test(golang): host refusals around a target field, and a tampered EQL value

Review of #1095: the errNoEQL branch in Open and the two field-selection
refusals in Query ran in no test, and no Go test opened a changed EQL
value. Over the uninitialised guest, Open refuses a target field with no
EQL value, with a ciphertext where the value should be, and missing,
naming the field before the guest is asked; Query refuses a field the plan
does not have and a field that names no EQL type the same way. Over the
deterministic eql build, a TextEq value moved to another column does not
open, bytes that are not a TextEq (an empty object, non-JSON, a query
value) are ErrEncoding, a flipped ciphertext byte fails authentication,
and the untouched value still opens.

Claude-Session: https://claude.ai/code/session_01V3WFXwax4J3uecpFEJ6yHc

Author: coderdan

languages/golang/encrypt/eql_test.go

@@ -189,6 +189,82 @@ func TestTextEqQueryMatchesTheStoredValueAndTheRustFixture(t *testing.T) {
 	}
 }
 
+// A stored EQL value changed before it is opened: moved to another column,
+// or replaced with bytes that are not a TextEq. Neither opens, and the
+// second is refused as malformed input before any key is retrieved.
+func TestATamperedEQLValueDoesNotOpen(t *testing.T) {
+	c := deterministicEQLClient(t)
+	ctx := context.Background()
+	cipher := c.DefaultKeyset()
+
+	moved, err := testusers.EncryptContact(ctx, cipher, contacts[:1])
+	if err != nil {
+		t.Fatal(err)
+	}
+	original := moved[0].Email
+	moved[0].Email = eql.TextEq(bytes.Replace(original, []byte(`"c":"email"`), []byte(`"c":"notes"`), 1))
+	if bytes.Equal(moved[0].Email, original) {
+		t.Fatal("the stored identifier was not where the test expected it")
+	}
+	if _, err := testusers.DecryptContact(ctx, cipher, moved); err == nil {
+		t.Fatal("an EQL value moved to another column opened")
+	}
+
+	junk, err := testusers.EncryptContact(ctx, cipher, contacts[:1])
+	if err != nil {
+		t.Fatal(err)
+	}
+	for name, value := range map[string]eql.TextEq{
+		"an empty object": eql.TextEq(`{}`),
+		"not JSON":        eql.TextEq(`not json`),
+		"a query value":   eql.TextEq(`{"v":3,"i":{"t":"users","c":"email"},"hm":"00"}`),
+	} {
+		junk[0].Email = value
+		if _, err := testusers.DecryptContact(ctx, cipher, junk); !errors.Is(err, encrypt.ErrEncoding) {
+			t.Errorf("%s: Decrypt = %v, want ErrEncoding", name, err)
+		}
+	}
+
+	// One flipped byte in the ciphertext inside the value: authenticated,
+	// so it does not open; the untouched value still does.
+	flipped, err := testusers.EncryptContact(ctx, cipher, contacts[:1])
+	if err != nil {
+		t.Fatal(err)
+	}
+	var doc map[string]json.RawMessage
+	if err := json.Unmarshal(flipped[0].Email, &doc); err != nil {
+		t.Fatal(err)
+	}
+	var ct string
+	if err := json.Unmarshal(doc["c"], &ct); err != nil {
+		t.Fatal(err)
+	}
+	last := []byte(ct)
+	if last[len(last)-2] == 'A' {
+		last[len(last)-2] = 'B'
+	} else {
+		last[len(last)-2] = 'A'
+	}
+	doc["c"], _ = json.Marshal(string(last))
+	tampered, _ := json.Marshal(doc)
+	flipped[0].Email = eql.TextEq(tampered)
+	if _, err := testusers.DecryptContact(ctx, cipher, flipped); err == nil {
+		t.Fatal("a tampered ciphertext opened")
+	}
+	if _, err := testusers.DecryptContact(ctx, cipher, contactsSealed(t, ctx, cipher)); err != nil {
+		t.Fatalf("the untouched value no longer opens: %v", err)
+	}
+}
+
+func contactsSealed(t *testing.T, ctx context.Context, cipher *encrypt.Cipher) []testusers.EncryptedContact {
+	t.Helper()
+	sealed, err := testusers.EncryptContact(ctx, cipher, contacts[:1])
+	if err != nil {
+		t.Fatal(err)
+	}
+	return sealed
+}
+
 func TestTextEqIsRefusedByTheBuildWithoutEQLTypes(t *testing.T) {
 	ctx := context.Background()
 	plain, err := encrypt.PlainGuest()

languages/golang/encrypt/guest_test.go

@@ -597,6 +597,41 @@ func fixtureRecord() record.Sealed {
 
 // A record opened under a plan that seals a field it does not carry is
 // refused on the host, with the field named, before the guest is asked.
+// A record whose target field has no EQL value is refused by the host,
+// before the guest sees it: the errNoEQL branch, which a change could
+// otherwise drop and send a malformed record on.
+func TestTargetWithoutEQLIsRefusedBeforeTheGuest(t *testing.T) {
+	ctx := context.Background()
+	c := rawInstance(t)
+	plan := &record.Plan{
+		Context: []string{"users"},
+		Fields:  []record.Field{{Name: "email", Kind: record.String, Target: "TextEq"}},
+	}
+	for name, rec := range map[string]record.Sealed{
+		"no outputs": {"email": {}},
+		"a ciphertext where the EQL value should be": {"email": {Ciphertext: fixtureLeaf}},
+		"the field missing":                          {},
+	} {
+		_, err := c.DefaultKeyset().Open(ctx, plan, []record.Sealed{rec})
+		if !errors.Is(err, errNoEQL) || errors.Is(err, ErrState) || !strings.Contains(err.Error(), `field "email"`) {
+			t.Errorf("%s: Open = %v, want errNoEQL before the guest, naming the field", name, err)
+		}
+	}
+}
+
+// Query refuses a field the plan does not have, and a field that names no
+// EQL type, before the guest is asked.
+func TestQueryRejectsMissingAndNonTargetFieldsBeforeTheGuest(t *testing.T) {
+	ctx := context.Background()
+	c := rawInstance(t)
+	for _, field := range []string{"email", "missing"} {
+		_, err := c.DefaultKeyset().Query(ctx, usersPlan(), field, "a@b.c")
+		if !errors.Is(err, ErrEncoding) || errors.Is(err, ErrState) || !strings.Contains(err.Error(), field) {
+			t.Errorf("Query(%q) = %v, want ErrEncoding before the guest, naming the field", field, err)
+		}
+	}
+}
+
 func TestMismatchedPlanIsRefusedBeforeTheGuest(t *testing.T) {
 	ctx := context.Background()
 	c := rawInstance(t)