test(sqlx): add ciphertext extraction and encrypted selector tests

Add test coverage for JSONB path operators with encrypted selectors:
- eql_v2.ciphertext() extraction from arrow operator results
- -> and ->> operators with eql_v2_encrypted selectors

Tests verify ciphertext extraction functionality and encrypted selector
handling across both single-row and multi-row scenarios.

Author: tobyhede

tests/sqlx/tests/jsonb_path_operators_tests.rs

@@ -128,3 +128,109 @@ async fn arrow_operator_returns_metadata_fields(pool: PgPool) -> Result<()> {
 
     Ok(())
 }
+
+#[sqlx::test(fixtures(path = "../fixtures", scripts("encrypted_json")))]
+async fn ciphertext_function_extracts_from_arrow_result(pool: PgPool) -> Result<()> {
+    // Test: eql_v2.ciphertext(e -> 'selector') extracts ciphertext value
+    // SQL equivalent: src/operators/->_test.sql lines 60-75
+    //
+    // The ciphertext() function extracts the 'c' field from the encrypted JSONB structure.
+    // When combined with the -> operator, it allows extracting ciphertext from nested paths.
+
+    let sql = format!(
+        "SELECT eql_v2.ciphertext(e -> '{}'::text) FROM encrypted LIMIT 1",
+        Selectors::N
+    );
+
+    // Should return ciphertext value (a text string)
+    QueryAssertion::new(&pool, &sql).returns_rows().await;
+
+    Ok(())
+}
+
+#[sqlx::test(fixtures(path = "../fixtures", scripts("encrypted_json")))]
+async fn ciphertext_function_returns_all_rows(pool: PgPool) -> Result<()> {
+    // Test: eql_v2.ciphertext() returns ciphertext for all encrypted rows
+    // SQL equivalent: src/operators/->_test.sql lines 70-73
+
+    let sql = format!(
+        "SELECT eql_v2.ciphertext(e -> '{}'::text) FROM encrypted",
+        Selectors::N
+    );
+
+    // All 3 records have $.n path, should return 3 ciphertext values
+    QueryAssertion::new(&pool, &sql).count(3).await;
+
+    Ok(())
+}
+
+#[sqlx::test(fixtures(path = "../fixtures", scripts("encrypted_json")))]
+async fn arrow_operator_with_encrypted_selector(pool: PgPool) -> Result<()> {
+    // Test: e -> eql_v2_encrypted selector (encrypted selector)
+    // SQL equivalent: src/operators/->_test.sql lines 39-56
+    //
+    // The -> operator can accept an eql_v2_encrypted value as the selector.
+    // The selector is created from JSONB with structure: {"s": "selector_hash"}
+
+    let encrypted_selector = Selectors::as_encrypted(Selectors::ROOT);
+    let sql = format!(
+        "SELECT e -> '{}'::jsonb::eql_v2_encrypted FROM encrypted LIMIT 1",
+        encrypted_selector
+    );
+
+    QueryAssertion::new(&pool, &sql).returns_rows().await;
+
+    Ok(())
+}
+
+#[sqlx::test(fixtures(path = "../fixtures", scripts("encrypted_json")))]
+async fn arrow_operator_with_encrypted_selector_all_rows(pool: PgPool) -> Result<()> {
+    // Test: e -> eql_v2_encrypted selector returns all matching rows
+    // SQL equivalent: src/operators/->_test.sql lines 51-54
+
+    let encrypted_selector = Selectors::as_encrypted(Selectors::ROOT);
+    let sql = format!(
+        "SELECT e -> '{}'::jsonb::eql_v2_encrypted FROM encrypted",
+        encrypted_selector
+    );
+
+    // All 3 records should have the root selector
+    QueryAssertion::new(&pool, &sql).count(3).await;
+
+    Ok(())
+}
+
+#[sqlx::test(fixtures(path = "../fixtures", scripts("encrypted_json")))]
+async fn double_arrow_operator_with_encrypted_selector(pool: PgPool) -> Result<()> {
+    // Test: e ->> eql_v2_encrypted selector (encrypted selector)
+    // SQL equivalent: src/operators/->>_test.sql lines 50-67
+    //
+    // The ->> operator can also accept an eql_v2_encrypted value as the selector.
+
+    let encrypted_selector = Selectors::as_encrypted(Selectors::ROOT);
+    let sql = format!(
+        "SELECT e ->> '{}'::jsonb::eql_v2_encrypted FROM encrypted LIMIT 1",
+        encrypted_selector
+    );
+
+    QueryAssertion::new(&pool, &sql).returns_rows().await;
+
+    Ok(())
+}
+
+#[sqlx::test(fixtures(path = "../fixtures", scripts("encrypted_json")))]
+async fn double_arrow_operator_with_encrypted_selector_all_rows(pool: PgPool) -> Result<()> {
+    // Test: e ->> eql_v2_encrypted selector returns all matching rows
+    // SQL equivalent: src/operators/->>_test.sql lines 62-65
+
+    let encrypted_selector = Selectors::as_encrypted(Selectors::ROOT);
+    let sql = format!(
+        "SELECT e ->> '{}'::jsonb::eql_v2_encrypted FROM encrypted",
+        encrypted_selector
+    );
+
+    // All 3 records should have the root selector
+    QueryAssertion::new(&pool, &sql).count(3).await;
+
+    Ok(())
+}