Skip to content

Searchable encrypted JSON arrays: implement counted-container semantics #976

Open
0 of 2 issues completed

Description

@tobyhede

Searchable encrypted JSON arrays in EQL v3 need a coherent container model so
path queries, array length, and array element access agree for populated and
empty arrays.

The selected direction keeps the flat searchable-vector encoding and gives an
array container an authenticated selector for its elements. Query-time array
operations gather sibling elements through that selector instead of inferring
array shape from an entry flag.

Required behaviour

  • Path queries aggregate array matches into one array result.
  • Empty arrays produce an empty result and length zero without a null loop bound.
  • The element selector is authenticated and included in inbound metadata
    comparison so a stored container cannot be repointed silently.
  • The obsolete entry-level array marker is removed from the wire contract.
  • Nested-array limitations and the resulting length, equality-partition, and
    ordering disclosure are documented explicitly.
  • SQL, client, proxy, fixtures, and cross-side conformance tests land as one
    coordinated breaking change.

Sequencing

First drop STRICT from the full jsonb_path_* family —
jsonb_path_query, jsonb_path_exists, and jsonb_path_query_first — to
restore SQL function inlining, then land the array aggregation and coordinated wire changes.
Regression coverage must include
real populated and empty arrays rather than only hand-built array documents.

Activity

  1. coderdan commented on Oct 21, 2026

    @coderdan
    Contributor

    For reference against the EQL v4 json_tree family (#1288, #1325, #1329), which takes a different container model and does not inherit this one.

    In json_tree an array is a node like any other: its own entry holds, under encryption, its kind, its child count and its label, and every element has an entry of its own addressed from the array's token by ordinal. There is no entry-level array marker and no shared element selector to authenticate. Array length is eql_v4.json_tree_child_count(doc, token), which counts the elements the walk finds; element access is json_tree_children or a gated json_tree_subtree_at; and the client reassembles a gathered array from the rows (it reads each node's child count from its ciphertext). Empty arrays are a node with child count zero and no element entries, so length is zero and the element functions return no rows without a null bound.

    The nested-array limitations and the disclosure this issue asks to document are recorded for v4 in the design doc's leakage table (docs/plans/2026-10-17-json-index-stack-encrypt-spike.md): array lengths are not visible at rest, element grouping is (bounded to array elements, through the containment projection).

    None of this changes v3; the v3 container model here is still open on its own terms.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions