perf: batch entry decryption into a single agent round trip

src/bin/rbw-agent/actions.rs

@@ -688,6 +688,32 @@ pub async fn decrypt(
     Ok(())
 }
 
+pub async fn decrypt_many(
+    sock: &mut crate::sock::Sock,
+    state: std::sync::Arc<tokio::sync::Mutex<crate::state::State>>,
+    environment: &rbw::protocol::Environment,
+    items: &[rbw::protocol::DecryptItem],
+) -> anyhow::Result<()> {
+    let mut plaintexts = Vec::with_capacity(items.len());
+    for item in items {
+        plaintexts.push(
+            decrypt_cipher(
+                state.clone(),
+                environment,
+                &item.cipherstring,
+                item.entry_key.as_deref(),
+                item.org_id.as_deref(),
+            )
+            .await
+            .map_err(|e| format!("{e:#}")),
+        );
+    }
+    sock.send(&rbw::protocol::Response::DecryptMany { plaintexts })
+        .await?;
+
+    Ok(())
+}
+
 pub async fn encrypt(
     sock: &mut crate::sock::Sock,
     state: std::sync::Arc<tokio::sync::Mutex<crate::state::State>>,

src/bin/rbw-agent/agent.rs

@@ -162,6 +162,16 @@ async fn handle_request(
             .await?;
             true
         }
+        rbw::protocol::Action::DecryptMany { items } => {
+            crate::actions::decrypt_many(
+                sock,
+                state.clone(),
+                &environment,
+                items,
+            )
+            .await?;
+            true
+        }
         rbw::protocol::Action::Encrypt { plaintext, org_id } => {
             crate::actions::encrypt(
                 sock,

src/bin/rbw/actions.rs

@@ -105,6 +105,27 @@ pub fn decrypt(
     }
 }
 
+// decrypt a batch of cipherstrings with a single agent round trip; each
+// item succeeds or fails individually
+pub fn decrypt_many(
+    items: Vec<rbw::protocol::DecryptItem>,
+) -> anyhow::Result<Vec<Result<String, String>>> {
+    let mut sock = connect()?;
+    sock.send(&rbw::protocol::Request::new(
+        get_environment(),
+        rbw::protocol::Action::DecryptMany { items },
+    ))?;
+
+    let res = sock.recv()?;
+    match res {
+        rbw::protocol::Response::DecryptMany { plaintexts } => Ok(plaintexts),
+        rbw::protocol::Response::Error { error } => {
+            Err(anyhow::anyhow!("failed to decrypt: {error}"))
+        }
+        _ => Err(anyhow::anyhow!("unexpected message: {res:?}")),
+    }
+}
+
 pub fn encrypt(
     plaintext: &str,
     org_id: Option<&str>,