security: never return ciphertext on decryption auth failure (#286)

On an encrypted DB the read path (entity_from_row), FTS reindex, and the history
content-change check used decrypt(...).unwrap_or(raw), so a GCM/AAD authentication
failure (wrong key or tampered/AAD-mismatched ciphertext) was swallowed and the
raw ciphertext returned/indexed as the plaintext body — nullifying the AES-256-GCM
integrity guarantee. Add EncryptionManager::decrypt_body which distinguishes
decrypted plaintext, legacy plaintext (mixed DBs still work — JSON bodies are never
valid base64), and authentication failure; read paths now refuse the bytes on
failure (error sentinel + warning for recall; empty FTS entry so ciphertext is
never indexed). 5 new tests (roundtrip, legacy passthrough, tamper/wrong-aad/
wrong-key). Full suite 103 passed.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: tcconnally

CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to Mimir are documented here. This project adheres to
 
 ## [Unreleased]
 
+### Security
+- **Decryption failures no longer silently return ciphertext.** On an encrypted DB,
+  the read path (`entity_from_row`), FTS reindex, and the history content-change
+  check used `decrypt(...).unwrap_or(raw)`, so any authentication failure — wrong
+  key, or AAD-mismatched / tampered ciphertext (exactly what AES-256-GCM + AAD exist
+  to detect) — was swallowed and the raw ciphertext was returned/indexed as if it
+  were the plaintext body. That nullified the integrity guarantee: an attacker who
+  could write to the DB file could tamper with a body and have it surface
+  undetected. New `EncryptionManager::decrypt_body` classifies the input as
+  decrypted plaintext, a legacy plaintext row (a real JSON body is never valid
+  base64, so mixed DBs still work), or an authentication failure — and read paths
+  now refuse to return the bytes on failure (a clear error sentinel + stderr warning
+  for recall; an empty FTS entry so ciphertext is never indexed). Regression tests
+  cover roundtrip, legacy-plaintext passthrough, and tamper / wrong-AAD / wrong-key
+  rejection.
+
 ## [2.7.0] - 2026-06-28
 
 ### Distribution

src/db.rs

@@ -735,9 +735,21 @@ impl Database {
             let mut count = 0usize;
             for (rowid, category, key, raw_body) in rows {
                 let aad = format!("{}:{}", category, key);
-                // Fall back to raw on decrypt failure (e.g. a row written before
-                // encryption was enabled), mirroring entity_from_row.
-                let plain = enc.decrypt(&raw_body, aad.as_bytes()).unwrap_or(raw_body);
+                // Index decrypted text, or a legacy plaintext row. On an
+                // authentication failure (wrong key / tampered), index an empty
+                // body rather than the ciphertext: putting ciphertext into the
+                // plaintext FTS index would both leak it and corrupt search.
+                let plain = match enc.decrypt_body(&raw_body, aad.as_bytes()) {
+                    crate::encryption::BodyDecrypt::Plaintext(s)
+                    | crate::encryption::BodyDecrypt::LegacyPlaintext(s) => s,
+                    crate::encryption::BodyDecrypt::AuthFailed(e) => {
+                        eprintln!(
+                            "mimir: reindex skipping body text for {}:{} — decryption {}.",
+                            category, key, e
+                        );
+                        "{}".to_string()
+                    }
+                };
                 insert.execute(params![rowid, plain])?;
                 count += 1;
             }
@@ -1252,8 +1264,16 @@ impl Database {
                 .unwrap_or_default();
             let old_plain_body = if let Some(ref enc) = self.encryption {
                 let aad = format!("{}:{}", entity.category, entity.key);
-                enc.decrypt(&old_raw_body, aad.as_bytes())
-                    .unwrap_or_else(|_| old_raw_body.clone())
+                match enc.decrypt_body(&old_raw_body, aad.as_bytes()) {
+                    crate::encryption::BodyDecrypt::Plaintext(s)
+                    | crate::encryption::BodyDecrypt::LegacyPlaintext(s) => s,
+                    // Can't authenticate the prior body: do NOT compare against
+                    // ciphertext. Use a sentinel so content_changed is true and we
+                    // conservatively snapshot history.
+                    crate::encryption::BodyDecrypt::AuthFailed(_) => {
+                        "\u{0}__mimir_undecryptable__".to_string()
+                    }
+                }
             } else {
                 old_raw_body.clone()
             };
@@ -4543,8 +4563,24 @@ fn entity_from_row(
         let cat: String = row.get(1)?;
         let k: String = row.get(2)?;
         let aad = format!("{}:{}", cat, k);
-        enc.decrypt(&raw_body_json, aad.as_bytes())
-            .unwrap_or(raw_body_json) // Fall back to raw if decryption fails (unencrypted DB)
+        match enc.decrypt_body(&raw_body_json, aad.as_bytes()) {
+            // Decrypted ciphertext, or a legacy plaintext row in a mixed DB.
+            crate::encryption::BodyDecrypt::Plaintext(s)
+            | crate::encryption::BodyDecrypt::LegacyPlaintext(s) => s,
+            // Authentic-looking ciphertext that failed GCM auth (wrong key or
+            // tampered). Never return the raw ciphertext — that would silently
+            // defeat the AES-256-GCM/AAD integrity guarantee. Surface a sentinel
+            // and warn instead.
+            crate::encryption::BodyDecrypt::AuthFailed(e) => {
+                eprintln!(
+                    "mimir: refusing to return body for {}:{} — decryption {}. \
+                     Wrong key or tampered ciphertext.",
+                    cat, k, e
+                );
+                "{\"error\":\"mimir: body decryption failed (wrong key or tampered ciphertext)\"}"
+                    .to_string()
+            }
+        }
     } else {
         raw_body_json
     };

src/encryption.rs

@@ -9,6 +9,21 @@ pub struct EncryptionManager {
     cipher: Aes256Gcm,
 }
 
+/// Result of attempting to decrypt a stored `body_json` in a possibly-mixed DB
+/// (one where encryption was enabled after some rows were already written plain).
+pub enum BodyDecrypt {
+    /// Ciphertext that authenticated and decrypted successfully.
+    Plaintext(String),
+    /// The stored value is not Mimir ciphertext at all (a legacy plaintext row);
+    /// it is safe to use as-is. JSON bodies always start with `{`, which is not in
+    /// the base64 alphabet, so real plaintext is reliably classified here.
+    LegacyPlaintext(String),
+    /// The value WAS well-formed ciphertext but failed authentication — wrong key
+    /// or tampered / AAD-mismatched data. The raw bytes MUST NOT be returned to the
+    /// caller; doing so would silently defeat the AES-256-GCM integrity guarantee.
+    AuthFailed(String),
+}
+
 impl EncryptionManager {
     /// Load an encryption key from a base64-encoded key file.
     /// Supports `~` expansion for home directory paths.
@@ -101,4 +116,109 @@ impl EncryptionManager {
         String::from_utf8(plaintext)
             .map_err(|e| format!("Decrypted data is not valid UTF-8: {}", e))
     }
+
+    /// Mixed-DB-aware decrypt for stored bodies. Distinguishes a legacy plaintext
+    /// row (not ciphertext at all -> safe to pass through) from authentic-looking
+    /// ciphertext that fails GCM authentication (wrong key or tampering -> the raw
+    /// value must NOT be used). This is the variant read paths should use: the old
+    /// `decrypt(...).unwrap_or(raw)` pattern silently returned ciphertext on an
+    /// auth failure, nullifying the AAD tamper-detection guarantee.
+    pub fn decrypt_body(&self, encoded: &str, aad: &[u8]) -> BodyDecrypt {
+        let combined = match B64.decode(encoded) {
+            Ok(c) => c,
+            // Not base64 -> cannot be our ciphertext -> legacy plaintext row.
+            Err(_) => return BodyDecrypt::LegacyPlaintext(encoded.to_string()),
+        };
+        // Mimir ciphertext is nonce(12) + GCM tag(16) + body(>=0) = >= 28 bytes.
+        // Anything shorter is not our ciphertext.
+        if combined.len() < 12 + 16 {
+            return BodyDecrypt::LegacyPlaintext(encoded.to_string());
+        }
+        let (nonce_bytes, ciphertext) = combined.split_at(12);
+        let nonce = Nonce::from_slice(nonce_bytes);
+        let payload = aes_gcm::aead::Payload {
+            msg: ciphertext,
+            aad: if aad.is_empty() { b"" } else { aad },
+        };
+        match self.cipher.decrypt(nonce, payload) {
+            Ok(pt) => match String::from_utf8(pt) {
+                Ok(s) => BodyDecrypt::Plaintext(s),
+                Err(e) => BodyDecrypt::AuthFailed(format!("decrypted bytes not UTF-8: {}", e)),
+            },
+            Err(e) => BodyDecrypt::AuthFailed(format!("authentication failed: {}", e)),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn mgr() -> EncryptionManager {
+        let key = Key::<Aes256Gcm>::from_slice(&[7u8; 32]);
+        EncryptionManager {
+            cipher: Aes256Gcm::new(key),
+        }
+    }
+
+    #[test]
+    fn decrypt_body_roundtrip_is_plaintext() {
+        let m = mgr();
+        let ct = m.encrypt("{\"note\":\"hello\"}", b"cat:key").unwrap();
+        match m.decrypt_body(&ct, b"cat:key") {
+            BodyDecrypt::Plaintext(s) => assert_eq!(s, "{\"note\":\"hello\"}"),
+            _ => panic!("expected Plaintext"),
+        }
+    }
+
+    #[test]
+    fn legacy_plaintext_passes_through() {
+        // A real JSON body starts with '{' (not base64) -> classified legacy plaintext.
+        let m = mgr();
+        match m.decrypt_body("{\"note\":\"legacy unencrypted row\"}", b"cat:key") {
+            BodyDecrypt::LegacyPlaintext(s) => assert!(s.contains("legacy")),
+            _ => panic!("expected LegacyPlaintext"),
+        }
+    }
+
+    #[test]
+    fn tampered_ciphertext_is_authfailed_not_returned() {
+        let m = mgr();
+        let ct = m.encrypt("{\"secret\":\"x\"}", b"cat:key").unwrap();
+        // Flip a byte in the base64 ciphertext body (after the nonce region).
+        let mut bytes = ct.into_bytes();
+        let i = bytes.len() - 4;
+        bytes[i] = if bytes[i] == b'A' { b'B' } else { b'A' };
+        let tampered = String::from_utf8(bytes).unwrap();
+        match m.decrypt_body(&tampered, b"cat:key") {
+            BodyDecrypt::AuthFailed(_) => {}
+            BodyDecrypt::Plaintext(_) => panic!("tampered ciphertext authenticated (GCM broken?)"),
+            BodyDecrypt::LegacyPlaintext(s) => {
+                panic!("tampered ciphertext returned as plaintext: {}", s)
+            }
+        }
+    }
+
+    #[test]
+    fn wrong_aad_is_authfailed() {
+        let m = mgr();
+        let ct = m.encrypt("{\"a\":1}", b"cat:key").unwrap();
+        match m.decrypt_body(&ct, b"different:aad") {
+            BodyDecrypt::AuthFailed(_) => {}
+            _ => panic!("AAD mismatch must fail authentication"),
+        }
+    }
+
+    #[test]
+    fn wrong_key_is_authfailed() {
+        let m = mgr();
+        let ct = m.encrypt("{\"a\":1}", b"cat:key").unwrap();
+        let other = EncryptionManager {
+            cipher: Aes256Gcm::new(Key::<Aes256Gcm>::from_slice(&[9u8; 32])),
+        };
+        match other.decrypt_body(&ct, b"cat:key") {
+            BodyDecrypt::AuthFailed(_) => {}
+            _ => panic!("wrong key must fail authentication"),
+        }
+    }
 }