Merge branch 'main' into overtrue/fix/lifecycle-rule-validation

crates/ecstore/src/bucket/sealed_credentials.rs

@@ -28,7 +28,7 @@
 
 use async_trait::async_trait;
 use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
+use std::collections::BTreeMap;
 use std::fmt;
 use std::sync::{Arc, OnceLock};
 
@@ -81,8 +81,8 @@ impl SealScope {
     /// The encryption context handed to the sealer. Keys are stable: they are
     /// part of the on-disk contract, because a ciphertext only decrypts under
     /// the same context.
-    pub fn encryption_context(&self) -> HashMap<String, String> {
-        HashMap::from([
+    pub fn encryption_context(&self) -> BTreeMap<String, String> {
+        BTreeMap::from([
             ("rustfs:store".to_string(), self.store.as_str().to_string()),
             ("rustfs:owner".to_string(), self.owner.clone()),
             ("rustfs:field".to_string(), self.field.to_string()),
@@ -201,12 +201,18 @@ pub async fn unseal_secret(sealed: &SealedCredential, scope: &SealScope) -> Resu
 mod tests {
     use super::*;
     use parking_lot::Mutex;
+    use std::collections::BTreeMap;
+
+    fn encode_context(context: &HashMap<String, String>) -> String {
+        let ordered = context.iter().collect::<BTreeMap<_, _>>();
+        serde_json::to_string(&ordered).expect("context serializes")
+    }
 
     /// Stands in for the KMS-backed sealer: records the context it was called
     /// with, and refuses a ciphertext presented under a different one.
     #[derive(Default)]
     struct FakeSealer {
-        sealed_contexts: Mutex<Vec<HashMap<String, String>>>,
+        sealed_contexts: Mutex<Vec<BTreeMap<String, String>>>,
     }
 
     #[async_trait]
@@ -214,7 +220,7 @@ mod tests {
         async fn seal(&self, plaintext: &str, scope: &SealScope) -> Result<SealedCredential, SealedCredentialError> {
             let context = scope.encryption_context();
             self.sealed_contexts.lock().push(context.clone());
-            let mut bound = serde_json::to_string(&context).expect("context serializes");
+            let mut bound = encode_context(&context);
             bound.push('|');
             bound.push_str(plaintext);
             Ok(SealedCredential {
@@ -231,7 +237,7 @@ mod tests {
                 .decode_to_vec(sealed.ct.as_bytes())
                 .map_err(|err| SealedCredentialError::Malformed(err.to_string()))?;
             let bound = String::from_utf8(raw).map_err(|err| SealedCredentialError::Malformed(err.to_string()))?;
-            let expected = serde_json::to_string(&scope.encryption_context()).expect("context serializes");
+            let expected = encode_context(&scope.encryption_context());
             bound
                 .strip_prefix(&expected)
                 .and_then(|rest| rest.strip_prefix('|'))