Translate CompletionException to GeneralSecurityException in AwsKmsAead

src/main/java/com/google/crypto/tink/integration/awskms/AwsKmsAead.java

@@ -22,6 +22,7 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.concurrent.CompletionException;
 import software.amazon.awssdk.core.SdkBytes;
 import software.amazon.awssdk.core.exception.SdkClientException;
 import software.amazon.awssdk.services.kms.KmsClient;
@@ -67,6 +68,17 @@ public byte[] encrypt(final byte[] plaintext, final byte[] associatedData)
       return response.ciphertextBlob().asByteArray();
     } catch (SdkClientException | KmsException e) {
       throw new GeneralSecurityException("encryption failed", e);
+    } catch (CompletionException e) {
+      // The SDK's internal synchronous credential resolution can throw this, still wrapping its
+      // cause, when that cause is not itself a RuntimeException (e.g. a credentials provider that
+      // fails with a checked exception). Only that specific checked-cause shape is translated; a
+      // null, RuntimeException, or Error cause means this isn't that shape, so the
+      // CompletionException itself is rethrown unchanged rather than guessed at.
+      Throwable cause = e.getCause();
+      if (cause == null || cause instanceof RuntimeException || cause instanceof Error) {
+        throw e;
+      }
+      throw new GeneralSecurityException("encryption failed", cause);
     }
   }
 
@@ -95,6 +107,13 @@ public byte[] decrypt(final byte[] ciphertext, final byte[] associatedData)
       return result.plaintext().asByteArray();
     } catch (SdkClientException | KmsException e) {
       throw new GeneralSecurityException("decryption failed", e);
+    } catch (CompletionException e) {
+      // See the comment in encrypt() above.
+      Throwable cause = e.getCause();
+      if (cause == null || cause instanceof RuntimeException || cause instanceof Error) {
+        throw e;
+      }
+      throw new GeneralSecurityException("decryption failed", cause);
     }
   }
 

src/test/java/com/google/crypto/tink/integration/awskms/AwsKmsAeadTest.java

@@ -24,11 +24,16 @@
 import com.google.crypto.tink.aead.AeadConfig;
 import com.google.crypto.tink.subtle.Random;
 import java.security.GeneralSecurityException;
+import java.util.concurrent.CompletionException;
 import org.junit.BeforeClass;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.junit.runners.JUnit4;
 import software.amazon.awssdk.services.kms.KmsClient;
+import software.amazon.awssdk.services.kms.model.DecryptRequest;
+import software.amazon.awssdk.services.kms.model.DecryptResponse;
+import software.amazon.awssdk.services.kms.model.EncryptRequest;
+import software.amazon.awssdk.services.kms.model.EncryptResponse;
 
 /** Tests for AwsKmsAead. */
 @RunWith(JUnit4.class)
@@ -123,4 +128,169 @@ public void testDecryptWithInvalidKeyArn_success() throws Exception {
     Aead aeadWithInvalidArn = new AwsKmsAead(kms, invalidArn);
     assertThat(aeadWithInvalidArn.decrypt(ciphertext, aad)).isEqualTo(message);
   }
+
+  @Test
+  public void testEncryptWithCompletionExceptionCause_translatedToGeneralSecurityException()
+      throws Exception {
+    GeneralSecurityException credentialFailure =
+        new GeneralSecurityException("credential refresh failed");
+    KmsClient kms = new ThrowingKmsClient(new CompletionException(credentialFailure));
+    Aead aead = new AwsKmsAead(kms, KEY_ARN);
+
+    GeneralSecurityException thrown =
+        assertThrows(
+            GeneralSecurityException.class,
+            () -> aead.encrypt(Random.randBytes(20), Random.randBytes(20)));
+
+    assertThat(thrown).hasCauseThat().isEqualTo(credentialFailure);
+  }
+
+  @Test
+  public void testDecryptWithCompletionExceptionCause_translatedToGeneralSecurityException()
+      throws Exception {
+    GeneralSecurityException credentialFailure =
+        new GeneralSecurityException("credential refresh failed");
+    KmsClient kms = new ThrowingKmsClient(new CompletionException(credentialFailure));
+    Aead aead = new AwsKmsAead(kms, KEY_ARN);
+
+    GeneralSecurityException thrown =
+        assertThrows(
+            GeneralSecurityException.class,
+            () -> aead.decrypt(Random.randBytes(20), Random.randBytes(20)));
+
+    assertThat(thrown).hasCauseThat().isEqualTo(credentialFailure);
+  }
+
+  @Test
+  public void
+      testEncryptWithCompletionExceptionUnrelatedCheckedCause_translatedToGeneralSecurityException()
+          throws Exception {
+    java.io.IOException unrelatedFailure = new java.io.IOException("unrelated checked failure");
+    KmsClient kms = new ThrowingKmsClient(new CompletionException(unrelatedFailure));
+    Aead aead = new AwsKmsAead(kms, KEY_ARN);
+
+    GeneralSecurityException thrown =
+        assertThrows(
+            GeneralSecurityException.class,
+            () -> aead.encrypt(Random.randBytes(20), Random.randBytes(20)));
+
+    assertThat(thrown).hasCauseThat().isEqualTo(unrelatedFailure);
+  }
+
+  @Test
+  public void testEncryptWithCompletionExceptionRuntimeExceptionCause_propagatedUnchanged()
+      throws Exception {
+    CompletionException exception = new CompletionException(new IllegalStateException("bug"));
+    KmsClient kms = new ThrowingKmsClient(exception);
+    Aead aead = new AwsKmsAead(kms, KEY_ARN);
+
+    CompletionException thrown =
+        assertThrows(
+            CompletionException.class,
+            () -> aead.encrypt(Random.randBytes(20), Random.randBytes(20)));
+
+    assertThat(thrown).isSameInstanceAs(exception);
+  }
+
+  @Test
+  public void testDecryptWithCompletionExceptionRuntimeExceptionCause_propagatedUnchanged()
+      throws Exception {
+    CompletionException exception = new CompletionException(new IllegalStateException("bug"));
+    KmsClient kms = new ThrowingKmsClient(exception);
+    Aead aead = new AwsKmsAead(kms, KEY_ARN);
+
+    CompletionException thrown =
+        assertThrows(
+            CompletionException.class,
+            () -> aead.decrypt(Random.randBytes(20), Random.randBytes(20)));
+
+    assertThat(thrown).isSameInstanceAs(exception);
+  }
+
+  @Test
+  public void testEncryptWithCompletionExceptionErrorCause_propagatedUnchanged() throws Exception {
+    CompletionException exception = new CompletionException(new AssertionError("fatal"));
+    KmsClient kms = new ThrowingKmsClient(exception);
+    Aead aead = new AwsKmsAead(kms, KEY_ARN);
+
+    CompletionException thrown =
+        assertThrows(
+            CompletionException.class,
+            () -> aead.encrypt(Random.randBytes(20), Random.randBytes(20)));
+
+    assertThat(thrown).isSameInstanceAs(exception);
+  }
+
+  @Test
+  public void testDecryptWithCompletionExceptionErrorCause_propagatedUnchanged() throws Exception {
+    CompletionException exception = new CompletionException(new AssertionError("fatal"));
+    KmsClient kms = new ThrowingKmsClient(exception);
+    Aead aead = new AwsKmsAead(kms, KEY_ARN);
+
+    CompletionException thrown =
+        assertThrows(
+            CompletionException.class,
+            () -> aead.decrypt(Random.randBytes(20), Random.randBytes(20)));
+
+    assertThat(thrown).isSameInstanceAs(exception);
+  }
+
+  @Test
+  public void testEncryptWithCauselessCompletionException_propagatedUnchanged() throws Exception {
+    CompletionException exception = new CompletionException("no cause", null);
+    KmsClient kms = new ThrowingKmsClient(exception);
+    Aead aead = new AwsKmsAead(kms, KEY_ARN);
+
+    CompletionException thrown =
+        assertThrows(
+            CompletionException.class,
+            () -> aead.encrypt(Random.randBytes(20), Random.randBytes(20)));
+
+    assertThat(thrown).isSameInstanceAs(exception);
+  }
+
+  @Test
+  public void testDecryptWithCauselessCompletionException_propagatedUnchanged() throws Exception {
+    CompletionException exception = new CompletionException("no cause", null);
+    KmsClient kms = new ThrowingKmsClient(exception);
+    Aead aead = new AwsKmsAead(kms, KEY_ARN);
+
+    CompletionException thrown =
+        assertThrows(
+            CompletionException.class,
+            () -> aead.decrypt(Random.randBytes(20), Random.randBytes(20)));
+
+    assertThat(thrown).isSameInstanceAs(exception);
+  }
+
+  /**
+   * A fake {@link KmsClient} whose {@code encrypt}/{@code decrypt} always throw a given {@link
+   * CompletionException}, simulating what the AWS SDK's internal synchronous credential resolution
+   * does when the configured credentials provider fails with a checked exception.
+   */
+  private static final class ThrowingKmsClient implements KmsClient {
+    private final CompletionException exception;
+
+    ThrowingKmsClient(CompletionException exception) {
+      this.exception = exception;
+    }
+
+    @Override
+    public EncryptResponse encrypt(EncryptRequest request) {
+      throw exception;
+    }
+
+    @Override
+    public DecryptResponse decrypt(DecryptRequest request) {
+      throw exception;
+    }
+
+    @Override
+    public String serviceName() {
+      return "kms";
+    }
+
+    @Override
+    public void close() {}
+  }
 }