docs: correct reencrypt's list-nested-blob docstring to match current behavior
the docstring said a list-nested blob is "not covered by the depth-limit raise below", but the cutoff check uses _has_encrypted_field, which does walk lists - so a list-nested blob reached via the cutoff dict scan DOES raise, while the same blob one level shallower (hit during normal traversal instead) is what's actually skipped silently. doc-only, no behavior change. Signed-off-by: disqualifier <dev@disqualifier.me>
This commit is contained in:
@@ -476,9 +476,11 @@ class EnvelopeCrypto:
|
||||
pattern) it is re-encrypted directly and returned in place of `record`.
|
||||
|
||||
traversal recurses into nested DICTS only - a blob nested inside a LIST is
|
||||
not re-encrypted and not covered by the depth-limit raise below; flatten
|
||||
list-nested blobs to dict fields before rotation or they'll be silently
|
||||
left under the old key.
|
||||
not re-encrypted. the depth-limit raise below IS reached for a list-nested
|
||||
blob when the cutoff dict scan finds it (it walks lists too), but a blob
|
||||
one level shallower - hit during normal traversal instead of the cutoff
|
||||
scan - is skipped silently; flatten list-nested blobs to dict fields before
|
||||
rotation or they can be silently left under the old key.
|
||||
|
||||
Args:
|
||||
source_crypto: instance holding the old (source) key.
|
||||
|
||||
Reference in New Issue
Block a user