- Splitting the encryption/decryption process into separate methods for level and value bytes.

- Updating the basic encryptor to encrypt/decrypt value lists
- Updated the encryption sequencer to split/join the value+level bytes explicitly.

Author: avalerio-tkd

src/server/encryption_sequencer.cpp

@@ -48,15 +48,10 @@ static std::unique_ptr<DBPSEncryptor> CreateEncryptor(
     const std::string& key_id,
     const std::string& column_name,
     const std::string& user_id,
-    const std::string& application_context,
-    const std::string& encryptor_type) {
+    const std::string& application_context) {
 
     // Return a BasicEncryptor instance.
-    if (encryptor_type == "basic") {
-        return std::make_unique<BasicEncryptor>(key_id, column_name, user_id, application_context);
-    }
-    // TODO: Add other encryptor types here (e.g., ProtegrityEncryptor).
-    throw DBPSUnsupportedException("Unsupported encryptor type: " + encryptor_type);
+    return std::make_unique<BasicEncryptor>(key_id, column_name, user_id, application_context);
 }
 
 // Constructor implementation
@@ -83,7 +78,34 @@ DataBatchEncryptionSequencer::DataBatchEncryptionSequencer(
     user_id_(user_id),
     application_context_(application_context),
     encryption_metadata_(encryption_metadata),
-    encryptor_(CreateEncryptor(key_id, column_name, user_id, application_context, "basic")) {}
+    encryptor_(CreateEncryptor(key_id, column_name, user_id, application_context)) {}
+
+// Constructor with pre-built encryptor
+DataBatchEncryptionSequencer::DataBatchEncryptionSequencer(
+    const std::string& column_name,
+    Type::type datatype,
+    const std::optional<int>& datatype_length,
+    CompressionCodec::type compression,
+    Format::type format,
+    const std::map<std::string, std::string>& encoding_attributes,
+    CompressionCodec::type encrypted_compression,
+    const std::string& key_id,
+    const std::string& user_id,
+    const std::string& application_context,
+    const std::map<std::string, std::string>& encryption_metadata,
+    std::unique_ptr<DBPSEncryptor> encryptor
+) : column_name_(column_name),
+    datatype_(datatype),
+    datatype_length_(datatype_length),
+    compression_(compression),
+    format_(format),
+    encoding_attributes_(encoding_attributes),
+    encrypted_compression_(encrypted_compression),
+    key_id_(key_id),
+    user_id_(user_id),
+    application_context_(application_context),
+    encryption_metadata_(encryption_metadata),
+    encryptor_(std::move(encryptor)) {}
 
 // Top level encryption/decryption methods.
 
@@ -108,11 +130,13 @@ bool DataBatchEncryptionSequencer::ConvertAndEncrypt(const std::vector<uint8_t>&
         // Parse value bytes into typed list
         auto typed_list = ParseValueBytesIntoTypedList(value_bytes, datatype_, datatype_length_, format_);
 
-        // Encrypt the typed list and level bytes
-        auto encrypted_bytes = encryptor_->EncryptValueList(typed_list, level_bytes);
+        // Encrypt the typed list and level bytes, then join them into a single encrypted byte vector.
+        auto encrypted_value_bytes = encryptor_->EncryptValueList(typed_list);
+        auto encrypted_level_bytes = encryptor_->EncryptBlock(level_bytes);
+        auto joined_encrypted_bytes = JoinWithLengthPrefix(encrypted_level_bytes, encrypted_value_bytes);
 
-        // Compress the encrypted bytes
-        encrypted_result_ = Compress(encrypted_bytes, encrypted_compression_);
+        // Compress the joined encrypted bytes
+        encrypted_result_ = Compress(joined_encrypted_bytes, encrypted_compression_);
 
     } catch (const DBPSUnsupportedException& e) {
         // If any stage is as of yet unsupported, default to whole payload (per-block) encryption
@@ -175,13 +199,15 @@ bool DataBatchEncryptionSequencer::ConvertAndDecrypt(const std::vector<uint8_t>&
         // Decompress the encrypted bytes
         auto decompressed_encrypted_bytes = Decompress(ciphertext, encrypted_compression_);
 
-        // Decrypt the typed list and level bytes
-        auto [typed_list, level_bytes] = encryptor_->DecryptValueList(decompressed_encrypted_bytes);
+        // Split the joined encrypted bytes, then decrypt the level and value bytes separately.
+        auto [encrypted_level_bytes, encrypted_value_bytes] = SplitWithLengthPrefix(decompressed_encrypted_bytes);
+        auto level_bytes = encryptor_->DecryptBlock(encrypted_level_bytes);
+        auto typed_list = encryptor_->DecryptValueList(encrypted_value_bytes);
 
-        // Convert typed list back to value bytes
+        // Convert the decrypted typed list back to value bytes
         auto value_bytes = GetTypedListAsValueBytes(typed_list, datatype_, datatype_length_, format_);
 
-        // Join level and value bytes and compress to get plaintext
+        // Join the decrypted level and value bytes, then compress to get plaintext
         decrypted_result_ = CompressAndJoin(level_bytes, value_bytes);
     }
 

src/server/encryption_sequencer.h

@@ -79,6 +79,22 @@ class DataBatchEncryptionSequencer {
         const std::map<std::string, std::string>& encryption_metadata
     );
 
+    // Constructor with pre-built encryptor (for dependency injection)
+    DataBatchEncryptionSequencer(
+        const std::string& column_name,
+        Type::type datatype,
+        const std::optional<int>& datatype_length,
+        CompressionCodec::type compression,
+        Format::type format,
+        const std::map<std::string, std::string>& encoding_attributes,
+        CompressionCodec::type encrypted_compression,
+        const std::string& key_id,
+        const std::string& user_id,
+        const std::string& application_context,
+        const std::map<std::string, std::string>& encryption_metadata,
+        std::unique_ptr<DBPSEncryptor> encryptor
+    );
+    
     // Default constructor
     DataBatchEncryptionSequencer() = default;
 

src/server/encryptors/basic_encryptor.cpp

@@ -48,30 +48,29 @@ std::vector<uint8_t> BasicEncryptor::DecryptBlock(const std::vector<uint8_t>& da
 }
 
 std::vector<uint8_t> BasicEncryptor::EncryptValueList(
-    const TypedListValues& typed_list,
-    const std::vector<uint8_t>& level_bytes) {
-    
+    const TypedListValues& typed_list) {
+
     // Printout the typed list.
     auto print_result = PrintTypedList(typed_list);
     if (print_result.length() > 1000) {
-        std::cout << "Encrypt value - Decoded plaintext data (first 1000 chars):\n" 
-                << print_result.substr(0, 1000) << "...";
+        std::cout << "Encrypt value - Decoded plaintext data (first 1000 chars):\n"
+                  << print_result.substr(0, 1000) << "...";
     } else {
         std::cout << "Encrypt value - Decoded plaintext data:\n" << print_result;
     }
 
     // Printout the additional context parameters.
     std::cout << "Context parameters:\n"
-        << "  column_name: " << column_name_ << "\n"
-        << "  user_id: " << user_id_ << "\n"
-        << "  key_id: " << key_id_ << "\n"
-        << "  application_context: " << application_context_ << "\n"
-        << std::endl;
+              << "  column_name: " << column_name_ << "\n"
+              << "  user_id: " << user_id_ << "\n"
+              << "  key_id: " << key_id_ << "\n"
+              << "  application_context: " << application_context_ << "\n"
+              << std::endl;
 
     throw DBPSUnsupportedException("EncryptTypedList not implemented");
 }
 
-std::pair<TypedListValues, std::vector<uint8_t>> BasicEncryptor::DecryptValueList(
+TypedListValues BasicEncryptor::DecryptValueList(
     const std::vector<uint8_t>& encrypted_bytes) {
 
     throw DBPSUnsupportedException("DecryptTypedList not implemented");

src/server/encryptors/basic_encryptor.h

@@ -59,10 +59,9 @@ class DBPS_EXPORT BasicEncryptor : public DBPSEncryptor {
 
     // Value encryption methods
     std::vector<uint8_t> EncryptValueList(
-        const TypedListValues& typed_list,
-        const std::vector<uint8_t>& level_bytes) override;
+        const TypedListValues& typed_list) override;
 
-    std::pair<TypedListValues, std::vector<uint8_t>> DecryptValueList(
+    TypedListValues DecryptValueList(
         const std::vector<uint8_t>& encrypted_bytes) override;
 };
 

src/server/encryptors/basic_encryptor_test.cpp

@@ -54,12 +54,11 @@ TEST(BasicEncryptor, EncryptBlock_DifferentKeys) {
 
 TEST(BasicEncryptor, EncryptValueList_ThrowsException) {
     BasicEncryptor encryptor("test_key", "test_column", "test_user", "test_context");
-    
+
     std::vector<int32_t> values = {1, 2, 3};
     TypedListValues typed_list = values;
-    std::vector<uint8_t> level_bytes = {0, 1, 0};
-    
-    EXPECT_THROW(encryptor.EncryptValueList(typed_list, level_bytes), DBPSUnsupportedException);
+
+    EXPECT_THROW(encryptor.EncryptValueList(typed_list), DBPSUnsupportedException);
 }
 
 TEST(BasicEncryptor, DecryptValueList_ThrowsException) {

src/server/encryptors/dbps_encryptor.h

@@ -85,35 +85,27 @@ class DBPS_EXPORT DBPSEncryptor {
      * The context-rich encryptor can use the additional parameters stored in the constructor:
      *    column_name, user_id, key_id, application_context.
      * 
-     * This method encrypts individual values from a typed list (e.g., integers, floats, strings)
-     * along with associated level bytes. The encrypted result combines both the encrypted
-     * typed list values and level bytes into a single encrypted byte vector.
-     * 
-     * Both the level_bytes AND list of values need to be encrypted and combined as a single encrypted
-     * vector of bytes.
+     * This method encrypts individual values from a typed list (e.g., integers, floats, strings).
      * 
      * @param typed_list The typed list of values to encrypt (variant type supporting multiple data types)
-     * @param level_bytes The level bytes associated with the typed list
-     * @return The encrypted data as a vector of bytes containing both encrypted typed list and level bytes
+     * @return The encrypted data as a vector of bytes containing the encrypted typed list values
      * @throws InvalidInputException if the input data is invalid or empty
      * @throws DBPSUnsupportedException if the encryption operation is not supported
      */
     virtual std::vector<uint8_t> EncryptValueList(
-        const TypedListValues& typed_list,
-        const std::vector<uint8_t>& level_bytes) = 0;
+        const TypedListValues& typed_list) = 0;
 
     /**
      * Integration point: Decryption function based on encrypted bytes that will be implemented by Protegrity.
      * 
-     * This method decrypts the encrypted byte vector back into its constituent parts:
-     * a typed list of values and associated level bytes.
+     * This method decrypts the encrypted byte vector containing only the typed list values.
      * 
-     * @param encrypted_bytes The encrypted data as a vector of bytes
-     * @return A pair containing the decrypted TypedListValues and level_bytes
+     * @param encrypted_bytes The encrypted data as a vector of bytes containing only the encrypted typed list
+     * @return The decrypted TypedListValues
      * @throws InvalidInputException if the input data is invalid, empty, or corrupted
      * @throws DBPSUnsupportedException if the decryption operation is not supported
      */
-    virtual std::pair<TypedListValues, std::vector<uint8_t>> DecryptValueList(
+    virtual TypedListValues DecryptValueList(
         const std::vector<uint8_t>& encrypted_bytes) = 0;
 
 protected: