Skip to content

Commit eb5edd4

Browse files
authored
Merge pull request #298 from cipherstash/docs/add-limitations
Add more notes on json limitations
2 parents 23dac3c + 6dc38b4 commit eb5edd4

File tree

1 file changed

+19
-0
lines changed

1 file changed

+19
-0
lines changed

docs/reference/searchable-json.md

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ This document outlines the supported JSONB functions and operators in CipherStas
66
## Table of Contents
77

88
- [Setup](#setup)
9+
- [Important Limtiations](#important-limitations)
910
- [Operators](#operators)
1011
- [->](#field_access_operator)
1112
- [->>](#field_access_as_text_operator)
@@ -59,6 +60,24 @@ Examples assume an encrypted JSON document with the following structure:
5960
```
6061

6162

63+
## Important Limitations
64+
65+
Encrypted literals cannot be passed as arguments to SQL functions. Encrypted columns can only be passed to SQL functions if the value has an encrypted search index that supports that specific function.
66+
67+
Examples:
68+
- `AVG()` cannot be used on encrypted numeric values ❌
69+
- `MIN()` and `MAX()` can be used on encrypted values with ORE index ✅
70+
- `LOWER()` cannot be used on encrypted text (operates only on plaintext) ❌
71+
72+
⚠️ **CAST Operations**: CAST operations cannot work on encrypted data because casting would require decryption within the database, which is impossible. EQL's `ste_vec` configuration enables direct comparison and ordering operations on encrypted values without requiring CAST.
73+
74+
⚠️ **Chained Operators**: The `->` operator cannot be chained on `ste_vec` encrypted columns. Use JSONPath functions like `jsonb_path_query_first()` for deep nested access instead.
75+
76+
⚠️ **Array Access**: A selector path to an array field `$.array` will return the decrypted array as a json literal To access an encrypted array as an array of encrypted values (for use with functions like `jsonb_array_length`) requires the special EQL array element selector `[@]`. The selector is an extension of JSONPath and works similar to the standard wildcard `[*]` path. The wildcard selector follows the default PostgreSQL behaviour and will return the array elements as a setof encrypted values.
77+
78+
79+
80+
6281
---------------------------------------------------------------
6382

6483
## Operators

0 commit comments

Comments
 (0)