Validate that reserve bytes are set when uploading db with encryption (#1009)

fixes #1008 

This patch validates that the db being uploaded has set the correct
reserved bytes. If it isn't set, then it prints an error and
instructions on how to set it:

```
$ turso db create --remote-encryption-key "gq2LqyS...DPOY=" --remote-encryption-cipher aegis256 --from-file my.db

Error: database reserved bytes mismatch: found 12, but cipher 'aegis256' requires 48 reserved bytes.
To fix this, run:

  $ sqlite3 my.db
  sqlite> .filectrl reserve_bytes 48
  sqlite> VACUUM;
```

Author: avinassh

internal/cmd/db_create.go

@@ -21,6 +21,29 @@ func showSchemaDeprecationNotice() {
 
 const MaxDumpFileSizeBytes = 8 << 30
 
+// cipherReservedBytes maps cipher names to their required reserved bytes
+var cipherReservedBytes = map[string]int{
+	"aes256gcm":        28,
+	"aes128gcm":        28,
+	"chacha20poly1305": 28,
+	"aegis128l":        32,
+	"aegis128x2":       32,
+	"aegis128x4":       32,
+	"aegis256":         48,
+	"aegis256x2":       48,
+	"aegis256x4":       48,
+}
+
+func isValidCipher(cipher string) bool {
+	_, ok := cipherReservedBytes[cipher]
+	return ok
+}
+
+func getRequiredReservedBytes(cipher string) (int, bool) {
+	bytes, ok := cipherReservedBytes[cipher]
+	return bytes, ok
+}
+
 func init() {
 	dbCmd.AddCommand(createCmd)
 	addGroupFlag(createCmd)
@@ -86,7 +109,12 @@ func CreateDatabase(name string) error {
 	}
 
 	isAWS := strings.HasPrefix(group.Primary, "aws-")
-	seed, err := parseDBSeedFlags(client, isAWS)
+
+	if err = validateEncryptionFlags(); err != nil {
+		return err
+	}
+
+	seed, err := parseDBSeedFlags(client, isAWS, remoteEncryptionCipherFlag)
 	if err != nil {
 		return err
 	}
@@ -96,10 +124,6 @@ func CreateDatabase(name string) error {
 		version = "canary"
 	}
 
-	if err = validateEncryptionFlags(); err != nil {
-		return err
-	}
-
 	if err := ensureGroup(client, groupName, groups, location, version); err != nil {
 		return err
 	}
@@ -233,13 +257,18 @@ func validateEncryptionFlags() error {
 		return fmt.Errorf("encryption key (%s) is not valid base64: %w", remoteEncryptionKey, err)
 	}
 
-	if remoteEncryptionCipherFlag != "" {
-		return nil
-	}
-
 	// if cipher is empty, then it is only valid in case of forks and for everything else we need to have it set
-	if fromDBFlag == "" {
+	if remoteEncryptionCipherFlag == "" && fromDBFlag == "" {
 		return fmt.Errorf("remote encryption cipher must be provided when remote encryption key is set")
 	}
+
+	if !isValidCipher(remoteEncryptionCipherFlag) {
+		validCiphers := make([]string, 0, len(cipherReservedBytes))
+		for cipher := range cipherReservedBytes {
+			validCiphers = append(validCiphers, cipher)
+		}
+		return fmt.Errorf("unknown encryption cipher: %s. Valid ciphers are: %s", remoteEncryptionCipherFlag, strings.Join(validCiphers, ", "))
+	}
+
 	return nil
 }

internal/cmd/group_flag.go

@@ -8,6 +8,7 @@ import (
 	"log"
 	"os"
 	"os/exec"
+	"strconv"
 	"strings"
 	"time"
 
@@ -64,7 +65,7 @@ func parseTimestampFlag() (*time.Time, error) {
 	return &timestamp, nil
 }
 
-func parseDBSeedFlags(client *turso.Client, isAWS bool) (*turso.DBSeed, error) {
+func parseDBSeedFlags(client *turso.Client, isAWS bool, cipher string) (*turso.DBSeed, error) {
 	if countFlags(fromDBFlag, fromDumpFlag, fromFileFlag, fromDumpURLFlag, fromCSVFlag) > 1 {
 		return nil, errors.New("only one of --from prefixed flags can be used at a time")
 	}
@@ -85,7 +86,7 @@ func parseDBSeedFlags(client *turso.Client, isAWS bool) (*turso.DBSeed, error) {
 	}
 
 	if fromFileFlag != "" {
-		return handleDBFile(client, fromFileFlag, isAWS)
+		return handleDBFile(client, fromFileFlag, isAWS, cipher)
 	}
 
 	if fromDumpFlag != "" {
@@ -97,7 +98,7 @@ func parseDBSeedFlags(client *turso.Client, isAWS bool) (*turso.DBSeed, error) {
 		if err != nil {
 			return nil, err
 		}
-		return handleCSVFile(client, fromCSVFlag, csvTableNameFlag, csvSeparator)
+		return handleCSVFile(client, fromCSVFlag, csvTableNameFlag, csvSeparator, cipher)
 	}
 	if fromDumpURLFlag != "" {
 		return handleDumpURL(fromDumpURLFlag)
@@ -205,7 +206,50 @@ func checkIfDump(filename string) (bool, error) {
 	}
 }
 
-func sqliteFileIntegrityChecks(file string) error {
+// getReservedBytes retrieves the current reserved bytes setting from a SQLite database
+func getReservedBytes(dbPath string) (int, error) {
+	output, err := exec.Command("sqlite3", dbPath, ".filectrl reserve_bytes").CombinedOutput()
+	if err != nil {
+		return 0, fmt.Errorf("failed to get reserved bytes: %w", err)
+	}
+	outputStr := strings.TrimSpace(string(output))
+
+	if strings.Contains(outputStr, ":") {
+		parts := strings.Split(outputStr, ":")
+		if len(parts) >= 2 {
+			outputStr = strings.TrimSpace(parts[1])
+		}
+	}
+
+	reservedBytes, err := strconv.Atoi(outputStr)
+	if err != nil {
+		return 0, fmt.Errorf("failed to parse reserved bytes from output '%s': %w", string(output), err)
+	}
+
+	return reservedBytes, nil
+}
+
+// validateReservedBytes checks if the database has the required reserved bytes for the given cipher
+func validateReservedBytes(dbPath string, cipher string) error {
+	requiredBytes, ok := getRequiredReservedBytes(cipher)
+	if !ok {
+		return nil
+	}
+
+	currentBytes, err := getReservedBytes(dbPath)
+	if err != nil {
+		return err
+	}
+
+	if currentBytes != requiredBytes {
+		return fmt.Errorf("database reserved bytes mismatch: found %d, but cipher '%s' requires %d reserved bytes.\nTo fix this, run:\n\n  $ sqlite3 %s\n  sqlite> .filectrl reserve_bytes %d\n  sqlite> VACUUM;",
+			currentBytes, cipher, requiredBytes, dbPath, requiredBytes)
+	}
+
+	return nil
+}
+
+func sqliteFileIntegrityChecks(file string, cipher string) error {
 	if flags.Debug() {
 		log.Printf("Running integrity checks on database file %s", file)
 	}
@@ -268,11 +312,19 @@ func sqliteFileIntegrityChecks(file string) error {
 		return fmt.Errorf("integrity check on database failed: %w", err)
 	}
 
+	// validate reserved bytes if encryption cipher is specified
+	if cipher != "" {
+		if flags.Debug() {
+			log.Printf("Checking reserved bytes for cipher %s...", cipher)
+		}
+		return validateReservedBytes(file, cipher)
+	}
+
 	return nil
 }
 
-func handleDBFileAWS(file string) (*turso.DBSeed, error) {
-	if err := sqliteFileIntegrityChecks(file); err != nil {
+func handleDBFileAWS(file string, cipher string) (*turso.DBSeed, error) {
+	if err := sqliteFileIntegrityChecks(file, cipher); err != nil {
 		return nil, err
 	}
 
@@ -284,7 +336,7 @@ func handleDBFileAWS(file string) (*turso.DBSeed, error) {
 	return seed, nil
 }
 
-func handleDBFile(client *turso.Client, file string, isAWS bool) (*turso.DBSeed, error) {
+func handleDBFile(client *turso.Client, file string, isAWS bool, cipher string) (*turso.DBSeed, error) {
 	if err := checkFileExists(file); err != nil {
 		return nil, err
 	}
@@ -293,7 +345,7 @@ func handleDBFile(client *turso.Client, file string, isAWS bool) (*turso.DBSeed,
 	}
 
 	if isAWS {
-		return handleDBFileAWS(file)
+		return handleDBFileAWS(file, cipher)
 	}
 
 	if err := checkSQLiteFile(file); err != nil {
@@ -363,7 +415,7 @@ func dumpSQLiteDatabase(database string, dump *os.File) error {
 	return nil
 }
 
-func handleCSVFile(client *turso.Client, file, csvTableName string, separator rune) (*turso.DBSeed, error) {
+func handleCSVFile(client *turso.Client, file, csvTableName string, separator rune, cipher string) (*turso.DBSeed, error) {
 	if err := checkFileExists(file); err != nil {
 		return nil, err
 	}
@@ -393,7 +445,7 @@ func handleCSVFile(client *turso.Client, file, csvTableName string, separator ru
 		return nil, err
 	}
 
-	seed, err := handleDBFile(client, tempDB.Name(), false)
+	seed, err := handleDBFile(client, tempDB.Name(), false, cipher)
 	if err != nil {
 		return nil, err
 	}