lte(ctx context.Context, c *encrypt.Cipher, v int32) (eql.IntegerOrdQuery, error)

type RankingMeanField 

type RankingMeanField struct {
	// contains filtered or unexported fields
}

func (RankingMeanField) Encrypt 

func (f RankingMeanField) Encrypt(ctx context.Context, c *encrypt.Cipher, v float64) (eql.DoubleOrdOpe, error)

func (RankingMeanField) Gt 

func (f RankingMeanField) Gt(ctx context.Context, c *encrypt.Cipher, v float64) (eql.DoubleOrdOpeQuery, error)

func (RankingMeanField) Gte 

func (f RankingMeanField) Gte(ctx context.Context, c *encrypt.Cipher, v float64) (eql.DoubleOrdOpeQuery, error)

func (RankingMeanField) Lt 

func (f RankingMeanField) Lt(ctx context.Context, c *encrypt.Cipher, v float64) (eql.DoubleOrdOpeQuery, error)

func (RankingMeanField) Lte 

func (f RankingMeanField) Lte(ctx context.Context, c *encrypt.Cipher, v float64) (eql.DoubleOrdOpeQuery, error)

type RankingPaceField 

type RankingPaceField struct {
	// contains filtered or unexported fields
}

func (RankingPaceField) Encrypt 

func (f RankingPaceField) Encrypt(ctx context.Context, c *encrypt.Cipher, v float32) (eql.RealOrdOpe, error)

func (RankingPaceField) Gt 

func (f RankingPaceField) Gt(ctx context.Context, c *encrypt.Cipher, v float32) (eql.RealOrdOpeQuery, error)

func (RankingPaceField) Gte 

func (f RankingPaceField) Gte(ctx context.Context, c *encrypt.Cipher, v float32) (eql.RealOrdOpeQuery, error)

func (RankingPaceField) Lt 

func (f RankingPaceField) Lt(ctx context.Context, c *encrypt.Cipher, v float32) (eql.RealOrdOpeQuery, error)

func (RankingPaceField) Lte 

func (f RankingPaceField) Lte(ctx context.Context, c *encrypt.Cipher, v float32) (eql.RealOrdOpeQuery, error)

type RankingPointsField 

type RankingPointsField struct {
	// contains filtered or unexported fields
}

func (RankingPointsField) Encrypt 

func (f RankingPointsField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int64) (eql.BigintOrd, error)

func (RankingPointsField) Gt 

func (f RankingPointsField) Gt(ctx context.Context, c *encrypt.Cipher, v int64) (eql.BigintOrdQuery, error)

func (RankingPointsField) Gte 

func (f RankingPointsField) Gte(ctx context.Context, c *encrypt.Cipher, v int64) (eql.BigintOrdQuery, error)

func (RankingPointsField) Lt 

func (f RankingPointsField) Lt(ctx context.Context, c *encrypt.Cipher, v int64) (eql.BigintOrdQuery, error)

func (RankingPointsField) Lte 

func (f RankingPointsField) Lte(ctx context.Context, c *encrypt.Cipher, v int64) (eql.BigintOrdQuery, error)

type RankingScoreField 

type RankingScoreField struct {
	// contains filtered or unexported fields
}

func (RankingScoreField) Encrypt 

func (f RankingScoreField) Encrypt(ctx context.Context, c *encrypt.Cipher, v float64) (eql.DoubleOrd, error)

func (RankingScoreField) Gt 

func (f RankingScoreField) Gt(ctx context.Context, c *encrypt.Cipher, v float64) (eql.DoubleOrdQuery, error)

func (RankingScoreField) Gte 

func (f RankingScoreField) Gte(ctx context.Context, c *encrypt.Cipher, v float64) (eql.DoubleOrdQuery, error)

func (RankingScoreField) Lt 

func (f RankingScoreField) Lt(ctx context.Context, c *encrypt.Cipher, v float64) (eql.DoubleOrdQuery, error)

func (RankingScoreField) Lte 

func (f RankingScoreField) Lte(ctx context.Context, c *encrypt.Cipher, v float64) (eql.DoubleOrdQuery, error)

type RankingSpeedField 

type RankingSpeedField struct {
	// contains filtered or unexported fields
}

func (RankingSpeedField) Encrypt 

func (f RankingSpeedField) Encrypt(ctx context.Context, c *encrypt.Cipher, v float32) (eql.RealOrd, error)

func (RankingSpeedField) Gt 

func (f RankingSpeedField) Gt(ctx context.Context, c *encrypt.Cipher, v float32) (eql.RealOrdQuery, error)

func (RankingSpeedField) Gte 

func (f RankingSpeedField) Gte(ctx context.Context, c *encrypt.Cipher, v float32) (eql.RealOrdQuery, error)

func (RankingSpeedField) Lt 

func (f RankingSpeedField) Lt(ctx context.Context, c *encrypt.Cipher, v float32) (eql.RealOrdQuery, error)

func (RankingSpeedField) Lte 

func (f RankingSpeedField) Lte(ctx context.Context, c *encrypt.Cipher, v float32) (eql.RealOrdQuery, error)

type RankingTitleField 

type RankingTitleField struct {
	// contains filtered or unexported fields
}

func (RankingTitleField) Encrypt 

func (f RankingTitleField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextOrd, error)

func (RankingTitleField) Eq 

func (f RankingTitleField) Eq(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextOrdQuery, error)

func (RankingTitleField) Gt 

func (f RankingTitleField) Gt(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextOrdQuery, error)

func (RankingTitleField) Gte 

func (f RankingTitleField) Gte(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextOrdQuery, error)

func (RankingTitleField) Lt 

func (f RankingTitleField) Lt(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextOrdQuery, error)

func (RankingTitleField) Lte 

func (f RankingTitleField) Lte(ctx context.Context, c *encrypt.Cipher, v string) (eql.TextOrdQuery, error)

type RankingTotalField 

type RankingTotalField struct {
	// contains filtered or unexported fields
}

func (RankingTotalField) Encrypt 

func (f RankingTotalField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int64) (eql.BigintOrdOpe, error)

func (RankingTotalField) Gt 

func (f RankingTotalField) Gt(ctx context.Context, c *encrypt.Cipher, v int64) (eql.BigintOrdOpeQuery, error)

func (RankingTotalField) Gte 

func (f RankingTotalField) Gte(ctx context.Context, c *encrypt.Cipher, v int64) (eql.BigintOrdOpeQuery, error)

func (RankingTotalField) Lt 

func (f RankingTotalField) Lt(ctx context.Context, c *encrypt.Cipher, v int64) (eql.BigintOrdOpeQuery, error)

func (RankingTotalField) Lte 

func (f RankingTotalField) Lte(ctx context.Context, c *encrypt.Cipher, v int64) (eql.BigintOrdOpeQuery, error)

type Score 

type Score int16

Defined types over scalars: the engine returns the underlying type and the generated code converts.

type Secret 

type Secret struct {
	ID    int64  `stash:"id,passthrough"`
	Value string `stash:"value,encrypt"`
	// contains filtered or unexported fields
}

Secret is generated with -redact, so it prints no sealed field.

func DecryptSecret 

func DecryptSecret(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedSecret) ([]Secret, error)

DecryptSecret opens each EncryptedSecret, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

func (Secret) GoString 

func (s Secret) GoString() string

GoString is what %#v prints; without it %#v prints every field.

func (Secret) LogValue 

func (s Secret) LogValue() slog.Value

func (Secret) String 

func (s Secret) String() string

Written because of -redact: Secret no longer prints its sealed fields.

type SecretValueField 

type SecretValueField struct {
	// contains filtered or unexported fields
}

func (SecretValueField) Encrypt 

func (f SecretValueField) Encrypt(ctx context.Context, c *encrypt.Cipher, v string) (EncryptedSecretValue, error)

type Status 

type Status string

Defined types over scalars: the engine returns the underlying type and the generated code converts.

type Subscriber 

type Subscriber struct {
	ID      int64             `stash:"id,passthrough"`
	Profile SubscriberProfile `stash:"profile,encrypt_into=JsonSearch(ordered=$.age;$.visits[*].at)"`
	Prefs   *SubscriberPrefs  `stash:"prefs,encrypt_into=JsonSearch,null=sql"`
	Labels  map[string]string `stash:"labels,encrypt_into=JsonSearch"`
	// contains filtered or unexported fields
}

Subscriber holds encrypted JSON documents (the EQL type JsonSearch) of Go types: encoding/json writes each to JSON text when it is sealed and reads it back when it is opened. Its profile orders $.age and each visit's $.at, its preferences are SQL NULL when nil, and its labels are a map.

func DecryptSubscriber 

func DecryptSubscriber(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedSubscriber) ([]Subscriber, error)

DecryptSubscriber opens each EncryptedSubscriber, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type SubscriberLabelsField 

type SubscriberLabelsField struct {
	// contains filtered or unexported fields
}

SubscriberLabelsField provides document queries and reads for the Labels field.

func (SubscriberLabelsField) ChildCount 

func (f SubscriberLabelsField) ChildCount(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONToken, error)

ChildCount derives the token of the node at path, which eql_v4.json_tree_child_count(col, $1::text) takes: zero for a scalar or an empty container, NULL where the row has no node there or for the sealed root.

func (SubscriberLabelsField) Children 

func (f SubscriberLabelsField) Children(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONToken, error)

Children derives the token of the node at path, a path with no wildcard, which eql_v4.json_tree_children(col, $1::text) takes. Its rows are encrypted entries one level down.

func (SubscriberLabelsField) ContainedBy 

func (f SubscriberLabelsField) ContainedBy(ctx context.Context, c *encrypt.Cipher, needle any) (eql.JSONSearchQuery, error)

ContainedBy derives the query for documents contained by needle: col <@ query. needle is a json.RawMessage of JSON text, or a map, struct or slice that encoding/json writes (not a Go string or a pointer to one, nor a needle that writes JSON null); here a zero-valued field widens the query, admitting documents that hold that zero.

func (SubscriberLabelsField) Contains 

func (f SubscriberLabelsField) Contains(ctx context.Context, c *encrypt.Cipher, needle any) (eql.JSONSearchQuery, error)

Contains derives the query for documents that contain needle: col @> query. needle is a json.RawMessage of JSON text, or a map, struct or slice that encoding/json writes; a Go string or a pointer to one is refused, as one JSON string is not JSON text, and so is a needle that writes JSON null (nil, or a nil pointer, map or slice). Each member it writes must be in the document, so a zero-valued struct field narrows the query to documents holding that zero: give a needle struct pointer fields, or omitempty, or use a map. Each array element of the needle must sit inside one element of the document's array.

func (SubscriberLabelsField) Encrypt 

func (f SubscriberLabelsField) Encrypt(ctx context.Context, c *encrypt.Cipher, v map[string]string) (eql.JSONSearch, error)

Encrypt seals one Labels document for an update of its stored column.

func (SubscriberLabelsField) EqAt 

func (f SubscriberLabelsField) EqAt(ctx context.Context, c *encrypt.Cipher, path string, v any) (eql.JSONSearchQuery, error)

EqAt derives the query for documents holding the scalar v at path: col @> query. v is a Go string, number or bool, nil for JSON null, or a json.RawMessage of JSON text; a Go string is the JSON string it holds, never parsed as JSON. A wildcard step matches when any element holds it; a position ([2]) is refused, since the stored selector reads every position as the wildcard.

func (SubscriberLabelsField) Match 

func (f SubscriberLabelsField) Match(ctx context.Context, c *encrypt.Cipher, predicate string, vars any, opts encrypt.JSONReadOptions) (eql.JSONSearchPredicateQuery, error)

Match derives the operand for a jsonpath predicate over the document, as plaintext jsonb_path_match(col, predicate, vars) takes one: bind it as col @@ $1::eql_v4.query_json_predicate, or eql_v4.json_tree_match(col, $1::eql_v4.query_json_predicate). vars are the predicate's variables ($name): a map, a struct or a json.RawMessage that writes a JSON object, and an empty map when there are none. A nil vars is SQL NULL, as pgx and database/sql bind it over plaintext: the operand is empty, binds as NULL, and matches no row, as jsonb_path_match does with NULL vars.

The engine reads the predicate, and nothing in Go does: paths of .key, ."quoted key" and [*] steps; ==, !=, <, <=, > and >= between a path and a variable or a JSON literal; exists(path), and exists(path ? (@.m == $v && @.n > $w)) for several members of one array element; &&, || and !(…). Anything else is refused, before any term is derived, as an *encrypt.Diagnostic wrapping encrypt.ErrEncoding whose Reason, Construct and At name the refusal and the byte offset in predicate where it starts. An ordering at a path the tag does not order, or a member of a filter of more than one condition that it does not order, is refused wrapping encrypt.ErrTerm.

The tree is evaluated inside eql_v4.json_tree_match, which engages no index: every row the scan gives it is opened and tested. The per-operator methods engage the GIN index for @> (EqAt, Contains) and a btree on an ordered path's term (At.<Path>), so a query that needs an index writes those leaves with them, or narrows the rows with one beside Match.

A query returns jsonb_path_match's rows over the plaintext, and each row answers as it does, true, false or NULL, save five cases. Lax mode's unwrapping of an array the path names no [*] for is not applied: write [*]. Nor is its wrapping of a value that is not an array under [*]. A string compared with a number is false under == and true under !=, where jsonpath says unknown. Orderings, and filters of more than one condition, compare folded ordering terms: text case- and accent-folded, numbers as float64, so such a filter's == is of folded values; == elsewhere is exact. An ordering of a JSON null is NULL where jsonpath says false, except under an odd number of !, which returns the same rows; there the operand also asks that the node is not null, which tells the database which rows hold null at the path.

A filter of more than one condition reads each array to opts.WildcardBound elements, 64 when it is 0. A row whose array is longer fails the query with SQLSTATE 22023 (invalid_parameter_value) rather than answer over part of it: raise the bound past the longest array.

func (SubscriberLabelsField) Selector 

func (f SubscriberLabelsField) Selector(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONSelection[eql.JSONEntry], error)

Selector prepares `->` at path: bind Selector() as col -> $1::text, and open the entries it returns with Open; encrypt.DecodeJSON reads each value into a Go type. A position ([2]) is refused; read one with Subtree.

func (SubscriberLabelsField) Subtree 

func (f SubscriberLabelsField) Subtree(ctx context.Context, c *encrypt.Cipher, path string, opts encrypt.JSONReadOptions) (encrypt.JSONRead[eql.JSONEntry], error)

Subtree prepares a read of the value at path: bind Tokens() as eql_v4.json_tree_subtree(col, $1::text[], budget), and open the rows it returns with Open or OpenOne; encrypt.DecodeJSON reads each value into a Go type.

type SubscriberPrefs 

type SubscriberPrefs struct {
	Theme string `json:"theme"`
}

SubscriberPrefs is a subscriber's optional preferences document.

type SubscriberPrefsField 

type SubscriberPrefsField struct {
	// contains filtered or unexported fields
}

SubscriberPrefsField provides document queries and reads for the Prefs field.

func (SubscriberPrefsField) ChildCount 

func (f SubscriberPrefsField) ChildCount(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONToken, error)

ChildCount derives the token of the node at path, which eql_v4.json_tree_child_count(col, $1::text) takes: zero for a scalar or an empty container, NULL where the row has no node there or for the sealed root.

func (SubscriberPrefsField) Children 

func (f SubscriberPrefsField) Children(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONToken, error)

Children derives the token of the node at path, a path with no wildcard, which eql_v4.json_tree_children(col, $1::text) takes. Its rows are encrypted entries one level down.

func (SubscriberPrefsField) ContainedBy 

func (f SubscriberPrefsField) ContainedBy(ctx context.Context, c *encrypt.Cipher, needle any) (eql.JSONSearchQuery, error)

ContainedBy derives the query for documents contained by needle: col <@ query. needle is a json.RawMessage of JSON text, or a map, struct or slice that encoding/json writes (not a Go string or a pointer to one, nor a needle that writes JSON null); here a zero-valued field widens the query, admitting documents that hold that zero.

func (SubscriberPrefsField) Contains 

func (f SubscriberPrefsField) Contains(ctx context.Context, c *encrypt.Cipher, needle any) (eql.JSONSearchQuery, error)

Contains derives the query for documents that contain needle: col @> query. needle is a json.RawMessage of JSON text, or a map, struct or slice that encoding/json writes; a Go string or a pointer to one is refused, as one JSON string is not JSON text, and so is a needle that writes JSON null (nil, or a nil pointer, map or slice). Each member it writes must be in the document, so a zero-valued struct field narrows the query to documents holding that zero: give a needle struct pointer fields, or omitempty, or use a map. Each array element of the needle must sit inside one element of the document's array. A needle of the field's own type, SubscriberPrefs, is refused for that reason, and so is a pointer to it: write a needle type whose fields are pointers with omitempty, or use a map.

func (SubscriberPrefsField) Encrypt 

func (f SubscriberPrefsField) Encrypt(ctx context.Context, c *encrypt.Cipher, v SubscriberPrefs) (eql.JSONSearch, error)

Encrypt seals one Prefs document for an update of its stored column.

func (SubscriberPrefsField) EqAt 

func (f SubscriberPrefsField) EqAt(ctx context.Context, c *encrypt.Cipher, path string, v any) (eql.JSONSearchQuery, error)

EqAt derives the query for documents holding the scalar v at path: col @> query. v is a Go string, number or bool, nil for JSON null, or a json.RawMessage of JSON text; a Go string is the JSON string it holds, never parsed as JSON. A wildcard step matches when any element holds it; a position ([2]) is refused, since the stored selector reads every position as the wildcard.

func (SubscriberPrefsField) Match 

func (f SubscriberPrefsField) Match(ctx context.Context, c *encrypt.Cipher, predicate string, vars any, opts encrypt.JSONReadOptions) (eql.JSONSearchPredicateQuery, error)

Match derives the operand for a jsonpath predicate over the document, as plaintext jsonb_path_match(col, predicate, vars) takes one: bind it as col @@ $1::eql_v4.query_json_predicate, or eql_v4.json_tree_match(col, $1::eql_v4.query_json_predicate). vars are the predicate's variables ($name): a map, a struct or a json.RawMessage that writes a JSON object, and an empty map when there are none. A nil vars is SQL NULL, as pgx and database/sql bind it over plaintext: the operand is empty, binds as NULL, and matches no row, as jsonb_path_match does with NULL vars.

The engine reads the predicate, and nothing in Go does: paths of .key, ."quoted key" and [*] steps; ==, !=, <, <=, > and >= between a path and a variable or a JSON literal; exists(path), and exists(path ? (@.m == $v && @.n > $w)) for several members of one array element; &&, || and !(…). Anything else is refused, before any term is derived, as an *encrypt.Diagnostic wrapping encrypt.ErrEncoding whose Reason, Construct and At name the refusal and the byte offset in predicate where it starts. An ordering at a path the tag does not order, or a member of a filter of more than one condition that it does not order, is refused wrapping encrypt.ErrTerm.

The tree is evaluated inside eql_v4.json_tree_match, which engages no index: every row the scan gives it is opened and tested. The per-operator methods engage the GIN index for @> (EqAt, Contains) and a btree on an ordered path's term (At.<Path>), so a query that needs an index writes those leaves with them, or narrows the rows with one beside Match.

A query returns jsonb_path_match's rows over the plaintext, and each row answers as it does, true, false or NULL, save five cases. Lax mode's unwrapping of an array the path names no [*] for is not applied: write [*]. Nor is its wrapping of a value that is not an array under [*]. A string compared with a number is false under == and true under !=, where jsonpath says unknown. Orderings, and filters of more than one condition, compare folded ordering terms: text case- and accent-folded, numbers as float64, so such a filter's == is of folded values; == elsewhere is exact. An ordering of a JSON null is NULL where jsonpath says false, except under an odd number of !, which returns the same rows; there the operand also asks that the node is not null, which tells the database which rows hold null at the path.

A filter of more than one condition reads each array to opts.WildcardBound elements, 64 when it is 0. A row whose array is longer fails the query with SQLSTATE 22023 (invalid_parameter_value) rather than answer over part of it: raise the bound past the longest array.

func (SubscriberPrefsField) Selector 

func (f SubscriberPrefsField) Selector(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONSelection[eql.JSONEntry], error)

Selector prepares `->` at path: bind Selector() as col -> $1::text, and open the entries it returns with Open; encrypt.DecodeJSON reads each value into a Go type. A position ([2]) is refused; read one with Subtree.

func (SubscriberPrefsField) Subtree 

func (f SubscriberPrefsField) Subtree(ctx context.Context, c *encrypt.Cipher, path string, opts encrypt.JSONReadOptions) (encrypt.JSONRead[eql.JSONEntry], error)

Subtree prepares a read of the value at path: bind Tokens() as eql_v4.json_tree_subtree(col, $1::text[], budget), and open the rows it returns with Open or OpenOne; encrypt.DecodeJSON reads each value into a Go type.

type SubscriberProfile 

type SubscriberProfile struct {
	Name   string  `json:"name"`
	Age    int64   `json:"age"`
	Tier   string  `json:"tier,omitempty"`
	Big    uint64  `json:"big"`
	Small  int64   `json:"small"`
	Score  float64 `json:"score"`
	Visits []Visit `json:"visits"`
}

SubscriberProfile is a subscriber's profile document. Big, Small and Score hold the values a float64 would round: they cross as their exact digits.

type SubscriberProfileField 

type SubscriberProfileField struct {

	// At has one accessor per path the field orders, whose methods
	// are the orderings there.
	At SubscriberProfileFieldAt
	// Elements has one accessor per array whose elements have ordered
	// members, whose Match tests the members of one element together.
	Elements SubscriberProfileFieldElements
	// contains filtered or unexported fields
}

SubscriberProfileField provides document queries and reads for the Profile field.

func (SubscriberProfileField) ChildCount 

func (f SubscriberProfileField) ChildCount(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONToken, error)

ChildCount derives the token of the node at path, which eql_v4.json_tree_child_count(col, $1::text) takes: zero for a scalar or an empty container, NULL where the row has no node there or for the sealed root.

func (SubscriberProfileField) Children 

func (f SubscriberProfileField) Children(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONToken, error)

Children derives the token of the node at path, a path with no wildcard, which eql_v4.json_tree_children(col, $1::text) takes. Its rows are encrypted entries one level down.

func (SubscriberProfileField) ContainedBy 

func (f SubscriberProfileField) ContainedBy(ctx context.Context, c *encrypt.Cipher, needle any) (eql.JSONSearchQuery, error)

ContainedBy derives the query for documents contained by needle: col <@ query. needle is a json.RawMessage of JSON text, or a map, struct or slice that encoding/json writes (not a Go string or a pointer to one, nor a needle that writes JSON null); here a zero-valued field widens the query, admitting documents that hold that zero.

func (SubscriberProfileField) Contains 

func (f SubscriberProfileField) Contains(ctx context.Context, c *encrypt.Cipher, needle any) (eql.JSONSearchQuery, error)

Contains derives the query for documents that contain needle: col @> query. needle is a json.RawMessage of JSON text, or a map, struct or slice that encoding/json writes; a Go string or a pointer to one is refused, as one JSON string is not JSON text, and so is a needle that writes JSON null (nil, or a nil pointer, map or slice). Each member it writes must be in the document, so a zero-valued struct field narrows the query to documents holding that zero: give a needle struct pointer fields, or omitempty, or use a map. Each array element of the needle must sit inside one element of the document's array. A needle of the field's own type, SubscriberProfile, is refused for that reason, and so is a pointer to it: write a needle type whose fields are pointers with omitempty, or use a map.

func (SubscriberProfileField) Encrypt 

func (f SubscriberProfileField) Encrypt(ctx context.Context, c *encrypt.Cipher, v SubscriberProfile) (eql.JSONSearch, error)

Encrypt seals one Profile document for an update of its stored column.

func (SubscriberProfileField) EqAt 

func (f SubscriberProfileField) EqAt(ctx context.Context, c *encrypt.Cipher, path string, v any) (eql.JSONSearchQuery, error)

EqAt derives the query for documents holding the scalar v at path: col @> query. v is a Go string, number or bool, nil for JSON null, or a json.RawMessage of JSON text; a Go string is the JSON string it holds, never parsed as JSON. A wildcard step matches when any element holds it; a position ([2]) is refused, since the stored selector reads every position as the wildcard.

func (SubscriberProfileField) Match 

func (f SubscriberProfileField) Match(ctx context.Context, c *encrypt.Cipher, predicate string, vars any, opts encrypt.JSONReadOptions) (eql.JSONSearchPredicateQuery, error)

Match derives the operand for a jsonpath predicate over the document, as plaintext jsonb_path_match(col, predicate, vars) takes one: bind it as col @@ $1::eql_v4.query_json_predicate, or eql_v4.json_tree_match(col, $1::eql_v4.query_json_predicate). vars are the predicate's variables ($name): a map, a struct or a json.RawMessage that writes a JSON object, and an empty map when there are none. A nil vars is SQL NULL, as pgx and database/sql bind it over plaintext: the operand is empty, binds as NULL, and matches no row, as jsonb_path_match does with NULL vars.

The engine reads the predicate, and nothing in Go does: paths of .key, ."quoted key" and [*] steps; ==, !=, <, <=, > and >= between a path and a variable or a JSON literal; exists(path), and exists(path ? (@.m == $v && @.n > $w)) for several members of one array element; &&, || and !(…). Anything else is refused, before any term is derived, as an *encrypt.Diagnostic wrapping encrypt.ErrEncoding whose Reason, Construct and At name the refusal and the byte offset in predicate where it starts. An ordering at a path the tag does not order, or a member of a filter of more than one condition that it does not order, is refused wrapping encrypt.ErrTerm.

The tree is evaluated inside eql_v4.json_tree_match, which engages no index: every row the scan gives it is opened and tested. The per-operator methods engage the GIN index for @> (EqAt, Contains) and a btree on an ordered path's term (At.<Path>), so a query that needs an index writes those leaves with them, or narrows the rows with one beside Match.

A query returns jsonb_path_match's rows over the plaintext, and each row answers as it does, true, false or NULL, save five cases. Lax mode's unwrapping of an array the path names no [*] for is not applied: write [*]. Nor is its wrapping of a value that is not an array under [*]. A string compared with a number is false under == and true under !=, where jsonpath says unknown. Orderings, and filters of more than one condition, compare folded ordering terms: text case- and accent-folded, numbers as float64, so such a filter's == is of folded values; == elsewhere is exact. An ordering of a JSON null is NULL where jsonpath says false, except under an odd number of !, which returns the same rows; there the operand also asks that the node is not null, which tells the database which rows hold null at the path.

A filter of more than one condition reads each array to opts.WildcardBound elements, 64 when it is 0. A row whose array is longer fails the query with SQLSTATE 22023 (invalid_parameter_value) rather than answer over part of it: raise the bound past the longest array.

func (SubscriberProfileField) Selector 

func (f SubscriberProfileField) Selector(ctx context.Context, c *encrypt.Cipher, path string) (encrypt.JSONSelection[eql.JSONEntry], error)

Selector prepares `->` at path: bind Selector() as col -> $1::text, and open the entries it returns with Open; encrypt.DecodeJSON reads each value into a Go type. A position ([2]) is refused; read one with Subtree.

func (SubscriberProfileField) Subtree 

func (f SubscriberProfileField) Subtree(ctx context.Context, c *encrypt.Cipher, path string, opts encrypt.JSONReadOptions) (encrypt.JSONRead[eql.JSONEntry], error)

Subtree prepares a read of the value at path: bind Tokens() as eql_v4.json_tree_subtree(col, $1::text[], budget), and open the rows it returns with Open or OpenOne; encrypt.DecodeJSON reads each value into a Go type.

type SubscriberProfileFieldArray 

type SubscriberProfileFieldArray[E any] struct {
	// contains filtered or unexported fields
}

SubscriberProfileFieldArray is one array of Profile whose elements have ordered members. E is the array's own type, which the predicates its Match takes carry.

func (SubscriberProfileFieldArray[E]) Match 

func (a SubscriberProfileFieldArray[E]) Match(ctx context.Context, c *encrypt.Cipher, opts encrypt.JSONReadOptions, predicates ...encrypt.ElementPredicate[E]) (eql.JSONSearchElementsQuery, error)

Match derives the operand that finds a row where one element of this array passes every predicate: eql_v4.json_tree_element_match(col, $1::eql_v4.query_json_elements). An EqAt and an ordering at the array's paths can each be answered by a different element; Match is answered by one. Make each predicate with encrypt.AtPath and a member of this array under SubscriberPaths, so a member of another array, or a value of another type, does not compile; or with Member, for a member named at run time. No predicates, and a zero ElementPredicate, are refused before the engine is asked.

Each comparison is of the member's ordering term, so Eq is an equality of folded values: text compares case- and accent-folded ("sibling" equals "Sibling"), and integers past 2^53 can tie. EqAt at a member's full path is exact, of any element.

The operand reads each array to opts.WildcardBound elements, 64 when it is 0. A row whose array is longer fails the query with SQLSTATE 22023 (invalid_parameter_value) rather than answer over part of it: raise the bound past the longest array. The function filters the rows a scan gives it, so narrow them with an indexed predicate first, such as @> on the same values.

func (SubscriberProfileFieldArray[E]) Member 

func (a SubscriberProfileFieldArray[E]) Member(member string) encrypt.MemberTest[E, any]

Member is the comparisons of the member of this array's elements that member names, for a filter whose members are known only at run time: relationship, or address.city, written as the member is written below the array in the field's ordered paths. Its values are not checked by the compiler, and Match refuses a member the field does not order beneath this array, naming it, the array and the members the field orders there, before the engine is asked. Where the member is known when the program is written, use encrypt.AtPath and SubscriberPaths.

type SubscriberProfileFieldAt 

type SubscriberProfileFieldAt struct {
	Age      SubscriberProfileFieldPath // $.age
	VisitsAt SubscriberProfileFieldPath // $.visits[*].at
}

SubscriberProfileFieldAt names the declared ordered paths of Profile. Use an accessor's Selector with its ordering query.

type SubscriberProfileFieldElements 

type SubscriberProfileFieldElements struct {
	Visits SubscriberProfileFieldArray[SubscriberProfileFieldElementsVisits] // $.visits[*]: at
}

SubscriberProfileFieldElements names the arrays of Profile whose elements have ordered members. Each accessor's Match tests the members of one element together.

type SubscriberProfileFieldElementsVisits 

type SubscriberProfileFieldElementsVisits struct{}

SubscriberProfileFieldElementsVisits is the array $.visits[*] of Profile, as a type: Elements.Visits.Match takes an encrypt.ElementPredicate[SubscriberProfileFieldElementsVisits], which encrypt.AtPath makes from a member under SubscriberPaths.Profile.Visits.

type SubscriberProfileFieldPath 

type SubscriberProfileFieldPath struct {
	// contains filtered or unexported fields
}

SubscriberProfileFieldPath is one ordered path of Profile. Its orderings derive the leaf operand (eql_v4.query_json_leaf) a stored leaf's ordering term is compared with, and Selector the path's selector. At a path with no array step, compare col -> Selector() with the operand, and order by eql_v4.ord_term(col -> Selector()). At a wildcard path ([*]) col -> Selector() is an unspecified element of each row, so write the comparison over every match, EXISTS (SELECT 1 FROM eql_v4.json_tree_path_query(col, $sel) e WHERE e < $1::eql_v4.query_json_leaf), and order by the least or greatest match's term: (SELECT eql_v4.ord_term(e) FROM eql_v4.json_tree_path_query(col, $sel) e ORDER BY 1 LIMIT 1). Each operand is a Go number or string, or a json.RawMessage of JSON text. Numbers order as float64, so integers past 2^53 can tie; text orders case- and accent-folded.

func (SubscriberProfileFieldPath) Between 

func (p SubscriberProfileFieldPath) Between(ctx context.Context, c *encrypt.Cipher, lo, hi any) (encrypt.JSONRange[eql.JSONSearchLeafQuery], error)

Between derives the two operands that find a leaf at this path from lo to hi, inclusive: (col -> $sel) >= Low AND (col -> $sel) <= High, or at a wildcard path the same over every match, with both bounds on one element (see SubscriberProfileFieldPath).

func (SubscriberProfileFieldPath) Gt 

func (p SubscriberProfileFieldPath) Gt(ctx context.Context, c *encrypt.Cipher, v any) (eql.JSONSearchLeafQuery, error)

Gt derives the operand that finds a leaf at this path greater than v: (col -> $sel) > $1::eql_v4.query_json_leaf, or at a wildcard path the same comparison over every match (see SubscriberProfileFieldPath).

func (SubscriberProfileFieldPath) Gte 

func (p SubscriberProfileFieldPath) Gte(ctx context.Context, c *encrypt.Cipher, v any) (eql.JSONSearchLeafQuery, error)

Gte derives the operand that finds a leaf at this path at least v: (col -> $sel) >= $1::eql_v4.query_json_leaf, or at a wildcard path the same comparison over every match (see SubscriberProfileFieldPath).

func (SubscriberProfileFieldPath) Lt 

func (p SubscriberProfileFieldPath) Lt(ctx context.Context, c *encrypt.Cipher, v any) (eql.JSONSearchLeafQuery, error)

Lt derives the operand that finds a leaf at this path less than v: (col -> $sel) < $1::eql_v4.query_json_leaf, or at a wildcard path the same comparison over every match (see SubscriberProfileFieldPath).

func (SubscriberProfileFieldPath) Lte 

func (p SubscriberProfileFieldPath) Lte(ctx context.Context, c *encrypt.Cipher, v any) (eql.JSONSearchLeafQuery, error)

Lte derives the operand that finds a leaf at this path at most v: (col -> $sel) <= $1::eql_v4.query_json_leaf, or at a wildcard path the same comparison over every match (see SubscriberProfileFieldPath).

func (SubscriberProfileFieldPath) Selector 

func (p SubscriberProfileFieldPath) Selector(ctx context.Context, c *encrypt.Cipher) (encrypt.JSONSelection[eql.JSONEntry], error)

Selector prepares `->` at this path: bind Selector() beside the ordering's operand, from the same path, as col -> $sel, or at a wildcard path as eql_v4.json_tree_path_query(col, $sel), whose matches are every element.

type Tally 

type Tally struct {
	ID    int64 `stash:"id,passthrough"`
	Small int16 `stash:"small,encrypt_into=Smallint"`
	Count int16 `stash:"tally,encrypt_into=SmallintEq"`
	Wide  int32 `stash:"wide,encrypt_into=SmallintEq"`
	// contains filtered or unexported fields
}

Tally stores the smallint EQL v4 types, under Profile's table so its query shares v4_queries.json (key tally). It is a model of its own because Profile's rows are frozen in stored_v4_rows_v1.json: a new Profile field would change what those rows store.

func DecryptTally 

func DecryptTally(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedTally) ([]Tally, error)

DecryptTally opens each EncryptedTally, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type TallyCountField 

type TallyCountField struct {
	// contains filtered or unexported fields
}

func (TallyCountField) Encrypt 

func (f TallyCountField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int16) (eql.SmallintEq, error)

func (TallyCountField) Eq 

func (f TallyCountField) Eq(ctx context.Context, c *encrypt.Cipher, v int16) (eql.SmallintEqQuery, error)

type TallySmallField 

type TallySmallField struct {
	// contains filtered or unexported fields
}

func (TallySmallField) Encrypt 

func (f TallySmallField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int16) (eql.Smallint, error)

type TallyWideField 

type TallyWideField struct {
	// contains filtered or unexported fields
}

func (TallyWideField) Encrypt 

func (f TallyWideField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int32) (eql.SmallintEq, error)

func (TallyWideField) Eq 

func (f TallyWideField) Eq(ctx context.Context, c *encrypt.Cipher, v int32) (eql.SmallintEqQuery, error)

type User 

type User struct {
	ID       int64  `stash:"id,passthrough"`
	Age      uint32 `stash:"age,encrypt,index=equality;ore"`
	Email    string `stash:"email,encrypt,index=equality;match"`
	Notes    string `stash:"notes,encrypt"`
	Internal string `stash:"-"`
	// contains filtered or unexported fields
}

User is the record of the Rust record fixture (packages/stack-encrypt/tests/fixtures/record_lowering.json): the same context, identities, kinds and indexes, so the fixture's records open through the generated code and its terms compare.

func Decrypt 

func Decrypt(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedUser) ([]User, error)

Decrypt opens each EncryptedUser, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

func DecryptRows 

func DecryptRows(ctx context.Context, d encrypt.Decrypter, rows []UserRow) ([]User, error)

type UserRow 

type UserRow struct {
	ID         int64                `stash:"id"`
	Age        encrypt.Ciphertext   `stash:"age"`
	AgeEq      encrypt.EqualityTerm `stash:"age,equality"`
	AgeOre     encrypt.OreTerm      `stash:"age,ore"`
	Email      encrypt.Ciphertext   `stash:"email"`
	EmailEq    encrypt.EqualityTerm `stash:"email,equality"`
	EmailMatch encrypt.MatchTerm    `stash:"email,match"`
	Notes      encrypt.Ciphertext   `stash:"notes"`
}

UserRow is a model for User in separate columns: one field for each output, each tagged with the output it holds, for a library that maps one struct field to one column.

func EncryptRows 

func EncryptRows(ctx context.Context, cipher *encrypt.Cipher, testusers []User) ([]UserRow, error)

type ValueKinds 

type ValueKinds struct {
	I8     int8            `stash:"i8,encrypt,index=equality"`
	I16    int16           `stash:"i16,encrypt,index=equality;ore"`
	U8     uint8           `stash:"u8,encrypt,index=equality"`
	U16    uint16          `stash:"u16,encrypt,index=equality;ope"`
	I128   encrypt.Int128  `stash:"i128,encrypt,index=equality;ore"`
	U128   encrypt.Uint128 `stash:"u128,encrypt,index=equality;ope"`
	Date   encrypt.Date    `stash:"date,encrypt,index=equality;ore"`
	At     time.Time       `stash:"at,encrypt,index=equality;ope"`
	Amount encrypt.Decimal `stash:"amount,encrypt,index=equality;ore"`
	// contains filtered or unexported fields
}

ValueKinds has one sealed field of each kind added in #1144, with the context, identities and indexes of the plan in packages/stack-encrypt/tests/fixtures/value_kinds.json, so the generated code opens the record Rust sealed there and derives the same terms. Every integer seals at its own width, and an 8-bit integer has no order term, so those two carry equality alone.

func DecryptValueKinds 

func DecryptValueKinds(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedValueKinds) ([]ValueKinds, error)

DecryptValueKinds opens each EncryptedValueKinds, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type ValueKindsAmountField 

type ValueKindsAmountField struct {
	// contains filtered or unexported fields
}

func (ValueKindsAmountField) Between 

func (f ValueKindsAmountField) Between(ctx context.Context, c *encrypt.Cipher, lo, hi encrypt.Decimal) (encrypt.Range[encrypt.OreTerm], error)

func (ValueKindsAmountField) Encrypt 

func (f ValueKindsAmountField) Encrypt(ctx context.Context, c *encrypt.Cipher, v encrypt.Decimal) (EncryptedValueKindsAmount, error)

func (ValueKindsAmountField) Eq 

func (f ValueKindsAmountField) Eq(ctx context.Context, c *encrypt.Cipher, v encrypt.Decimal) (encrypt.EqualityTerm, error)

func (ValueKindsAmountField) Gt 

func (f ValueKindsAmountField) Gt(ctx context.Context, c *encrypt.Cipher, v encrypt.Decimal) (encrypt.OreTerm, error)

func (ValueKindsAmountField) Gte 

func (f ValueKindsAmountField) Gte(ctx context.Context, c *encrypt.Cipher, v encrypt.Decimal) (encrypt.OreTerm, error)

func (ValueKindsAmountField) Lt 

func (f ValueKindsAmountField) Lt(ctx context.Context, c *encrypt.Cipher, v encrypt.Decimal) (encrypt.OreTerm, error)

func (ValueKindsAmountField) Lte 

func (f ValueKindsAmountField) Lte(ctx context.Context, c *encrypt.Cipher, v encrypt.Decimal) (encrypt.OreTerm, error)

type ValueKindsAtField 

type ValueKindsAtField struct {
	// contains filtered or unexported fields
}

func (ValueKindsAtField) Between 

func (f ValueKindsAtField) Between(ctx context.Context, c *encrypt.Cipher, lo, hi time.Time) (encrypt.Range[encrypt.OpeTerm], error)

func (ValueKindsAtField) Encrypt 

func (f ValueKindsAtField) Encrypt(ctx context.Context, c *encrypt.Cipher, v time.Time) (EncryptedValueKindsAt, error)

func (ValueKindsAtField) Eq 

func (f ValueKindsAtField) Eq(ctx context.Context, c *encrypt.Cipher, v time.Time) (encrypt.EqualityTerm, error)

func (ValueKindsAtField) Gt 

func (f ValueKindsAtField) Gt(ctx context.Context, c *encrypt.Cipher, v time.Time) (encrypt.OpeTerm, error)

func (ValueKindsAtField) Gte 

func (f ValueKindsAtField) Gte(ctx context.Context, c *encrypt.Cipher, v time.Time) (encrypt.OpeTerm, error)

func (ValueKindsAtField) Lt 

func (f ValueKindsAtField) Lt(ctx context.Context, c *encrypt.Cipher, v time.Time) (encrypt.OpeTerm, error)

func (ValueKindsAtField) Lte 

func (f ValueKindsAtField) Lte(ctx context.Context, c *encrypt.Cipher, v time.Time) (encrypt.OpeTerm, error)

type ValueKindsDateField 

type ValueKindsDateField struct {
	// contains filtered or unexported fields
}

func (ValueKindsDateField) Between 

func (f ValueKindsDateField) Between(ctx context.Context, c *encrypt.Cipher, lo, hi encrypt.Date) (encrypt.Range[encrypt.OreTerm], error)

func (ValueKindsDateField) Encrypt 

func (f ValueKindsDateField) Encrypt(ctx context.Context, c *encrypt.Cipher, v encrypt.Date) (EncryptedValueKindsDate, error)

func (ValueKindsDateField) Eq 

func (f ValueKindsDateField) Eq(ctx context.Context, c *encrypt.Cipher, v encrypt.Date) (encrypt.EqualityTerm, error)

func (ValueKindsDateField) Gt 

func (f ValueKindsDateField) Gt(ctx context.Context, c *encrypt.Cipher, v encrypt.Date) (encrypt.OreTerm, error)

func (ValueKindsDateField) Gte 

func (f ValueKindsDateField) Gte(ctx context.Context, c *encrypt.Cipher, v encrypt.Date) (encrypt.OreTerm, error)

func (ValueKindsDateField) Lt 

func (f ValueKindsDateField) Lt(ctx context.Context, c *encrypt.Cipher, v encrypt.Date) (encrypt.OreTerm, error)

func (ValueKindsDateField) Lte 

func (f ValueKindsDateField) Lte(ctx context.Context, c *encrypt.Cipher, v encrypt.Date) (encrypt.OreTerm, error)

type ValueKindsI8Field 

type ValueKindsI8Field struct {
	// contains filtered or unexported fields
}

func (ValueKindsI8Field) Encrypt 

func (f ValueKindsI8Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v int8) (EncryptedValueKindsI8, error)

func (ValueKindsI8Field) Eq 

func (f ValueKindsI8Field) Eq(ctx context.Context, c *encrypt.Cipher, v int8) (encrypt.EqualityTerm, error)

type ValueKindsI16Field 

type ValueKindsI16Field struct {
	// contains filtered or unexported fields
}

func (ValueKindsI16Field) Between 

func (f ValueKindsI16Field) Between(ctx context.Context, c *encrypt.Cipher, lo, hi int16) (encrypt.Range[encrypt.OreTerm], error)

func (ValueKindsI16Field) Encrypt 

func (f ValueKindsI16Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v int16) (EncryptedValueKindsI16, error)

func (ValueKindsI16Field) Eq 

func (f ValueKindsI16Field) Eq(ctx context.Context, c *encrypt.Cipher, v int16) (encrypt.EqualityTerm, error)

func (ValueKindsI16Field) Gt 

func (f ValueKindsI16Field) Gt(ctx context.Context, c *encrypt.Cipher, v int16) (encrypt.OreTerm, error)

func (ValueKindsI16Field) Gte 

func (f ValueKindsI16Field) Gte(ctx context.Context, c *encrypt.Cipher, v int16) (encrypt.OreTerm, error)

func (ValueKindsI16Field) Lt 

func (f ValueKindsI16Field) Lt(ctx context.Context, c *encrypt.Cipher, v int16) (encrypt.OreTerm, error)

func (ValueKindsI16Field) Lte 

func (f ValueKindsI16Field) Lte(ctx context.Context, c *encrypt.Cipher, v int16) (encrypt.OreTerm, error)

type ValueKindsI128Field 

type ValueKindsI128Field struct {
	// contains filtered or unexported fields
}

func (ValueKindsI128Field) Between 

func (f ValueKindsI128Field) Between(ctx context.Context, c *encrypt.Cipher, lo, hi encrypt.Int128) (encrypt.Range[encrypt.OreTerm], error)

func (ValueKindsI128Field) Encrypt 

func (f ValueKindsI128Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v encrypt.Int128) (EncryptedValueKindsI128, error)

func (ValueKindsI128Field) Eq 

func (f ValueKindsI128Field) Eq(ctx context.Context, c *encrypt.Cipher, v encrypt.Int128) (encrypt.EqualityTerm, error)

func (ValueKindsI128Field) Gt 

func (f ValueKindsI128Field) Gt(ctx context.Context, c *encrypt.Cipher, v encrypt.Int128) (encrypt.OreTerm, error)

func (ValueKindsI128Field) Gte 

func (f ValueKindsI128Field) Gte(ctx context.Context, c *encrypt.Cipher, v encrypt.Int128) (encrypt.OreTerm, error)

func (ValueKindsI128Field) Lt 

func (f ValueKindsI128Field) Lt(ctx context.Context, c *encrypt.Cipher, v encrypt.Int128) (encrypt.OreTerm, error)

func (ValueKindsI128Field) Lte 

func (f ValueKindsI128Field) Lte(ctx context.Context, c *encrypt.Cipher, v encrypt.Int128) (encrypt.OreTerm, error)

type ValueKindsU8Field 

type ValueKindsU8Field struct {
	// contains filtered or unexported fields
}

func (ValueKindsU8Field) Encrypt 

func (f ValueKindsU8Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v uint8) (EncryptedValueKindsU8, error)

func (ValueKindsU8Field) Eq 

func (f ValueKindsU8Field) Eq(ctx context.Context, c *encrypt.Cipher, v uint8) (encrypt.EqualityTerm, error)

type ValueKindsU16Field 

type ValueKindsU16Field struct {
	// contains filtered or unexported fields
}

func (ValueKindsU16Field) Between 

func (f ValueKindsU16Field) Between(ctx context.Context, c *encrypt.Cipher, lo, hi uint16) (encrypt.Range[encrypt.OpeTerm], error)

func (ValueKindsU16Field) Encrypt 

func (f ValueKindsU16Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v uint16) (EncryptedValueKindsU16, error)

func (ValueKindsU16Field) Eq 

func (f ValueKindsU16Field) Eq(ctx context.Context, c *encrypt.Cipher, v uint16) (encrypt.EqualityTerm, error)

func (ValueKindsU16Field) Gt 

func (f ValueKindsU16Field) Gt(ctx context.Context, c *encrypt.Cipher, v uint16) (encrypt.OpeTerm, error)

func (ValueKindsU16Field) Gte 

func (f ValueKindsU16Field) Gte(ctx context.Context, c *encrypt.Cipher, v uint16) (encrypt.OpeTerm, error)

func (ValueKindsU16Field) Lt 

func (f ValueKindsU16Field) Lt(ctx context.Context, c *encrypt.Cipher, v uint16) (encrypt.OpeTerm, error)

func (ValueKindsU16Field) Lte 

func (f ValueKindsU16Field) Lte(ctx context.Context, c *encrypt.Cipher, v uint16) (encrypt.OpeTerm, error)

type ValueKindsU128Field 

type ValueKindsU128Field struct {
	// contains filtered or unexported fields
}

func (ValueKindsU128Field) Between 

func (f ValueKindsU128Field) Between(ctx context.Context, c *encrypt.Cipher, lo, hi encrypt.Uint128) (encrypt.Range[encrypt.OpeTerm], error)

func (ValueKindsU128Field) Encrypt 

func (f ValueKindsU128Field) Encrypt(ctx context.Context, c *encrypt.Cipher, v encrypt.Uint128) (EncryptedValueKindsU128, error)

func (ValueKindsU128Field) Eq 

func (f ValueKindsU128Field) Eq(ctx context.Context, c *encrypt.Cipher, v encrypt.Uint128) (encrypt.EqualityTerm, error)

func (ValueKindsU128Field) Gt 

func (f ValueKindsU128Field) Gt(ctx context.Context, c *encrypt.Cipher, v encrypt.Uint128) (encrypt.OpeTerm, error)

func (ValueKindsU128Field) Gte 

func (f ValueKindsU128Field) Gte(ctx context.Context, c *encrypt.Cipher, v encrypt.Uint128) (encrypt.OpeTerm, error)

func (ValueKindsU128Field) Lt 

func (f ValueKindsU128Field) Lt(ctx context.Context, c *encrypt.Cipher, v encrypt.Uint128) (encrypt.OpeTerm, error)

func (ValueKindsU128Field) Lte 

func (f ValueKindsU128Field) Lte(ctx context.Context, c *encrypt.Cipher, v encrypt.Uint128) (encrypt.OpeTerm, error)

type Visit 

type Visit struct {
	At    int64  `json:"at"`
	Place string `json:"place"`
}

Visit is one visit in a profile.

type Widened 

type Widened struct {
	Visits  uint8  `stash:"visits,encrypt_into=Integer"`
	Balance int    `stash:"balance,encrypt_into=Bigint"`
	Age     int16  `stash:"age,encrypt_into=IntegerEq"`
	Rank    uint32 `stash:"rank,encrypt_into=BigintEq"`
	Count   int64  `stash:"count,encrypt_into=IntegerEq"`
	// contains filtered or unexported fields
}

Widened stores Go integers of other widths in Profile's integer EQL types, under the same table and columns (ADR-0002): narrower ones that always fit, and a wider one gensupport range checks value by value. Its terms are the ones Profile's int32 and int64 fields store for the same values.

func DecryptWidened 

func DecryptWidened(ctx context.Context, d encrypt.Decrypter, encrypted []EncryptedWidened) ([]Widened, error)

DecryptWidened opens each EncryptedWidened, with one ZeroKMS request for each 500 sealed values, plus one the first time a keyset is used.

type WidenedAgeField 

type WidenedAgeField struct {
	// contains filtered or unexported fields
}

func (WidenedAgeField) Encrypt 

func (f WidenedAgeField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int16) (eql.IntegerEq, error)

func (WidenedAgeField) Eq 

func (f WidenedAgeField) Eq(ctx context.Context, c *encrypt.Cipher, v int16) (eql.IntegerEqQuery, error)

type WidenedBalanceField 

type WidenedBalanceField struct {
	// contains filtered or unexported fields
}

func (WidenedBalanceField) Encrypt 

func (f WidenedBalanceField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int) (eql.Bigint, error)

type WidenedCountField 

type WidenedCountField struct {
	// contains filtered or unexported fields
}

func (WidenedCountField) Encrypt 

func (f WidenedCountField) Encrypt(ctx context.Context, c *encrypt.Cipher, v int64) (eql.IntegerEq, error)

func (WidenedCountField) Eq 

func (f WidenedCountField) Eq(ctx context.Context, c *encrypt.Cipher, v int64) (eql.IntegerEqQuery, error)

type WidenedRankField 

type WidenedRankField struct {
	// contains filtered or unexported fields
}

func (WidenedRankField) Encrypt 

func (f WidenedRankField) Encrypt(ctx context.Context, c *encrypt.Cipher, v uint32) (eql.BigintEq, error)

func (WidenedRankField) Eq 

func (f WidenedRankField) Eq(ctx context.Context, c *encrypt.Cipher, v uint32) (eql.BigintEqQuery, error)

type WidenedVisitsField 

type WidenedVisitsField struct {
	// contains filtered or unexported fields
}

func (WidenedVisitsField) Encrypt 

func (f WidenedVisitsField) Encrypt(ctx context.Context, c *encrypt.Cipher, v uint8) (eql.Integer, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.