feat(stack-encrypt-derive): all outputs of a plaintext record share the caller's context

A field-level `#[stash(context = "..")]` is now a compile error on every
derive form, not only on `struct` derives. A one-value plan has exactly
one context source, the caller's, so a `plaintext = T` record whose
outputs sit under two different contexts (a ciphertext under the
caller's context beside a second one under a literal of its own) has no
plan form. The derive is about to emit the plan, so it can say only what
the plan can say. The error says that all outputs of a `plaintext = T`
record share the caller's context, and that writing one value under two
contexts is a fields plan that picks the same source twice.

With the literal gone, only a `struct` derive's fields carry a context of
their own, and such a record always takes `DeclaredContext`. So the
`extend` path for an own context beside a caller-context field, and the
`context_type`-versus-all-literal-fields refusal, are unreachable and are
removed.

Tests: `Doubled` keeps proving that `#[stash(decrypt)]` chooses between
two ciphertexts, now both under the caller's context. `WrappedUser`
takes the caller's context instead of a literal and derives the same
inner term bytes. `AuditedAge` and `PinnedAge` are deleted: what they
proved was how a literal-context leaf mixes with caller-context fields,
which no longer exists. trybuild: `field_context_removed` covers the
three derive forms; `struct_field_context` and
`non_plain_literal_context` are folded into it.

Author: coderdan

docs/target-directed-encryption.md

@@ -196,7 +196,8 @@ name, which two types can share and a refactor can change. `#[stash(from = ..)]`
 reads a field from a differently named plaintext field, and
 `#[stash(identity = "..")]` pins the label segment, so the field is keyed under
 `<context>/<identity>`. A field's context is always its record's context plus
-its identity: no field escapes it, and a literal context is one plain segment.
+its identity: no field escapes it. No field takes a literal context of its own,
+on any derive: every output of a `plaintext = T` record shares the caller's.
 A field whose type is itself a record is an ordinary field: it is sealed under
 `<context>/<field>`, and its own contexts are extended by that pair. A struct
 derive takes one output per plaintext field; to store several terms from one
@@ -257,7 +258,7 @@ vitaminc already has the generic notion, twice — `Aad<'a>` (aead) and `PrfCont
 
 Context is threaded **per value**, as an argument. It is not baked into the cipher.
 
-Whether the *caller* owes one is decided by the target type, at compile time. `Ctx` is a parameter of `EncryptFrom` so that each impl can bound it: a leaf is implemented for `NonEmpty<T>` alone, because it has nothing else to authenticate under and `()` is the empty context it must never derive under; a derived record is implemented twice — for `()`, deriving each field under the context it carries itself (the one a `struct = ..` derive infers, `<context>/<identity>`, or a plain-segment literal), and for `NonEmpty<T>`, deriving each field under that context *extended* with the caller's (`("users/age", id)`), or under the caller's as it is for a field with none. No record accepts a context and then discards it. `encrypt_into(&cipher)` passes `()` and therefore compiles only for outputs whose every leaf has a context of its own; everything else takes `encrypt_into_with_context`, and such an output takes that too when the caller has something to add, a record id say, so a field is bound to its record as well as its name. This is vitaminc's `encrypt` / `encrypt_with_aad` split, with the choice made by the type rather than at every call site.
+Whether the *caller* owes one is decided by the target type, at compile time. `Ctx` is a parameter of `EncryptFrom` so that each impl can bound it: a leaf is implemented for `NonEmpty<T>` alone, because it has nothing else to authenticate under and `()` is the empty context it must never derive under; a derived record is implemented twice — for `()`, deriving each field under the context it carries itself (the one a `struct = ..` derive infers, `<context>/<identity>`), and for `NonEmpty<T>`, deriving each field under that context *extended* with the caller's (`("users/age", id)`), or under the caller's as it is for a field with none (every field of a `plaintext = T` record). No record accepts a context and then discards it. `encrypt_into(&cipher)` passes `()` and therefore compiles only for outputs whose every leaf has a context of its own; everything else takes `encrypt_into_with_context`, and such an output takes that too when the caller has something to add, a record id say, so a field is bound to its record as well as its name. This is vitaminc's `encrypt` / `encrypt_with_aad` split, with the choice made by the type rather than at every call site.
 
 A scoped cipher (`cipher.for_column("users", "age")`) was considered and rejected: it makes encrypting one record — several fields, several identifiers — into several scoped ciphers, which fights batching for no gain. With context as an argument, a record is one shared `&cipher`, many contexts, one flush.
 

packages/stack-encrypt-derive/docs/attributes.md

@@ -28,25 +28,30 @@ literal.
 
 | Attribute | Effect |
 |---|---|
-| `context_field` | Store the caller’s typed context here and recover it on decryption. Exactly one per record; excludes the other field attributes and literal contexts. |
-| `context = "..."` | With a `plaintext` record only: derive this field under exactly this context, extended by the one the caller passes for the record like any other. A query-side term built under the same literal — extended the same way — matches it. One plain segment (`"email"`, not `"users/email"`), as a plan's context segments are. Refused on a field of a `struct` derive, which sits under the record's context: use `identity`. |
+| `context_field` | Store the caller’s typed context here and recover it on decryption. Exactly one per record; excludes the other field attributes. |
 | `identity = "..."` | With `struct` only: key this field under the segment `identity` instead of the plaintext field's name, so it is derived under `("<context>", "<identity>")`. One plain segment. The plan builder's `.identity(segment)`. |
 | `from = field` / `from = 0` | With `struct` only: derive this field from `plaintext.field` (or `plaintext.0` for a tuple struct) when its name differs from its plaintext field's. A plaintext field has one output: two fields `from` one plaintext field are refused (a ciphertext with its terms is one `Encrypted<Terms>` field). |
 | `default` / `default = expr` | Not derived: filled with `Default::default()` or `expr`. Never encrypted, never authenticated. |
 | `decrypt` | Decryption opens this field (`DecryptInto` only). Needed only when the field types cannot decide it — see below. |
 
+A field takes no `context = ".."` of its own, on any derive: it is a compile
+error. A plan has exactly one context source, and every output sits under it.
+All outputs of a `plaintext = T` record share the caller's context; every
+field of a `struct` derive sits under the record's (`identity` keys it under
+another segment of it). Writing one value under two different contexts, a
+dual write, is a fields plan that picks the same source twice, not a derive.
+
 Each derive emits one declaration per plaintext, with an associated `Context`.
 A record with `#[stash(context_field)]` on a field of type `T` requires
 `NonEmpty<T>` for encryption and stores its inner value in that field. Decryption
 takes `ExpectedContext<T>`. Its default checks only that the stored value is nonempty and then opens the record under whatever context it stores — so a ciphertext moved together with its stored context opens as if it belonged where it now sits. `NonEmpty<T>.into()` names the destination the caller believes it is opening; a stored context that differs is refused with `Error::ContextMismatch` before any key is retrieved. Either way the stored context is data the record arrived with, not something the cipher has authenticated.
 `T` supplies the Vitamin C context encodings and implements `Clone`,
 `MaybeEmpty`, and `PartialEq`. This metadata is not a separate encrypted field.
-It cannot be combined with literal context attributes.
 
-Otherwise, a record whose fields all carry their own contexts (including a
-`struct` derive) uses `DeclaredContext`. `().into()` or its default selects the
+Otherwise, a `struct` derive, whose fields all carry their own contexts, uses
+`DeclaredContext`. `().into()` or its default selects the
 declared contexts unchanged; a nonempty caller context extends each base context.
-A record with fields that need a caller context uses `CallerContext`, constructed
+A `plaintext` record, whose fields all take the caller's context, uses `CallerContext`, constructed
 from a `NonEmpty<T>` or a supported integer. Both encodings and the descriptor's
 structured identity are preserved when borrowing context data is converted into
 an owned declaration. No context is inferred from a Rust type's name.
@@ -75,11 +80,9 @@ let record: SealedName = name.encrypt_into_with_context(&keyset, NonEmpty::new(t
 The derive cannot pick this for you: it sees the field types' names, not
 what they declare. The type you name must convert into every field's own
 `Context` (`AeadContext` does not convert into `CallerContext`, so a term
-field beside it is a compile error at the record, which is the point), and a
-field with a `context = ".."` of its own is derived under that literal
-extended by the caller's context through the type's `extend` — `AeadContext`
-and `CallerContext` both have one. A record with a `context_field`, or a
-`struct` derive, settles its context itself and refuses the attribute.
+field beside it is a compile error at the record, which is the point). A
+record with a `context_field`, or a `struct` derive, settles its context
+itself and refuses the attribute.
 
 A declaration is executed by `keyset.encrypt_as(&value, context)` and
 `cipher.decrypt_as(record, context)`, or through the blanket `EncryptInto` and
@@ -110,9 +113,8 @@ encrypted struct. Nothing is pluralised or otherwise guessed. The pair is
 what `nonempty!("users").with("age")` spells at a call site, and what a
 two-segment `Label` spells. `#[stash(identity = "nickname")] name: ..`
 replaces the second part only: the field is derived under
-`("users", "nickname")`. A field of a `struct` derive cannot be given a
-context of its own (`context = ".."` on it is refused): it always sits under
-the record's. Each plaintext field has exactly one output, and each output
+`("users", "nickname")`. A field cannot be given a context of its own
+(`context = ".."` on it is refused): it always sits under the record's. Each plaintext field has exactly one output, and each output
 its own segment: a ciphertext with search terms beside it is one field of
 type `Encrypted<Terms>` (`email: Encrypted<(EqualityTerm, MatchTerms)>`),
 not a ciphertext field plus term fields `from` the same plaintext field. A

packages/stack-encrypt-derive/src/attrs.rs

@@ -209,12 +209,6 @@ impl ContainerAttrs {
 #[derive(Default)]
 pub(crate) struct FieldAttrs {
     pub(crate) context_field: bool,
-    /// `#[stash(context = "...")]`: with a `plaintext` record, derive this
-    /// field under exactly this context instead of the one the caller passes
-    /// for the record. Extended by a caller's context like any other. Refused
-    /// on a field of a `struct` derive, whose fields sit under the record's
-    /// context (`identity` names the segment instead).
-    pub(crate) context: Option<LitStr>,
     /// `#[stash(identity = "...")]`: with `struct = ..`, the label segment
     /// this field is keyed under, in place of the plaintext field's name:
     /// the field is derived under `("<context>", "<identity>")`. The plan
@@ -244,18 +238,25 @@ impl FieldAttrs {
                     parsed.context_field = true;
                     return Ok(());
                 }
+                // Removed rather than unknown, so the message can say what
+                // to write instead. A plan has exactly one context source,
+                // and every field sits under it: a field sealed under a
+                // literal of its own has no plan form.
                 if meta.path.is_ident("context") {
-                    // Each of these is singular by meaning, so a repeat is a
-                    // mistake: rejected rather than silently overwritten. A
-                    // silently-winning second `from` would be the worst of
-                    // them — it crosses fields, which is exactly the failure
-                    // the derive exists to prevent.
-                    if parsed.context.is_some() {
-                        return Err(meta.error("`context` is given twice; a field has one context"));
-                    }
-                    parsed.context = Some(meta.value()?.parse()?);
-                    return Ok(());
+                    return Err(meta.error(
+                        "a field-level `context = \"..\"` is no longer accepted: all outputs of a \
+                         `plaintext = T` record share the caller's context, and every field of a \
+                         `struct = ..` derive sits under the record's context (key it under \
+                         another segment with `identity = \"..\"`). Writing one value under two \
+                         contexts (a dual write) is a fields plan that picks the same source \
+                         twice, not a derive",
+                    ));
                 }
+                // Each of these is singular by meaning, so a repeat is a
+                // mistake: rejected rather than silently overwritten. A
+                // silently-winning second `from` would be the worst of them —
+                // it crosses fields, which is exactly the failure the derive
+                // exists to prevent.
                 if meta.path.is_ident("identity") {
                     if parsed.identity.is_some() {
                         return Err(meta.error(
@@ -302,7 +303,7 @@ impl FieldAttrs {
                     ));
                 }
                 Err(meta.error(
-                    "unsupported field attribute; expected `context_field`, `context = \"...\"`, \
+                    "unsupported field attribute; expected `context_field`, \
                      `identity = \"...\"`, `from = field`, `default`, `default = expr` or \
                      `decrypt`",
                 ))

packages/stack-encrypt-derive/src/lib.rs

@@ -30,10 +30,11 @@
 //! # }).unwrap();
 //! ```
 //!
-//! For a record without a context field, fields use the caller's context or a
-//! declared literal. A record made only of ciphertexts can declare
-//! `context_type = AeadContext` and accept a context type that implements
-//! `IntoAad` alone, as the ciphertext leaf itself does.
+//! For a `plaintext` record without a context field, every field uses the
+//! caller's context: a field takes no literal context of its own. A record
+//! made only of ciphertexts can declare `context_type = AeadContext` and
+//! accept a context type that implements `IntoAad` alone, as the ciphertext
+//! leaf itself does.
 //! `struct = User, context = "users"` selects plaintext fields
 //! and binds each under the pair `("users", "<field>")`, which renders
 //! `users/<field>` as its ZeroKMS descriptor; `identity = ".."` on a field keys