From 8dffb6bc616c8d8223cb17b5facadbf982a56c8e Mon Sep 17 00:00:00 2001 From: disqualifier Date: Mon, 6 Jul 2026 00:17:18 -0400 Subject: [PATCH] docs: correct reencrypt's list-nested-blob docstring to match current behavior the docstring said a list-nested blob is "not covered by the depth-limit raise below", but the cutoff check uses _has_encrypted_field, which does walk lists - so a list-nested blob reached via the cutoff dict scan DOES raise, while the same blob one level shallower (hit during normal traversal instead) is what's actually skipped silently. doc-only, no behavior change. Signed-off-by: disqualifier --- src/envelope_crypto/envelope_crypto.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/envelope_crypto/envelope_crypto.py b/src/envelope_crypto/envelope_crypto.py index be4d29c..05642c9 100644 --- a/src/envelope_crypto/envelope_crypto.py +++ b/src/envelope_crypto/envelope_crypto.py @@ -476,9 +476,11 @@ class EnvelopeCrypto: pattern) it is re-encrypted directly and returned in place of `record`. traversal recurses into nested DICTS only - a blob nested inside a LIST is - not re-encrypted and not covered by the depth-limit raise below; flatten - list-nested blobs to dict fields before rotation or they'll be silently - left under the old key. + not re-encrypted. the depth-limit raise below IS reached for a list-nested + blob when the cutoff dict scan finds it (it walks lists too), but a blob + one level shallower - hit during normal traversal instead of the cutoff + scan - is skipped silently; flatten list-nested blobs to dict fields before + rotation or they can be silently left under the old key. Args: source_crypto: instance holding the old (source) key.