Skip to content

Commit f4c1aaf

Browse files
committed
fix up wording and add return values
1 parent e44ae11 commit f4c1aaf

File tree

2 files changed

+81
-13
lines changed

2 files changed

+81
-13
lines changed

README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -503,7 +503,7 @@ Encryption and decryption are handled by CipherStash Proxy.
503503

504504
## Helper packages
505505

506-
We've created a few langague specific packages to help you interact with the payloads.
506+
We've created a few langague specific packages to help you interact with the payloads:
507507

508508
| Language | ORM | Example | Package |
509509
| ---------- | ----------- | ----------------------------------------------------------------- | ---------------------------------------------------------------- |

docs/tutorials/GETTINGSTARTED.md

Lines changed: 80 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,14 @@ cipherstash-migrator --columns email=email_encrypted --table users --database-na
249249

250250
We now have encrypted data in our `email_encrypted` field that we can query.
251251

252+
Drop the plaintext email column:
253+
254+
```sql
255+
ALTER TABLE users DROP COLUMN email;
256+
```
257+
258+
**Note: In production ensure data is backed up before dropping any columns**
259+
252260
### Insert a new record
253261

254262
Before inserting or querying any records, we need to connect to our database via the Proxy.
@@ -350,9 +358,37 @@ The EQL equivalent of this query is:
350358
SELECT email_encrypted FROM users;
351359
```
352360

361+
Returns:
362+
363+
```bash
364+
email_encrypted
365+
-------------------------------------------------------------------------------------------------
366+
{"k":"pt","p":"adalovelace@example.com","i":{"t":"users","c":"email_encrypted"},"v":1,"q":null}
367+
{"k":"pt","p":"gracehopper@test.com","i":{"t":"users","c":"email_encrypted"},"v":1,"q":null}
368+
{"k":"pt","p":"edithclarke@email.com","i":{"t":"users","c":"email_encrypted"},"v":1,"q":null}
369+
{"k":"pt","p":"test@test.com","i":{"t":"users","c":"email_encrypted"},"v":1,"q":null}
370+
```
371+
353372
**What is happening?**
354373

355-
All data returned from CipherStash Proxy for encrypted fields will be in this json format:
374+
The json stored in the database looks similar to this:
375+
376+
```json
377+
{
378+
"k": "ct", // The kind of EQL payload. The Proxy will insert a json payload of a ciphertext or "ct".
379+
"c": "encrypted test@test.com", // The source ciphertext of the plaintext email.
380+
"e": {
381+
"t": "users", // Table
382+
"c": "email_encrypted" // Encrypted column
383+
},
384+
"m": [42], // The ciphertext used for free text queries i.e match index
385+
"u": "unique ciphertext", // The ciphertext used for unique queries. i.e unique index
386+
"o": ["a", "b", "c"], // The ciphertext used for order or comparison queries. i.e ore index
387+
"v": 1
388+
}
389+
```
390+
391+
The Proxy decrypts the json above and returns a plaintext json payload that looks like this:
356392

357393
```json
358394
{
@@ -367,6 +403,10 @@ All data returned from CipherStash Proxy for encrypted fields will be in this js
367403
}
368404
```
369405

406+
> When working with EQL in an application you would likely be using an ORM.
407+
408+
> We are currently building out [packages and examples](../../README.md#helper-packages) to make it easier to work with EQL json payloads.
409+
370410
#### Advanced querying
371411

372412
EQL provides specialized functions to be able to interact with encrypted data and to support operations like equality checks, comparison queries, and unique constraints.
@@ -376,6 +416,7 @@ EQL provides specialized functions to be able to interact with encrypted data an
376416
Prerequsites:
377417

378418
- A [match index](#adding-indexes) is needed on the encrypted column to support this operation.
419+
- Connected to the database via the Proxy.
379420

380421
EQL function to use: `cs_match_v1(val JSONB)`
381422

@@ -394,20 +435,26 @@ EQL query payload for a match query:
394435
}
395436
```
396437

397-
A plaintext text search query like this:
438+
A plaintext query, to search for any records that have an email like `grace`, looks like this:
398439

399440
```sql
400441
SELECT * FROM users WHERE email LIKE '%grace%';
401442
```
402443

403-
Would look like this using EQL:
444+
The EQL equivalent of this query is:
404445

405446
```sql
406447
SELECT * FROM users WHERE cs_match_v1(email_encrypted) @> cs_match_v1(
407448
'{"v":1,"k":"pt","p":"grace","i":{"t":"users","c":"email_encrypted"},"q":"match"}'
408449
);
409450
```
410451

452+
This query returns:
453+
454+
| id | email_encrypted |
455+
| --- | -------------------------------------------------------------------------------------------- |
456+
| 2 | {"k":"pt","p":"gracehopper@test.com","i":{"t":"users","c":"email_encrypted"},"v":1,"q":null} |
457+
411458
#### Equality query
412459

413460
Prerequsites:
@@ -421,7 +468,7 @@ EQL query payload for a match query:
421468
```json
422469
{
423470
"k": "pt",
424-
"p": "gracehopper@test.com", // The text we want to use for the equality query
471+
"p": "adalovelace@example.com", // The text we want to use for the equality query
425472
"i": {
426473
"t": "users",
427474
"c": "email_encrypted"
@@ -431,20 +478,26 @@ EQL query payload for a match query:
431478
}
432479
```
433480

434-
A plaintext text equality query like this:
481+
A plaintext query to search for any records that equal `adalovelace@example.com` looks like this:
435482

436483
```sql
437-
SELECT * FROM users WHERE email = 'gracehopper@test.com';
484+
SELECT * FROM users WHERE email = 'adalovelace@example.com';
438485
```
439486

440-
Would look like this using EQL:
487+
The EQL equivalent of this query is:
441488

442489
```sql
443490
SELECT * FROM users WHERE cs_unique_v1(email_encrypted) = cs_unique_v1(
444-
'{"v":1,"k":"pt","p":"gracehopper@test.com","i":{"t":"users","c":"email_encrypted"},"q":"unique"}'
491+
'{"v":1,"k":"pt","p":"adalovelace@example.com","i":{"t":"users","c":"email_encrypted"},"q":"unique"}'
445492
);
446493
```
447494

495+
This query returns:
496+
497+
| id | email_encrypted |
498+
| --- | ----------------------------------------------------------------------------------------------- |
499+
| 1 | {"k":"pt","p":"adalovelace@example.com","i":{"t":"users","c":"email_encrypted"},"v":1,"q":null} |
500+
448501
#### Order by query
449502

450503
Prerequsites:
@@ -453,18 +506,27 @@ Prerequsites:
453506

454507
EQL function to use: `cs_ore_64_8_v1(val JSONB)`.
455508

456-
A plaintext text order by query like this:
509+
A plaintext query order by email looks like this:
457510

458511
```sql
459512
SELECT * FROM users ORDER BY email ASC;
460513
```
461514

462-
Would look like this using EQL:
515+
The EQL equivalent of this query is:
463516

464517
```sql
465518
SELECT * FROM users ORDER BY cs_ore_64_8_v1(email_encrypted) ASC;
466519
```
467520

521+
This query returns:
522+
523+
| id | email_encrypted |
524+
| --- | ----------------------------------------------------------------------------------------------- |
525+
| 1 | {"k":"pt","p":"adalovelace@example.com","i":{"t":"users","c":"email_encrypted"},"v":1,"q":null} |
526+
| 3 | {"k":"pt","p":"edithclarke@email.com","i":{"t":"users","c":"email_encrypted"},"v":1,"q":null} |
527+
| 2 | {"k":"pt","p":"gracehopper@test.com","i":{"t":"users","c":"email_encrypted"},"v":1,"q":null} |
528+
| 4 | {"k":"pt","p":"test@test.com","i":{"t":"users","c":"email_encrypted"},"v":1,"q":null} |
529+
468530
#### Comparison query
469531

470532
Prerequsites:
@@ -488,16 +550,22 @@ EQL query payload for a comparison query:
488550
}
489551
```
490552

491-
A plaintext text comparison query like this:
553+
A plaintext text query to compare email values looks like this:
492554

493555
```sql
494556
SELECT * FROM users WHERE email > 'gracehopper@test.com';
495557
```
496558

497-
Would look like this using EQL:
559+
The EQL equivalent of this query is:
498560

499561
```sql
500562
SELECT * FROM users WHERE cs_ore_64_8_v1(email_encrypted) > cs_ore_64_8_v1(
501563
'{"v":1,"k":"pt","p":"gracehopper@test.com","i":{"t":"users","c":"email_encrypted"},"q":"ore"}'
502564
);
503565
```
566+
567+
This query returns:
568+
569+
| id | email_encrypted |
570+
| --- | ------------------------------------------------------------------------------------- |
571+
| 4 | {"k":"pt","p":"test@test.com","i":{"t":"users","c":"email_encrypted"},"v":1,"q":null} |

0 commit comments

Comments
 (0)