chore(TestVectors): Test Smithy-generated ItemEncryptor

TestVectors/Makefile

@@ -7,14 +7,17 @@ TRANSPILE_TESTS_IN_RUST=1
 include ../SharedMakefile.mk
 
 PROJECT_SERVICES := \
-	DDBEncryption
+	DDBEncryption \
+	WrappedDynamoDbItemEncryptor
 
 MAIN_SERVICE_FOR_RUST := DDBEncryption
 
 SMITHY_MODEL_ROOT := $(PROJECT_ROOT)/DynamoDbEncryption/dafny/DynamoDbEncryption/Model
 OUTPUT_LOCAL_SERVICE_DDBEncryption := --local-service-test
+OUTPUT_LOCAL_SERVICE_WrappedDynamoDbItemEncryptor := --local-service-test
 
 SERVICE_NAMESPACE_DDBEncryption=aws.cryptography.dbEncryptionSdk.dynamoDb
+SERVICE_NAMESPACE_WrappedDynamoDbItemEncryptor=aws.cryptography.dbEncryptionSdk.dynamoDb.itemEncryptor
 
 MAX_RESOURCE_COUNT=10000000
 # Order is important
@@ -35,6 +38,7 @@ RUST_OTHER_FILES := \
 	runtimes/rust/src/ddb.rs \
 	runtimes/rust/src/concurrent_call.rs \
 	runtimes/rust/src/create_client.rs \
+	runtimes/rust/src/create_wrapped_item_encryptor.rs \
 	runtimes/rust/src/dafny_libraries.rs \
 	runtimes/rust/src/digest.rs \
 	runtimes/rust/src/ecdh.rs \
@@ -66,6 +70,8 @@ PROJECT_INDEX := \
 	DynamoDbEncryption/dafny/DynamoDbItemEncryptor/src/Index.dfy \
 	DynamoDbEncryption/dafny/DynamoDbEncryptionTransforms/src/Index.dfy \
 	DynamoDbEncryption/dafny/DynamoDbEncryption/src/Index.dfy \
+	DynamoDbEncryption/dafny/DynamoDbItemEncryptor/src/Index.dfy \
+	DynamoDbEncryption/dafny/DynamoDbEncryptionTransforms/src/Index.dfy \
 
 STD_LIBRARY=submodules/MaterialProviders/StandardLibrary
 SMITHY_DEPS=submodules/MaterialProviders/model
@@ -85,6 +91,17 @@ SERVICE_DEPS_DDBEncryption := \
 	DynamoDbEncryption/dafny/StructuredEncryption \
 	submodules/MaterialProviders/TestVectorsAwsCryptographicMaterialProviders/dafny/TestVectorsAwsCryptographicMaterialProviders \
 
+SERVICE_DEPS_WrappedDynamoDbItemEncryptor := \
+	submodules/MaterialProviders/AwsCryptographyPrimitives \
+	submodules/MaterialProviders/ComAmazonawsKms \
+	submodules/MaterialProviders/ComAmazonawsDynamodb \
+	submodules/MaterialProviders/AwsCryptographicMaterialProviders/dafny/AwsCryptographicMaterialProviders \
+	submodules/MaterialProviders/AwsCryptographicMaterialProviders/dafny/AwsCryptographyKeyStore \
+	DynamoDbEncryption/dafny/StructuredEncryption \
+	DynamoDbEncryption/dafny/DynamoDbEncryption \
+	DynamoDbEncryption/dafny/DynamoDbItemEncryptor \
+	submodules/MaterialProviders/TestVectorsAwsCryptographicMaterialProviders/dafny/TestVectorsAwsCryptographicMaterialProviders \
+
 transpile_implementation_rust: _remove_wrapped_client_rust
 
 _remove_wrapped_client_rust:

TestVectors/dafny/DDBEncryption/src/CreateWrappedItemEncryptor.dfy

@@ -0,0 +1,66 @@
+// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+include "../Model/AwsCryptographyDynamoDbEncryptionTypesWrapped.dfy"
+include "../../../../DynamoDbEncryption/dafny/DynamoDbItemEncryptor/src/Index.dfy"
+
+module {:extern} CreateWrappedItemEncryptor {
+  import opened Wrappers
+  import AwsCryptographyDbEncryptionSdkDynamoDbTypes
+  import ENC = AwsCryptographyDbEncryptionSdkDynamoDbItemEncryptorTypes
+  import DynamoDbItemEncryptor
+  import Operations = AwsCryptographyDbEncryptionSdkDynamoDbItemEncryptorOperations
+
+  // The `ensures` clause is copy-pasted from the DynamoDbItemEncryptor client method's `ensures` clause.
+  method {:extern} CreateWrappedItemEncryptor(config: ENC.DynamoDbItemEncryptorConfig)
+    returns (output: Result<ENC.IDynamoDbItemEncryptorClient, ENC.Error>)
+    // requires config.keyring.Some? ==>
+    //   config.keyring.value.ValidState()
+    // requires config.cmm.Some? ==>
+    //   config.cmm.value.ValidState()
+    // requires config.legacyOverride.Some? ==>
+    //   config.legacyOverride.value.encryptor.ValidState()
+    // modifies if config.keyring.Some? then
+    //     config.keyring.value.Modifies
+    //   else {}
+    // modifies if config.cmm.Some? then
+    //     config.cmm.value.Modifies
+    //   else {}
+    // modifies if config.legacyOverride.Some? then
+    //            config.legacyOverride.value.encryptor.Modifies
+    //          else {}
+    ensures output.Success? ==>
+              && output.value is DynamoDbItemEncryptor.DynamoDbItemEncryptorClient
+              && fresh(output.value)
+              && fresh(output.value.History)
+              && output.value.ValidState()
+              && var rconfig := (output.value as DynamoDbItemEncryptor.DynamoDbItemEncryptorClient).config;
+              && fresh(output.value.Modifies)
+              && rconfig.logicalTableName == config.logicalTableName
+              && rconfig.partitionKeyName == config.partitionKeyName
+              && rconfig.sortKeyName == config.sortKeyName
+              && rconfig.attributeActionsOnEncrypt == config.attributeActionsOnEncrypt
+              && rconfig.allowedUnsignedAttributes == config.allowedUnsignedAttributes
+              && rconfig.allowedUnsignedAttributePrefix == config.allowedUnsignedAttributePrefix
+              && rconfig.algorithmSuiteId == config.algorithmSuiteId
+
+              //= specification/dynamodb-encryption-client/ddb-table-encryption-config.md#attribute-actions
+              //= type=implication
+              //# The [Key Action](#key-action)
+              //# MUST be configured to the partition attribute and, if present, sort attribute.
+              && rconfig.version == Operations.VersionFromActions(config.attributeActionsOnEncrypt)
+              && config.partitionKeyName in config.attributeActionsOnEncrypt
+              && config.attributeActionsOnEncrypt[config.partitionKeyName] == Operations.KeyActionFromVersion(rconfig.version)
+              && (config.sortKeyName.Some? ==>
+                    && config.sortKeyName.value in config.attributeActionsOnEncrypt
+                    && config.attributeActionsOnEncrypt[config.sortKeyName.value] == Operations.KeyActionFromVersion(rconfig.version))
+
+    //= specification/dynamodb-encryption-client/ddb-table-encryption-config.md#plaintext-policy
+    //# If not specified, encryption and decryption MUST behave according to `FORBID_PLAINTEXT_WRITE_FORBID_PLAINTEXT_READ`.
+    ensures
+      && output.Success?
+      && config.plaintextOverride.None?
+      ==>
+        && var config := (output.value as DynamoDbItemEncryptor.DynamoDbItemEncryptorClient).config;
+        && config.plaintextOverride.FORBID_PLAINTEXT_WRITE_FORBID_PLAINTEXT_READ?
+}

TestVectors/dafny/DDBEncryption/src/JsonConfig.dfy

@@ -3,6 +3,7 @@
 
 include "JsonItem.dfy"
 include "CreateInterceptedDDBClient.dfy"
+include "CreateWrappedItemEncryptor.dfy"
 include "../../../../DynamoDbEncryption/dafny/DynamoDbItemEncryptor/src/Index.dfy"
 
 module {:options "-functionSyntax:4"} JsonConfig {
@@ -31,6 +32,8 @@ module {:options "-functionSyntax:4"} JsonConfig {
   import ParseJsonManifests
   import CreateInterceptedDDBClient
   import DynamoDbItemEncryptor
+  import CreateWrappedItemEncryptor
+  import Operations = AwsCryptographyDbEncryptionSdkDynamoDbItemEncryptorOperations
 
 
   const abc : UTF8.ValidUTF8Bytes :=
@@ -254,7 +257,7 @@ module {:options "-functionSyntax:4"} JsonConfig {
   }
 
   method GetItemEncryptor(name : string, data : JSON, keys: KeyVectors.KeyVectorsClient)
-    returns (encryptor : Result<DynamoDbItemEncryptor.DynamoDbItemEncryptorClient, string>)
+    returns (encryptor : Result<ENC.IDynamoDbItemEncryptorClient, string>)
     requires keys.ValidState()
     modifies keys.Modifies
     ensures keys.ValidState()
@@ -352,10 +355,11 @@ module {:options "-functionSyntax:4"} JsonConfig {
         legacyOverride := legacyOverride,
         plaintextOverride := plaintextOverride
       );
-    var enc : ENC.IDynamoDbItemEncryptorClient :- expect DynamoDbItemEncryptor.DynamoDbItemEncryptor(encryptorConfig);
-    assert enc is DynamoDbItemEncryptor.DynamoDbItemEncryptorClient;
-    var encr := enc as DynamoDbItemEncryptor.DynamoDbItemEncryptorClient;
-    return Success(encr);
+    var enc : ENC.IDynamoDbItemEncryptorClient :- expect CreateWrappedItemEncryptor.CreateWrappedItemEncryptor(encryptorConfig);
+    return Success(enc);
+    // assert enc is DynamoDbItemEncryptor.DynamoDbItemEncryptorClient;
+    // var encr := enc as DynamoDbItemEncryptor.DynamoDbItemEncryptorClient;
+    // return Success(encr);
   }
 
   method GetOneTableConfig(name : string, data : JSON, keys: KeyVectors.KeyVectorsClient)

TestVectors/dafny/WrappedDynamoDbItemEncryptor/Model/AwsCryptographyDbEncryptionSdkDynamoDbItemEncryptorTypesWrapped.dfy

@@ -0,0 +1,20 @@
+// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+// Do not modify this file. This file is machine generated, and any changes to it will be overwritten.
+include "../../../../submodules/MaterialProviders/StandardLibrary/src/Index.dfy"
+include "../src/Index.dfy"
+abstract module WrappedAbstractAwsCryptographyDbEncryptionSdkDynamoDbItemEncryptorService {
+  import opened Wrappers
+  import opened StandardLibrary.UInt
+  import opened UTF8
+  import opened Types = AwsCryptographyDbEncryptionSdkDynamoDbItemEncryptorTypes
+  import WrappedService : AbstractAwsCryptographyDbEncryptionSdkDynamoDbItemEncryptorService
+  function method WrappedDefaultDynamoDbItemEncryptorConfig(): DynamoDbItemEncryptorConfig
+  method {:extern} WrappedDynamoDbItemEncryptor(config: DynamoDbItemEncryptorConfig := WrappedDefaultDynamoDbItemEncryptorConfig())
+    returns (res: Result<IDynamoDbItemEncryptorClient, Error>)
+    ensures res.Success? ==>
+              && fresh(res.value)
+              && fresh(res.value.Modifies)
+              && fresh(res.value.History)
+              && res.value.ValidState()
+}

TestVectors/dafny/WrappedDynamoDbItemEncryptor/src/Index.dfy

@@ -0,0 +1,6 @@
+// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+// Empty stub expected by Smithy-Dafny
+
+include "../../../../DynamoDbEncryption/dafny/DynamoDbItemEncryptor/src/Index.dfy"
+module WrappedItemEncryptor {}

TestVectors/runtimes/java/src/main/java/CreateWrappedItemEncryptor_Compile/__default.java

@@ -0,0 +1,37 @@
+package CreateWrappedItemEncryptor_Compile;
+
+import Wrappers_Compile.Result;
+import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.DynamoDbItemEncryptor;
+import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.ToDafny;
+import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.ToNative;
+import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.internaldafny.types.Error;
+import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.internaldafny.types.IDynamoDbItemEncryptorClient;
+import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.model.DynamoDbItemEncryptorConfig;
+import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.wrapped.TestDynamoDbItemEncryptor;
+
+public class __default {
+
+  public static Result<
+    IDynamoDbItemEncryptorClient,
+    Error
+  > CreateWrappedItemEncryptor(
+    software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.internaldafny.types.DynamoDbItemEncryptorConfig config
+  ) {
+    try {
+      final DynamoDbItemEncryptorConfig nativeConfig =
+        ToNative.DynamoDbItemEncryptorConfig(config);
+
+      final DynamoDbItemEncryptor itemEncryptor = DynamoDbItemEncryptor
+        .builder()
+        .DynamoDbItemEncryptorConfig(nativeConfig)
+        .build();
+
+      final TestDynamoDbItemEncryptor wrappedEncryptor =
+        TestDynamoDbItemEncryptor.builder().impl(itemEncryptor).build();
+
+      return Result.create_Success(wrappedEncryptor);
+    } catch (Exception e) {
+      return Result.create_Failure(ToDafny.Error((RuntimeException) e));
+    }
+  }
+}

TestVectors/runtimes/java/src/main/smithy-generated/software/amazon/cryptography/dbencryptionsdk/dynamodb/itemencryptor/wrapped/TestDynamoDbItemEncryptor.java

@@ -0,0 +1,110 @@
+// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+// Do not modify this file. This file is machine generated, and any changes to it will be overwritten.
+package software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.wrapped;
+
+import Wrappers_Compile.Result;
+import java.lang.IllegalArgumentException;
+import java.lang.RuntimeException;
+import java.util.Objects;
+import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.DynamoDbItemEncryptor;
+import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.ToDafny;
+import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.ToNative;
+import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.internaldafny.types.DecryptItemInput;
+import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.internaldafny.types.DecryptItemOutput;
+import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.internaldafny.types.EncryptItemInput;
+import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.internaldafny.types.EncryptItemOutput;
+import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.internaldafny.types.Error;
+import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.internaldafny.types.IDynamoDbItemEncryptorClient;
+
+public class TestDynamoDbItemEncryptor implements IDynamoDbItemEncryptorClient {
+
+  private final DynamoDbItemEncryptor _impl;
+
+  protected TestDynamoDbItemEncryptor(BuilderImpl builder) {
+    this._impl = builder.impl();
+  }
+
+  public static Builder builder() {
+    return new BuilderImpl();
+  }
+
+  public Result<DecryptItemOutput, Error> DecryptItem(
+    DecryptItemInput dafnyInput
+  ) {
+    try {
+      software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.model.DecryptItemInput nativeInput =
+        ToNative.DecryptItemInput(dafnyInput);
+      software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.model.DecryptItemOutput nativeOutput =
+        this._impl.DecryptItem(nativeInput);
+      DecryptItemOutput dafnyOutput = ToDafny.DecryptItemOutput(nativeOutput);
+      return Result.create_Success(
+        DecryptItemOutput._typeDescriptor(),
+        Error._typeDescriptor(),
+        dafnyOutput
+      );
+    } catch (RuntimeException ex) {
+      return Result.create_Failure(
+        DecryptItemOutput._typeDescriptor(),
+        Error._typeDescriptor(),
+        ToDafny.Error(ex)
+      );
+    }
+  }
+
+  public Result<EncryptItemOutput, Error> EncryptItem(
+    EncryptItemInput dafnyInput
+  ) {
+    try {
+      software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.model.EncryptItemInput nativeInput =
+        ToNative.EncryptItemInput(dafnyInput);
+      software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.model.EncryptItemOutput nativeOutput =
+        this._impl.EncryptItem(nativeInput);
+      EncryptItemOutput dafnyOutput = ToDafny.EncryptItemOutput(nativeOutput);
+      return Result.create_Success(
+        EncryptItemOutput._typeDescriptor(),
+        Error._typeDescriptor(),
+        dafnyOutput
+      );
+    } catch (RuntimeException ex) {
+      return Result.create_Failure(
+        EncryptItemOutput._typeDescriptor(),
+        Error._typeDescriptor(),
+        ToDafny.Error(ex)
+      );
+    }
+  }
+
+  public interface Builder {
+    Builder impl(DynamoDbItemEncryptor impl);
+
+    DynamoDbItemEncryptor impl();
+
+    TestDynamoDbItemEncryptor build();
+  }
+
+  static class BuilderImpl implements Builder {
+
+    protected DynamoDbItemEncryptor impl;
+
+    protected BuilderImpl() {}
+
+    public Builder impl(DynamoDbItemEncryptor impl) {
+      this.impl = impl;
+      return this;
+    }
+
+    public DynamoDbItemEncryptor impl() {
+      return this.impl;
+    }
+
+    public TestDynamoDbItemEncryptor build() {
+      if (Objects.isNull(this.impl())) {
+        throw new IllegalArgumentException(
+          "Missing value for required field `impl`"
+        );
+      }
+      return new TestDynamoDbItemEncryptor(this);
+    }
+  }
+}

TestVectors/runtimes/net/Extern/CreateWrappedItemEncryptor.cs

@@ -0,0 +1,26 @@
+using AWS.Cryptography.DbEncryptionSDK.DynamoDb.ItemEncryptor;
+using AWS.Cryptography.DbEncryptionSDK.DynamoDb;
+using AWS.Cryptography.DbEncryptionSDK.DynamoDb.ItemEncryptor.Wrapped;
+using software.amazon.cryptography.services.dynamodb.internaldafny;
+using software.amazon.cryptography.services.dynamodb.internaldafny.types;
+using Wrappers_Compile;
+using _IError = software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.internaldafny.types._IError;
+
+namespace CreateWrappedItemEncryptor_Compile
+{
+    public partial class __default
+    {
+        public static _IResult<software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.internaldafny.types.IDynamoDbItemEncryptorClient, _IError> CreateWrappedItemEncryptor(
+            software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.internaldafny.types._IDynamoDbItemEncryptorConfig config)
+        {
+            var nativeConfig = AWS.Cryptography.DbEncryptionSDK.DynamoDb.ItemEncryptor.TypeConversion
+                .FromDafny_N3_aws__N12_cryptography__N15_dbEncryptionSdk__N8_dynamoDb__N13_itemEncryptor__S27_DynamoDbItemEncryptorConfig(
+                    config);
+
+            var itemEncryptor = new DynamoDbItemEncryptor(nativeConfig);
+            var wrappedEncryptor = new DynamoDbItemEncryptorShim(itemEncryptor);
+
+            return new Result_Success<software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.internaldafny.types.IDynamoDbItemEncryptorClient, _IError>(wrappedEncryptor);
+        }
+    }
+}