(couchdb) 01/01: wip

[rn...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rnewson pushed a commit to branch encrypt-since-seq
in repository https://gitbox.apache.org/repos/asf/couchdb.git

commit f9bca1f0ab9b1460e8e4506a3ad9a56ff34b16a2
Author: Robert Newson <rn...@apache.org>
AuthorDate: Tue Aug 11 15:37:05 2026 +0100

    wip
---
 src/fabric/src/fabric_view_changes.erl | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/src/fabric/src/fabric_view_changes.erl b/src/fabric/src/fabric_view_changes.erl
index dd2386f5e..a9a12a22d 100644
--- a/src/fabric/src/fabric_view_changes.erl
+++ b/src/fabric/src/fabric_view_changes.erl
@@ -394,8 +394,8 @@ pending_count(Dict) ->
 pack_seqs(Workers) ->
     SeqList = [{N, R, S} || {#shard{node = N, range = R}, S} <- Workers],
     SeqSum = lists:sum([fake_packed_seq(S) || {_, _, S} <- SeqList]),
-    Opaque = couch_util:encodeBase64Url(?term_to_bin(SeqList, [compressed])),
-    <<(integer_to_binary(SeqSum))/binary, $-, Opaque/binary>>.
+    Opaque = couch_util:encodeBase64Url(encrypt(?term_to_bin(SeqList, [compressed]))),
+    <<(integer_to_binary(SeqSum))/binary, $-, $., $1, Opaque/binary>>.
 
 % Generate the sequence number used to build the emitted N-... prefix.
 %
@@ -419,12 +419,24 @@ fake_packed_seq(Seq) -> Seq.
 unpack_seq_regex_match(Packed) ->
     Pattern = "^\"?([0-9]+-)?(?<opaque>.*?)\"?$",
     Options = [{capture, [opaque], binary}],
-    {match, Match} = re:run(Packed, Pattern, Options),
+    {match, [Match]} = re:run(Packed, Pattern, Options),
     Match.
 
+unpack_seq_decode_term(<<$., $1, EncryptedOpaque/binary>>) ->
+    binary_to_term(decrypt(couch_util:decodeBase64Url(EncryptedOpaque)));
 unpack_seq_decode_term(Opaque) ->
     binary_to_term(couch_util:decodeBase64Url(Opaque)).
 
+encrypt(Bin) when is_binary(Bin) ->
+    Secret = ?l2b(chttpd_util:get_chttpd_auth_config("secret")),
+    IV = crypto:strong_rand_bytes(12),
+    {CipherText, Tag} = crypto:crypto_one_time_aead(aes_256_gcm, Secret, IV, Bin, [], true),
+    <<IV/binary, Tag/binary, CipherText/binary>>.
+
+decrypt(<<IV:12/binary, Tag:16/binary, CipherText/binary>>) ->
+    Secret = ?l2b(chttpd_util:get_chttpd_auth_config("secret")),
+    crypto:crypto_one_time_aead(aes_256_gcm, Secret, IV, CipherText, [], Tag, false).
+
 % This is used for testing and for remsh debugging
 %
 % Return the unpacked list of sequences from a raw update seq string. The input