python: decrypt raises a bare Python error, with no code, when converting an opened value fails for a reason other than the value #1641

Background

The Python SDK, stackencrypt in languages/python, gives every error it raises a code, such as decrypt_not_representable, and the field it is about. An app can then handle errors by code, and never needs to parse a message.

Cipher.decrypt opens each stored value, then converts it into a Python value, such as a datetime.date or a decimal.Decimal.

Problem

python_value in languages/python/crates/engine/src/decrypt.rs:237 gives a code only to a value that does not fit its Python type. Any other failure in the conversion, to_python in languages/python/crates/engine/src/values.rs:371, goes up through ? as a plain Python exception. It has no code, no field, and it is not a StashError.

The failures that can still take that path are not about the value:

• a MemoryError while building a Python object
• a failed import of datetime (values.rs:394), or of another module the conversion imports

These are rare, and they happen after the keys were fetched. An app that catches StashError around decrypt does not catch them.

Proposal

1. Decide whether these failures should keep Python's own exception. That is the usual behaviour for a MemoryError, and it is what the code does now. The other choice is to wrap them in a StashError with a code such as decrypt_failed and the field's name.
2. Whichever is chosen, document it in the README's list of decrypt errors, so that an app knows what to catch.

Relationship to other work

• Left open on purpose in review: feat(python): decrypt rows back into models #1509 (comment)
• Part of the Python SDK work in Python SDK: core call over psycopg, on EQL v4 and Stack Encrypt #1341.