spike(stack-encrypt): cascading AEAD tags and a random stored order for json_tree

packages/eql/tests/encryption/tests/json_tree.rs

@@ -1906,9 +1906,12 @@ fn postgres_hostile_answers_are_refused_by_the_client() {
             cipher.decrypt_as(JsonTreeSubtree::from_key(key, rows), column()),
         )
     };
+    // Refused: as the wrong entry, or at the cipher. Under the cascading
+    // tags (spike) a row the chain misplaces fails to authenticate, since
+    // its parent's AAD covers its tag.
     let wrong = |result: Result<Value, Error>, what: &str| {
         assert!(
-            matches!(result, Err(Error::JsonWrongEntry { .. })),
+            matches!(result, Err(Error::JsonWrongEntry { .. }) | Err(Error::Aead)),
             "{what}: {result:?}"
         );
     };

packages/stack-encrypt/Cargo.toml

@@ -42,6 +42,8 @@ vitaminc-normalize = { workspace = true }
 vitaminc-ore = { workspace = true }
 vitaminc-prf = { workspace = true }
 vitaminc-protected = { workspace = true }
+# Spike (#1357): the CSPRNG that shuffles a document's stored entry order.
+vitaminc = { workspace = true }
 # `dynamic` only: serde over the transport frame, which reads a binding's
 # control data (statistics, options, a plan) into typed messages.
 vitaminc-aead-frame = { workspace = true, optional = true, features = ["serde"] }

packages/stack-encrypt/src/cipher.rs

@@ -592,6 +592,16 @@ impl<K> StackCipher<K> {
         &self.kms
     }
 
+    /// The loaded state of the keyset with `id`, if this cipher has loaded
+    /// it: what opening a JSON document with its root open needs, since the
+    /// client walks the document's chain itself (spike, cascading tags).
+    pub(crate) fn loaded_keyset(&self, id: Uuid) -> Option<Arc<KeysetState>> {
+        match self.keysets().get(&IdentifiedBy::Uuid(id)) {
+            Lookup::Hit(state) => Some(state),
+            Lookup::Stale(_) | Lookup::Miss(_) => None,
+        }
+    }
+
     fn keysets(&self) -> std::sync::MutexGuard<'_, KeysetCache> {
         // The cache holds no invariant a panic mid-update could break (an
         // insert is two map writes, and a stale name entry only points at