@@ -279,11 +279,56 @@ pub struct KeyValue {
279
279
#[ prost( int64, tag = "2" ) ]
280
280
pub version : i64 ,
281
281
/// Object value in bytes which is stored (in put) and fetched (in get).
282
- /// Clients must encrypt this blob client-side before sending it over the wire to server in order
283
- /// to preserve privacy and security.
282
+ /// Clients must encrypt the secret contents of this blob client-side before sending it over the
283
+ /// wire to the server in order to preserve privacy and security.
284
+ /// Clients may use a `Storable` object, serialize it and set it here.
284
285
#[ prost( bytes = "vec" , tag = "3" ) ]
285
286
pub value : :: prost:: alloc:: vec:: Vec < u8 > ,
286
287
}
288
+ /// Represents a storable object that can be serialized and stored as `value` in `PutObjectRequest`.
289
+ /// Only provided as a helper object for ease of use by clients.
290
+ /// Clients MUST encrypt the `PlaintextBlob` before using it as `data` in `Storable`.
291
+ /// The server does not use or read anything from `Storable`, Clients may use its fields as
292
+ /// required.
293
+ #[ allow( clippy:: derive_partial_eq_without_eq) ]
294
+ #[ derive( Clone , PartialEq , :: prost:: Message ) ]
295
+ pub struct Storable {
296
+ /// Represents an encrypted and serialized `PlaintextBlob`. MUST encrypt the whole `PlaintextBlob`
297
+ /// using client-side encryption before setting here.
298
+ #[ prost( bytes = "vec" , tag = "1" ) ]
299
+ pub data : :: prost:: alloc:: vec:: Vec < u8 > ,
300
+ /// Represents encryption related metadata
301
+ #[ prost( message, optional, tag = "2" ) ]
302
+ pub encryption_metadata : :: core:: option:: Option < EncryptionMetadata > ,
303
+ }
304
+ /// Represents encryption related metadata
305
+ #[ allow( clippy:: derive_partial_eq_without_eq) ]
306
+ #[ derive( Clone , PartialEq , :: prost:: Message ) ]
307
+ pub struct EncryptionMetadata {
308
+ /// The encryption algorithm used for encrypting the `PlaintextBlob`.
309
+ #[ prost( string, tag = "1" ) ]
310
+ pub cipher_format : :: prost:: alloc:: string:: String ,
311
+ /// The nonce used for encryption. Nonce is a random or unique value used to ensure that the same
312
+ /// plaintext results in different ciphertexts every time it is encrypted.
313
+ #[ prost( bytes = "vec" , tag = "2" ) ]
314
+ pub nonce : :: prost:: alloc:: vec:: Vec < u8 > ,
315
+ /// The authentication tag used for encryption. It provides integrity and authenticity assurance
316
+ /// for the encrypted data.
317
+ #[ prost( bytes = "vec" , tag = "3" ) ]
318
+ pub tag : :: prost:: alloc:: vec:: Vec < u8 > ,
319
+ }
320
+ /// Represents a data blob, which is encrypted, serialized and later used in `Storable.data`.
321
+ /// Since the whole `Storable.data` is client-side encrypted, the server cannot understand this.
322
+ #[ allow( clippy:: derive_partial_eq_without_eq) ]
323
+ #[ derive( Clone , PartialEq , :: prost:: Message ) ]
324
+ pub struct PlaintextBlob {
325
+ /// The unencrypted value.
326
+ #[ prost( bytes = "vec" , tag = "1" ) ]
327
+ pub value : :: prost:: alloc:: vec:: Vec < u8 > ,
328
+ /// The version of the value. Can be used by client to verify version integrity.
329
+ #[ prost( int64, tag = "2" ) ]
330
+ pub version : i64 ,
331
+ }
287
332
/// ErrorCodes to be used in `ErrorResponse`
288
333
#[ derive( Clone , Copy , Debug , PartialEq , Eq , Hash , PartialOrd , Ord , :: prost:: Enumeration ) ]
289
334
#[ repr( i32 ) ]
0 commit comments