fix(stack-encrypt): refuse a NaN either way in read, and test the typed-field gaps

dynamic::read treated a NaN differently in its two float directions:
read(Float64, Float32(NaN)) returned Float64(NaN), while
read(Float32, Float64(NaN)) refused it, and the doc said "a NaN is never
exact". Converting a NaN is never exact, since it equals nothing, so both
directions now refuse it. A NaN already of the field's own float kind is
still returned as it is, like any value of the kind.

Tests for paths review found unpinned:

- decrypt with an index-only field before a typed field. Opened values
  are paired with the fields that have a ciphertext, not with every plan
  field; pairing with every field makes this test fail (checked), where
  every existing test passed.
- a typed "object" or "array" field round-trips, empty or not, and opens
  as its declared kind.
- check_record accepts a record sealed as another type (it cannot open
  the leaf to see the tag), and decrypt refuses it.
- a field spec with "type" before "outputs" parses and is checked the
  same way.
- read at the first float past each integer range (2^63, 2^64, 2^32) is
  refused and the last value inside converts exactly, so a saturating
  `f as u64` cast would fail.
- read refuses a NaN in both float directions.

The query-term test's variable is renamed from probe to query, the
glossary's word.

Author: coderdan

packages/stack-encrypt/src/dynamic/kind.rs

@@ -72,9 +72,10 @@ pub fn admits(kind: ValueKind, index: &IndexSpec) -> bool {
 /// width or kind is converted when the conversion is exact: an integer in
 /// range, or a float with no fractional part in range, for an integer kind
 /// (a JavaScript `34` arrives as a float); an integer or float the target
-/// float kind represents exactly, for a float kind. Nothing else converts:
-/// a string is never parsed as a number, and a number never becomes a
-/// string.
+/// float kind represents exactly, for a float kind. A NaN is never
+/// converted, in either float direction: it equals nothing, so no
+/// conversion of it is exact. Nothing else converts: a string is never
+/// parsed as a number, and a number never becomes a string.
 ///
 /// This is for a query: what a host hands over to search with. A value
 /// being sealed is not converted; it must already be of the field's kind,
@@ -163,19 +164,20 @@ impl Number {
     }
 
     /// The `f64` this number is exactly, if it is one: an integer whose
-    /// conversion does not round.
+    /// conversion does not round, or a float that is not a NaN. A NaN is
+    /// never exact, because it does not equal itself.
     fn exact_f64(self) -> Option<f64> {
         match self {
-            Number::Float(f) => Some(f),
+            Number::Float(f) => (!f.is_nan()).then_some(f),
             Number::Integer(i) => {
                 let f = i as f64;
                 (f as i128 == i).then_some(f)
             }
         }
     }
 
-    /// The `f32` this number is exactly, if it is one. A NaN is never
-    /// exact, because it does not equal itself.
+    /// The `f32` this number is exactly, if it is one. A NaN is refused by
+    /// `exact_f64` before it gets here.
     fn exact_f32(self) -> Option<f32> {
         let f = self.exact_f64()?;
         let narrowed = f as f32;
@@ -284,9 +286,14 @@ mod tests {
             let read = read_ok(kind, sample(kind)).expect("its own kind");
             assert!(kind.holds(&read));
         }
+        // Already of the kind: returned as it is, not converted, so a NaN
+        // the host sent as the field's own float kind is not refused here.
         assert!(
             matches!(read_ok(ValueKind::Float32, FfiValue::Float32(f32::NAN)), Some(FfiValue::Float32(f)) if f.is_nan())
         );
+        assert!(
+            matches!(read_ok(ValueKind::Float64, FfiValue::Float64(f64::NAN)), Some(FfiValue::Float64(f)) if f.is_nan())
+        );
     }
 
     #[test]
@@ -359,6 +366,34 @@ mod tests {
         }
     }
 
+    /// The first float past each integer range is refused, and the last
+    /// one inside it converts exactly. A float cast straight to the integer
+    /// type (`f as u64`) would saturate instead: a JavaScript 2^64 would
+    /// read as `u64::MAX` and derive a term for a different number.
+    #[test]
+    fn read_refuses_a_float_at_the_first_value_past_an_integer_range() {
+        let two_63 = 9_223_372_036_854_775_808.0_f64;
+        let two_64 = 18_446_744_073_709_551_616.0_f64;
+        assert!(read_ok(ValueKind::Int64, FfiValue::Float64(two_63)).is_none());
+        assert!(matches!(
+            read_ok(ValueKind::Int64, FfiValue::Float64(-two_63)),
+            Some(FfiValue::Int64(i64::MIN))
+        ));
+        assert!(read_ok(ValueKind::UInt64, FfiValue::Float64(two_64)).is_none());
+        assert!(matches!(
+            read_ok(
+                ValueKind::UInt64,
+                FfiValue::Float64(18_446_744_073_709_549_568.0)
+            ),
+            Some(FfiValue::UInt64(18_446_744_073_709_549_568))
+        ));
+        assert!(read_ok(ValueKind::UInt32, FfiValue::Float64(4_294_967_296.0)).is_none());
+        assert!(matches!(
+            read_ok(ValueKind::UInt32, FfiValue::Float64(4_294_967_295.0)),
+            Some(FfiValue::UInt32(u32::MAX))
+        ));
+    }
+
     #[test]
     fn read_converts_an_exactly_representable_number_to_a_float_kind() {
         assert!(
@@ -386,7 +421,6 @@ mod tests {
             (ValueKind::Float64, FfiValue::UInt64(u64::MAX)),
             (ValueKind::Float32, FfiValue::UInt32(16_777_217)),
             (ValueKind::Float32, FfiValue::Float64(0.1)),
-            (ValueKind::Float32, FfiValue::Float64(f64::NAN)),
         ];
         for (at, (kind, value)) in refused.into_iter().enumerate() {
             assert!(
@@ -396,6 +430,20 @@ mod tests {
         }
     }
 
+    /// A NaN converts in neither float direction: it equals nothing, so no
+    /// conversion of it is exact, and a query for one could match nothing.
+    #[test]
+    fn read_refuses_a_nan_in_both_float_directions() {
+        assert!(matches!(
+            read(ValueKind::Float32, FfiValue::Float64(f64::NAN)),
+            Err(Error::Source)
+        ));
+        assert!(matches!(
+            read(ValueKind::Float64, FfiValue::Float32(f32::NAN)),
+            Err(Error::Source)
+        ));
+    }
+
     #[test]
     fn read_never_converts_across_kinds() {
         let refused = [

packages/stack-encrypt/src/dynamic/record.rs

@@ -2352,6 +2352,32 @@ mod tests {
             );
         }
 
+        /// The parser applies `"type"` after it has read every key, so a
+        /// spec that declares its type before its outputs is checked the
+        /// same way: admitted when the type admits the indexes, refused
+        /// when it does not.
+        #[test]
+        fn the_plan_reads_a_type_given_before_the_outputs() {
+            let early = |ty: &str| {
+                obj(vec![
+                    ("type", s(ty)),
+                    ("outputs", strings(&["c", "eq"])),
+                    ("context", s("users/age")),
+                ])
+            };
+            let parsed = plan(obj(vec![("age", early("uint64"))])).expect("parses");
+            assert_eq!(parsed.fields()[0].field_type(), Some(ValueKind::UInt64));
+            assert_eq!(
+                parsed.fields()[0].outputs(),
+                [Output::Ciphertext, Output::Term(IndexSpec::Equality)]
+            );
+            let refused = plan(obj(vec![("age", early("float64"))]));
+            assert!(
+                matches!(refused, Err(Error::Plan)),
+                "equality on a float is refused whatever the key order: {refused:?}"
+            );
+        }
+
         #[test]
         fn the_plan_refuses_an_unresolvable_type_or_one_that_does_not_admit_an_index() {
             let refused: [(&str, FfiValue); 8] = [
@@ -2552,15 +2578,103 @@ mod tests {
             let value =
                 crate::dynamic::read(declared, FfiValue::Float64(34.0)).expect("an exact 34");
             let scalar = Scalar::of(&value, &IndexSpec::Equality).expect("scalar");
-            let probe = term(
+            let query = term(
                 &keyset,
                 scalar,
                 &IndexSpec::Equality,
                 field.view().expect("view"),
             )
             .await
-            .expect("probe");
-            assert_eq!(probe, stored);
+            .expect("query term");
+            assert_eq!(query, stored);
+        }
+
+        /// An index-only field has no ciphertext, so it is not among the
+        /// opened values. The typed field after it is checked against its
+        /// own type, not against the index-only field's.
+        #[tokio::test]
+        async fn decrypt_skips_an_index_only_field_when_it_checks_types() {
+            let cipher = cipher().await;
+            let keyset = cipher.default_keyset();
+            let plan = plan(obj(vec![
+                ("age", typed("users/age", &["eq"], "uint64")),
+                ("name", typed("users/name", &["c"], "string")),
+            ]))
+            .expect("plan");
+            let sealed = encrypt(
+                &keyset,
+                obj(vec![("age", FfiValue::UInt64(34)), ("name", s("bob"))]),
+                &plan,
+            )
+            .await
+            .expect("seal");
+            let opened = object(
+                decrypt(Scope::Client(&cipher), sealed, &plan)
+                    .await
+                    .expect("name is checked as a string, not as a uint64"),
+            );
+            assert_eq!(keys(&opened), ["name"]);
+            assert_eq!(text_of(&opened[0].1), "bob");
+        }
+
+        /// A typed composite field opens as its declared kind, with its
+        /// entries, including when it is empty: an empty `[]` that opened
+        /// as `{}` would fail every read of an `"array"` field.
+        #[tokio::test]
+        async fn a_typed_composite_field_round_trips_even_when_empty() {
+            let cipher = cipher().await;
+            let keyset = cipher.default_keyset();
+            for (ty, value, len) in [
+                ("object", obj(vec![("home", s("a@x"))]), 1),
+                ("object", FfiValue::Object(vec![]), 0),
+                (
+                    "array",
+                    FfiValue::Array(vec![s("a"), FfiValue::UInt32(1)]),
+                    2,
+                ),
+                ("array", FfiValue::Array(vec![]), 0),
+            ] {
+                let plan = plan(obj(vec![("doc", typed("users/doc", &["c"], ty))])).expect("plan");
+                let sealed = encrypt(&keyset, obj(vec![("doc", value)]), &plan)
+                    .await
+                    .expect("seal");
+                let opened = decrypt(Scope::Client(&cipher), sealed, &plan)
+                    .await
+                    .expect("a composite opens as its declared kind");
+                let (_, doc) = object(opened).into_iter().next().expect("doc");
+                match (ty, doc) {
+                    ("object", FfiValue::Object(entries)) => assert_eq!(entries.len(), len),
+                    ("array", FfiValue::Array(items)) => assert_eq!(items.len(), len),
+                    (ty, _) => panic!("a {ty} field opened as another kind"),
+                }
+            }
+        }
+
+        /// `check_record` does not open anything, so it cannot see a
+        /// typed field's type: the tag is inside the AEAD envelope. A record
+        /// sealed as another type passes it, and only `decrypt` refuses it.
+        #[tokio::test]
+        async fn check_record_accepts_a_record_sealed_as_another_type() {
+            let cipher = cipher().await;
+            let keyset = cipher.default_keyset();
+            let untyped = plan(obj(vec![("age", spec(s("users/age"), &["c"]))])).expect("plan");
+            let as_uint64 =
+                plan(obj(vec![("age", typed("users/age", &["c"], "uint64"))])).expect("plan");
+
+            let sealed = encrypt(&keyset, obj(vec![("age", FfiValue::UInt32(34))]), &untyped)
+                .await
+                .expect("seal");
+            check_record(sealed, &as_uint64).expect("the type is not visible without opening");
+
+            let sealed = encrypt(&keyset, obj(vec![("age", FfiValue::UInt32(34))]), &untyped)
+                .await
+                .expect("seal");
+            let result = decrypt(Scope::Client(&cipher), sealed, &as_uint64).await;
+            assert!(
+                matches!(result, Err(Error::Record)),
+                "decrypt is where the type is checked: {:?}",
+                result.err()
+            );
         }
     }
 }