From 25b2842ba2d4112203d9688b0c84cfec7b517ce9 Mon Sep 17 00:00:00 2001 From: cxymds Date: Fri, 4 Sep 2026 22:13:39 +0800 Subject: [PATCH] test(ecstore): stabilize sealed context encoding --- crates/ecstore/src/bucket/sealed_credentials.rs | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/crates/ecstore/src/bucket/sealed_credentials.rs b/crates/ecstore/src/bucket/sealed_credentials.rs index 392e40dd1..e6b487136 100644 --- a/crates/ecstore/src/bucket/sealed_credentials.rs +++ b/crates/ecstore/src/bucket/sealed_credentials.rs @@ -201,6 +201,12 @@ pub async fn unseal_secret(sealed: &SealedCredential, scope: &SealScope) -> Resu mod tests { use super::*; use parking_lot::Mutex; + use std::collections::BTreeMap; + + fn encode_context(context: &HashMap) -> String { + let ordered = context.iter().collect::>(); + serde_json::to_string(&ordered).expect("context serializes") + } /// Stands in for the KMS-backed sealer: records the context it was called /// with, and refuses a ciphertext presented under a different one. @@ -214,7 +220,7 @@ mod tests { async fn seal(&self, plaintext: &str, scope: &SealScope) -> Result { let context = scope.encryption_context(); self.sealed_contexts.lock().push(context.clone()); - let mut bound = serde_json::to_string(&context).expect("context serializes"); + let mut bound = encode_context(&context); bound.push('|'); bound.push_str(plaintext); Ok(SealedCredential { @@ -231,7 +237,7 @@ mod tests { .decode_to_vec(sealed.ct.as_bytes()) .map_err(|err| SealedCredentialError::Malformed(err.to_string()))?; let bound = String::from_utf8(raw).map_err(|err| SealedCredentialError::Malformed(err.to_string()))?; - let expected = serde_json::to_string(&scope.encryption_context()).expect("context serializes"); + let expected = encode_context(&scope.encryption_context()); bound .strip_prefix(&expected) .and_then(|rest| rest.strip_prefix('|'))