test(xtest): cross-SDK partial decrypt, local and over HTTP

[sujankota]

DSPX-5117, Go side. Stacked on #653 (needs the range server).

Changes

• New features in tdfs.py: partial_decrypt and http_range_source. SDK.decrypt gains plaintext_range=(offset, length | None) and accepts an http(s) URL as input.
• New driver variable XT_WITH_PLAINTEXT_RANGE=<offset>:<length>. An empty length means "to the end".
• go cli.sh maps the variable to otdfctl --offset/--length and answers both features from --version --json .supported_features, the same way dpop is answered. Needs platform#4234, stacked on #4229 and #4221.
• java and js cli.sh report both features as unsupported until DSPX-5115 and DSPX-5116 ship.
• test_partial_decrypt.py runs every encrypt × decrypt pair on the 5 MiB multi-segment payload, from a local file and over HTTP through the range server.
  • 9 range cases: offset 0, inside one segment, crossing a boundary, spanning several segments, one whole segment, the last segment, length omitted, length past the end, and length 0.
  • Each result is compared with the matching plaintext slice.
  • Over HTTP, the bytes fetched must not exceed head + covering segments + tail + a 64 KiB allowance.
  • Also checks the rewrap audit event, rejection of a tampered in-range segment and a tampered root signature, and failure for an offset past the end.

Local results

Run with otdf-sdk-mgr install tip --ref pr:4234 go, platform main, and PLATFORM_VERSION=0.29.0: 17 passed, 4 failed. The failures point at the SDK, not the tests:

1. one_whole_segment-http and last_segment-http fetch one extra segment. A range that starts exactly on a segment boundary also reads and decrypts the segment before it. Reader.WriteTo (sdk/tdf.go, decryptedDataOffset+segSize < r.cursor) should use <=, as ReadAt already does. The line predates #4229, but #4229's Seek + io.Copy path is the first thing to hit it.
2. length_zero-file and length_zero-http emit no rewrap audit event. With --length 0, otdfctl returns before contacting KAS, so it exits 0 with no authorization check. DSPX-5114 requires the rewrap and audit event to match a full decrypt.

Not in this PR

• The CI guard that fails the job when every SDK pair skips.
• Recording (without asserting) what happens when a segment outside the range is tampered with.
• Java and JS cells. They skip until DSPX-5115 and DSPX-5116 land.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review: 1

• main

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7a6c2291-b335-42dd-9396-672bf05b433c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

X-Test Results

✅ java@v0.19.1-main
✅ java@main-v0.29.0
✅ js@v0.4.0-v0.29.0
✅ java@main-main
✅ go@main-main
✅ js@main-v0.29.0
✅ go@main-v0.29.0
✅ java@v0.19.1-v0.29.0
✅ js@main-main
✅ go@v0.38.1-v0.29.0
✅ go@v0.38.1-main
✅ js@v0.4.0-main