docs: correct reencrypt's list-nested-blob docstring to match current behavior

the docstring said a list-nested blob is "not covered by the depth-limit raise
below", but the cutoff check uses _has_encrypted_field, which does walk lists -
so a list-nested blob reached via the cutoff dict scan DOES raise, while the
same blob one level shallower (hit during normal traversal instead) is what's
actually skipped silently. doc-only, no behavior change.

Signed-off-by: disqualifier <dev@disqualifier.me>
This commit is contained in:
2026-07-06 00:17:18 -04:00
parent dc8f80c690
commit 8dffb6bc61
+5 -3
View File
@@ -476,9 +476,11 @@ class EnvelopeCrypto:
pattern) it is re-encrypted directly and returned in place of `record`. pattern) it is re-encrypted directly and returned in place of `record`.
traversal recurses into nested DICTS only - a blob nested inside a LIST is traversal recurses into nested DICTS only - a blob nested inside a LIST is
not re-encrypted and not covered by the depth-limit raise below; flatten not re-encrypted. the depth-limit raise below IS reached for a list-nested
list-nested blobs to dict fields before rotation or they'll be silently blob when the cutoff dict scan finds it (it walks lists too), but a blob
left under the old key. one level shallower - hit during normal traversal instead of the cutoff
scan - is skipped silently; flatten list-nested blobs to dict fields before
rotation or they can be silently left under the old key.
Args: Args:
source_crypto: instance holding the old (source) key. source_crypto: instance holding the old (source) key.