Add prototype encrypted CAS blobs

crates/geth/tests/bootstrap.rs

@@ -269,6 +269,71 @@ fn initialized_node_can_roundtrip_cas_blob() {
     );
 }
 
+#[test]
+fn private_cas_blob_uses_resource_secret_epoch() {
+    let home = tempfile::tempdir().expect("tempdir");
+    let paths = geth_config::GethPaths::from_home(home.path());
+    let node = geth_node::init_node(&paths).expect("init node");
+    let resource = "resource:cas:local".to_owned();
+    geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::SecretCreate {
+            resource: resource.clone(),
+        },
+    )
+    .expect("create resource secret");
+    let input = home.path().join("private.txt");
+    std::fs::write(&input, b"private blob bytes").expect("write private input");
+
+    let added = geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::CasAddPrivate {
+            resource: resource.clone(),
+            path: input,
+        },
+    )
+    .expect("add private blob");
+    let encrypted_hash = match added {
+        geth_control::ControlResponse::CasPrivateAdded {
+            encrypted_hash,
+            plaintext_hash,
+            epoch,
+            ..
+        } => {
+            assert_eq!(epoch, 1);
+            assert_eq!(plaintext_hash, geth_cas::hash_bytes(b"private blob bytes"));
+            encrypted_hash
+        }
+        other => panic!("unexpected private add response: {other:?}"),
+    };
+
+    let out = home.path().join("private-out.txt");
+    let got = geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::CasGetPrivate {
+            resource,
+            hash: encrypted_hash,
+            out: out.clone(),
+        },
+    )
+    .expect("get private blob");
+    match got {
+        geth_control::ControlResponse::CasPrivateGot {
+            plaintext_hash,
+            size_bytes,
+            ..
+        } => {
+            assert_eq!(plaintext_hash, geth_cas::hash_bytes(b"private blob bytes"));
+            assert_eq!(size_bytes, b"private blob bytes".len() as u64);
+        }
+        other => panic!("unexpected private get response: {other:?}"),
+    }
+    assert_eq!(
+        std::fs::read(out).expect("read private out"),
+        b"private blob bytes"
+    );
+}
+
 #[test]
 fn cas_pin_unpin_updates_local_pin_metadata() {
     let home = tempfile::tempdir().expect("tempdir");