fix: is_encrypted_record misses blobs nested inside a list or tuple

both the bounded pass and the unbounded _has_encrypted_field fallback
descended only through dict values, so a blob nested inside a list at
any depth was invisible and the function returned False. reencrypt()
already skips list-nested blobs (documented gotcha), so after rotation
such a blob was stranded under the old key while this audit reported
the record clean - a rotation-data-loss trap once the old wrapped-key
record is deleted. both traversal passes now walk list/tuple items in
addition to dict values; the blob-detection predicate is unchanged.

bump 0.1.7 -> 0.1.8

Signed-off-by: disqualifier <dev@disqualifier.me>
This commit is contained in:
2026-07-03 16:14:34 -04:00
parent 7287a52947
commit abf7491d26
3 changed files with 26 additions and 10 deletions
+1 -1
View File
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
[project]
name = "envelope_crypto"
version = "0.1.7"
version = "0.1.8"
description = "Envelope encryption (RSA-OAEP wrapped AES-256-GCM) for dict records — config-free, storage-agnostic, installable."
requires-python = ">=3.10"
dependencies = [