Follow-up from #725 (EQL v3 in encryptedDynamoDB).
Summary
The adapter stores an equality term as <attr>__hmac so it can back a DynamoDB GSI key condition. Today that end-to-end claim is asserted only by inference — unit/e2e tests confirm the __hmac attribute is present and correctly shaped, but nothing stands up a real table with a GSI on the __hmac attribute and runs an actual KeyConditionExpression query.
Why it's a separate issue
There is currently no DynamoDB Local / testcontainers / localstack infrastructure anywhere in the repo, and packages/stack does not depend on the aws-sdk DynamoDB client — the adapter operates purely on in-memory attribute-map objects. So this isn't "add a test"; it's introducing DynamoDB Local + the aws-sdk dynamodb dep + CI wiring, which carries its own supply-chain/CI review surface. That's why it was kept out of #725 rather than ballooning that diff.
Scope
- Add DynamoDB Local (or testcontainers) to the test infra, gated so it doesn't slow the default unit lane.
- One integration test: create a table with a GSI keyed on
<attr>__hmac, encryptModel an item, PutItem, then Query via KeyConditionExpression on the __hmac value produced by encryptQuery, and assert the item comes back.
- Cover both a top-level equality column and (optionally) a dotted-path one.
Acceptance
- A live-free (no ZeroKMS? — or creds-gated) integration test proving a
__hmac attribute backs a real GSI key-condition query end-to-end.
Follow-up from #725 (EQL v3 in
encryptedDynamoDB).Summary
The adapter stores an equality term as
<attr>__hmacso it can back a DynamoDB GSI key condition. Today that end-to-end claim is asserted only by inference — unit/e2e tests confirm the__hmacattribute is present and correctly shaped, but nothing stands up a real table with a GSI on the__hmacattribute and runs an actualKeyConditionExpressionquery.Why it's a separate issue
There is currently no DynamoDB Local / testcontainers / localstack infrastructure anywhere in the repo, and
packages/stackdoes not depend on the aws-sdk DynamoDB client — the adapter operates purely on in-memory attribute-map objects. So this isn't "add a test"; it's introducing DynamoDB Local + the aws-sdk dynamodb dep + CI wiring, which carries its own supply-chain/CI review surface. That's why it was kept out of #725 rather than ballooning that diff.Scope
<attr>__hmac,encryptModelan item,PutItem, thenQueryviaKeyConditionExpressionon the__hmacvalue produced byencryptQuery, and assert the item comes back.Acceptance
__hmacattribute backs a real GSI key-condition query end-to-end.