libmongocrypt-helper 1.7.0.0.1001 → 1.7.4.0.1000

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-assert-match-bson.h

@@ -0,0 +1,26 @@
+/*
+ * Copyright 2019-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef TEST_MONGOCRYPT_ASSERT_MATCH_BSON_H
+#define TEST_MONGOCRYPT_ASSERT_MATCH_BSON_H
+
+#include <bson/bson.h>
+
+/* Copied from libmongoc. */
+void
+_assert_match_bson (const bson_t *doc, const bson_t *pattern);
+
+#endif /* TEST_MONGOCRYPT_ASSERT_MATCH_BSON_H */

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-assert.h

@@ -0,0 +1,218 @@
+/*
+ * Copyright 2021-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef TEST_MONGOCRYPT_ASSERT_H
+#define TEST_MONGOCRYPT_ASSERT_H
+
+#include "test-mongocrypt-util.h"
+
+#include "mongocrypt.h"
+
+#include <bson/bson.h>
+
+#include <stdio.h>
+
+#define TEST_ERROR(...)                                                        \
+   do {                                                                        \
+      fprintf (                                                                \
+         stderr, "test error %s:%d %s(): ", __FILE__, __LINE__, __FUNCTION__); \
+      fprintf (stderr, __VA_ARGS__);                                           \
+      fprintf (stderr, "\n");                                                  \
+      fflush (stderr);                                                         \
+      abort ();                                                                \
+   } while (0)
+
+#define ASSERT(stmt)                             \
+   if (!(stmt)) {                                \
+      TEST_ERROR ("statement failed %s", #stmt); \
+   }
+
+#define ASSERT_OR_PRINT_MSG(_statement, msg)                        \
+   do {                                                             \
+      if (!(_statement)) {                                          \
+         TEST_ERROR ("%s failed with msg: %s", #_statement, (msg)); \
+      }                                                             \
+   } while (0)
+
+#define ASSERT_OR_PRINT(_statement, _err) \
+   ASSERT_OR_PRINT_MSG (_statement, mongocrypt_status_message (_err, NULL))
+
+#define ASSERT_OK_STATUS(_stmt, _status)                                   \
+   do {                                                                    \
+      bool _retval = (_stmt);                                              \
+      bool _status_ok = mongocrypt_status_ok (_status);                    \
+      const char *_msg = mongocrypt_status_message (_status, NULL);        \
+      if (!_retval) {                                                      \
+         TEST_ERROR ("%s failed with msg: %s\n", #_stmt, _msg);            \
+      } else if (!_status_ok) {                                            \
+         TEST_ERROR (                                                      \
+            "%s resulted in unexpected error status: %s\n", #_stmt, _msg); \
+      }                                                                    \
+   } while (0)
+
+#define ASSERT_FAILS_STATUS(_stmt, _status, _msg_pattern)                      \
+   do {                                                                        \
+      bool _retval = (_stmt);                                                  \
+      bool _status_ok = mongocrypt_status_ok (_status);                        \
+      const char *_msg = mongocrypt_status_message (_status, NULL);            \
+      bool _found_msg = _msg && strstr (_msg, _msg_pattern) != NULL;           \
+      if (_retval) {                                                           \
+         TEST_ERROR ("%s succeeded (but should have failed) with msg: '%s'\n", \
+                     #_stmt,                                                   \
+                     _msg_pattern);                                            \
+      } else if (_status_ok) {                                                 \
+         TEST_ERROR (                                                          \
+            "%s resulted in unexpected ok status: %s\n", #_stmt, _msg);        \
+      } else if (!_found_msg) {                                                \
+         TEST_ERROR ("'%s' does not contain '%s'\n", _msg, _msg_pattern);      \
+      }                                                                        \
+   } while (0)
+
+#define ASSERT_OK(_stmt, _obj) ASSERT_OK_STATUS (_stmt, (_obj)->status)
+
+#define ASSERT_FAILS(_stmt, _obj, _msg_pattern) \
+   ASSERT_FAILS_STATUS (_stmt, (_obj)->status, _msg_pattern)
+
+#define ASSERT_OR_PRINT_BSON(_statement, _err) \
+   ASSERT_OR_PRINT_MSG (_statement, _err.message)
+
+#define ASSERT_STATUS_CONTAINS(status, _msg_pattern) \
+   ASSERT_FAILS_STATUS (false, status, _msg_pattern)
+
+#define ASSERT_STREQUAL(_expr_a, _expr_b)                                  \
+   do {                                                                    \
+      const char *_str_a = (_expr_a);                                      \
+      const char *_str_b = (_expr_b);                                      \
+      ASSERT (_str_a);                                                     \
+      ASSERT (_str_b);                                                     \
+      int _ret = strcmp (_str_a, _str_b);                                  \
+      if (_ret != 0) {                                                     \
+         TEST_ERROR ("strings not equal:\n%s\nvs.\n%s\n", _str_a, _str_b); \
+      }                                                                    \
+   } while (0);
+
+#define ASSERT_STRCONTAINS(_expr_a, _expr_b)                             \
+   do {                                                                  \
+      const char *_str_a = (_expr_a);                                    \
+      const char *_str_b = (_expr_b);                                    \
+      char *_ret = strstr (_str_a, _str_b);                              \
+      if (_ret == NULL) {                                                \
+         TEST_ERROR ("string %s does not contain %s\n", _str_a, _str_b); \
+      }                                                                  \
+   } while (0);
+
+#define ASSERT_STATE_EQUAL(actual, expected)                       \
+   do {                                                            \
+      if (actual != expected) {                                    \
+         TEST_ERROR ("actual state: %s, but expected state: %s\n", \
+                     mongocrypt_ctx_state_to_string (actual),      \
+                     mongocrypt_ctx_state_to_string (expected));   \
+         abort ();                                                 \
+      }                                                            \
+   } while (0)
+
+#define ASSERT_CMPBYTES(                                                \
+   expected_bytes, expected_len, actual_bytes, actual_len)              \
+   do {                                                                 \
+      char *_actual_hex = data_to_hex (actual_bytes, actual_len);       \
+      char *_expected_hex = data_to_hex (expected_bytes, expected_len); \
+      ASSERT_STREQUAL (_actual_hex, _expected_hex);                     \
+      free (_actual_hex);                                               \
+      free (_expected_hex);                                             \
+   } while (0)
+
+#define ASSERT_CMPBUF(expected, actual) \
+   ASSERT_CMPBYTES (                    \
+      (expected).data, (expected).len, (actual).data, (actual).len)
+
+#define ASSERT_CMP_HELPER(_a, _operator, _b, fmt, type)      \
+   do {                                                      \
+      type _a_value = (_a);                                  \
+      type _b_value = (_b);                                  \
+      if (!(_a_value _operator _b_value)) {                  \
+         TEST_ERROR ("comparison failed: %" fmt " %s %" fmt, \
+                     _a_value,                               \
+                     #_operator,                             \
+                     _b_value);                              \
+      }                                                      \
+   } while (0);
+
+#define ASSERT_CMPINT(a, eq, b) ASSERT_CMP_HELPER (a, eq, b, "d", int)
+#define ASSERT_CMPUINT(a, eq, b) ASSERT_CMP_HELPER (a, eq, b, "u", unsigned int)
+#define ASSERT_CMPLONG(a, eq, b) ASSERT_CMP_HELPER (a, eq, b, "ld", long)
+#define ASSERT_CMPULONG(a, eq, b) \
+   ASSERT_CMP_HELPER (a, eq, b, "lu", unsigned long)
+#define ASSERT_CMPINT32(a, eq, b) ASSERT_CMP_HELPER (a, eq, b, PRId32, int32_t)
+#define ASSERT_CMPINT64(a, eq, b) ASSERT_CMP_HELPER (a, eq, b, PRId64, int64_t)
+#define ASSERT_CMPUINT16(a, eq, b) \
+   ASSERT_CMP_HELPER (a, eq, b, PRIu16, uint16_t)
+#define ASSERT_CMPUINT32(a, eq, b) \
+   ASSERT_CMP_HELPER (a, eq, b, PRIu32, uint32_t)
+#define ASSERT_CMPUINT64(a, eq, b) \
+   ASSERT_CMP_HELPER (a, eq, b, PRIu64, uint64_t)
+#define ASSERT_CMPSIZE_T(a, eq, b) ASSERT_CMP_HELPER (a, eq, b, "zu", size_t)
+#define ASSERT_CMPSSIZE_T(a, eq, b) ASSERT_CMP_HELPER (a, eq, b, "zd", ssize_t)
+#define ASSERT_CMPDOUBLE(a, eq, b) ASSERT_CMP_HELPER (a, eq, b, "f", double)
+#define ASSERT_CMPPTR(a, eq, b) ASSERT_CMP_HELPER (a, eq, b, "p", const void *)
+
+#define ASSERT_CMPINT128_EQ(A, B)                              \
+   if (1) {                                                    \
+      mlib_int128 left = (A);                                  \
+      mlib_int128 right = (B);                                 \
+      const bool result = mlib_int128_eq (left, right);        \
+      if (!result) {                                           \
+         TEST_ERROR ("Comparison failed: %s == %s (%s != %s)", \
+                     #A,                                       \
+                     #B,                                       \
+                     mlib_int128_format (left).str,            \
+                     mlib_int128_format (right).str);          \
+      }                                                        \
+   } else                                                      \
+      ((void) 0)
+
+#define ASSERT_EQUAL_BSON(expected, actual)                                   \
+   do {                                                                       \
+      bson_t *_expected_bson = expected, *_actual_bson = actual;              \
+      char *_expected_str, *_actual_str;                                      \
+      _expected_str = bson_as_canonical_extended_json (_expected_bson, NULL); \
+      _actual_str = bson_as_canonical_extended_json (_actual_bson, NULL);     \
+      if (!bson_equal (_expected_bson, _actual_bson)) {                       \
+         TEST_ERROR ("BSON unequal.\nExpected: %s\n     Got: %s",             \
+                     _expected_str,                                           \
+                     _actual_str);                                            \
+      }                                                                       \
+      bson_free (_actual_str);                                                \
+      bson_free (_expected_str);                                              \
+   } while (0)
+
+#define ASSERT_MONGOCRYPT_BINARY_EQUAL_BSON(expected, actual)                  \
+   do {                                                                        \
+      bson_t _expected_bson, _actual_bson;                                     \
+      char *_expected_str, *_actual_str;                                       \
+      ASSERT (_mongocrypt_binary_to_bson (expected, &_expected_bson));         \
+      ASSERT (_mongocrypt_binary_to_bson (actual, &_actual_bson));             \
+      _expected_str = bson_as_canonical_extended_json (&_expected_bson, NULL); \
+      _actual_str = bson_as_canonical_extended_json (&_actual_bson, NULL);     \
+      if (!bson_equal (&_expected_bson, &_actual_bson)) {                      \
+         TEST_ERROR ("BSON unequal.\nExpected: %s\n     Got: %s",              \
+                     _expected_str,                                            \
+                     _actual_str);                                             \
+      }                                                                        \
+      bson_free (_actual_str);                                                 \
+      bson_free (_expected_str);                                               \
+   } while (0)
+
+#endif /* TEST_MONGOCRYPT_ASSERT_H */

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-buffer.c

@@ -0,0 +1,266 @@
+/*
+ * Copyright 2019-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <mongocrypt-marking-private.h>
+
+#include "test-mongocrypt.h"
+#include "test-mongocrypt-assert.h"
+
+#include "mongocrypt-endian-private.h"
+
+#define TEST_STRING "?????" /* 3F 3F 3F 3F 3F */
+#define TEST_INT 5555555    /* 54 C5 63 */
+
+static void
+_get_bytes (const void *in, char *out, int len)
+{
+   const unsigned char *src = in;
+   char *dest = out;
+
+   for (int i = 0; i < len; i++, dest += 3) {
+      sprintf (dest, "%02X ", src[i]);
+   }
+   dest[-1] = '\0';
+}
+
+bool
+assert_excess_bytes_removed (
+   char *key, char *wrapped, char *unwrapped, uint32_t type, bson_value_t *out)
+{
+   _mongocrypt_buffer_t plaintext = {0};
+   _mongocrypt_marking_t marking = {0};
+   bson_iter_t iter;
+   bson_t wrapper = BSON_INITIALIZER;
+   char actual[100] = {0};
+   bool ret = false;
+   bson_t bson = BSON_INITIALIZER;
+
+   BSON_APPEND_UTF8 (&bson, "str_key", TEST_STRING);
+   BSON_APPEND_INT32 (&bson, "int_key", TEST_INT);
+
+   bson_iter_init_find (&iter, &bson, key);
+   memcpy (&marking.v_iter, &iter, sizeof (bson_iter_t));
+
+   bson_append_iter (&wrapper, "", 0, &marking.v_iter);
+   _get_bytes (bson_get_data (&wrapper), actual, wrapper.len);
+   BSON_ASSERT (0 == strcmp (wrapped, actual));
+
+   _mongocrypt_buffer_from_iter (&plaintext, &(&marking)->v_iter);
+   _get_bytes (plaintext.data, actual, plaintext.len);
+   BSON_ASSERT (0 == strcmp (unwrapped, actual));
+
+   _mongocrypt_marking_cleanup (&marking);
+   bson_destroy (&wrapper);
+
+   ret = _mongocrypt_buffer_to_bson_value (&plaintext, type, out);
+
+   _mongocrypt_buffer_cleanup (&plaintext);
+   bson_destroy (&bson);
+   return ret;
+}
+
+static void
+_test_mongocrypt_buffer_from_iter (_mongocrypt_tester_t *tester)
+{
+   /*
+    * This section explains the purpose of each byte in a BSON document. This is
+    * used to extract only the value of a BSON document for later storage. Below
+    * is an example of the leftmost derivation of one of the BSON documents
+    * used for this test.
+    *
+    * NOTES:
+    * - When used as a unary operator, * means that the repetition can occur 0
+    *   or more times.
+    *
+    * - int32     4 bytes (32-bit signed integer, two's complement)
+    * - (byte*)   Zero or more modified UTF-8 encoded characters followed by
+    *             '\x00'. The (byte*) MUST NOT contain '\x00', hence it is
+    *             not full UTF-8.
+    *
+    * RULES:
+    * 1. document ::=  int32 e_list "\x00"     int32 is the total number of
+    *                                          bytes comprising the doc.
+    * 2. e_list   ::=  element e_list
+    *              |   ""
+    * 3. element  ::=  "\x02" e_name string    UTF-8 string
+    *              |   "\x10" e_name int32 	  32-bit integer
+    * 4. e_name   ::=  cstring                 Key name
+    * 5. string   ::=  int32 (byte*) "\x00"
+    * 6. cstring  ::=  (byte*) "\x00"
+    *
+    * BELOW IS A LEFTMOST DERIVATION:
+    * Let doc = { "" : "?????" }
+    *
+    * -  doc  ::= int32 e_list "\x00"
+    *
+    * -- rule2 -> int32 element e_list "\x00"
+    * -- rule3 -> int32 "\x02" e_name string e_list "\x00"
+    * -- rule4 -> int32 "\x02" cstring string e_list "\x00"
+    * -- rule6 -> int32 "\x02" (byte*) "\x00" string e_list "\x00"
+    * -- key   -> int32 "\x02" "" "\x00" string e_list "\x00"
+    ** The key is an empty string, i.e. 0 bytes **
+    * -- rule5 -> int32 "\x02" "" "\x00" int32 (byte*) "\x00" e_list "\x00"
+    * -- value -> int32 "\x02" "" "\x00" int32=6 "?????" "\x00" e_list "\x00"
+    ** Above, the value is set. The int32 before the value is the size of the **
+    ** value in bytes, plus one for the the null char. **
+    * -- rule2 -> int32=17 "\x02" "" "\x00" int32=6 "?????" "\x00" "" "\x00"
+    *
+    * Finally, we have the byte sequence:
+    *    "11000000 02 "" 00 06000000 "?????" 00 00"
+    *
+    * Note, the hexcode for '?' is '3F'. Grouping the sequence by byte for
+    * readability, more precisely we have:
+    *    "11 00 00 00 02 00 06 00 00 00 3F 3F 3F 3F 3F 00 00"
+    *
+    * with the value, including its length and null terminator being:
+    *    "06 00 00 00 3F 3F 3F 3F 3F 00".
+    * This is what we will store.
+    */
+
+   bson_t wrapper = BSON_INITIALIZER;
+   bson_value_t out;
+
+
+   BSON_ASSERT (assert_excess_bytes_removed (
+      "str_key",
+      "11 00 00 00 02 00 06 00 00 00 3F 3F 3F 3F 3F 00 00",
+      /** no prefix **/ "06 00 00 00 3F 3F 3F 3F 3F 00",
+      0x02, /* string type */
+      &out));
+
+   BSON_ASSERT (out.value_type == BSON_TYPE_UTF8);
+   BSON_ASSERT (0 == strcmp (TEST_STRING, out.value.v_utf8.str));
+   BSON_ASSERT (5 == out.value.v_utf8.len);
+   bson_value_destroy (&out);
+
+   BSON_ASSERT (assert_excess_bytes_removed ("int_key",
+                                             "0B 00 00 00 10 00 63 C5 54 00 00",
+                                             /** no prefix **/ "63 C5 54 00",
+                                             0x10, /* int type */
+                                             &out));
+
+   BSON_ASSERT (out.value_type == BSON_TYPE_INT32);
+   BSON_ASSERT (TEST_INT == out.value.v_int32);
+
+   BSON_ASSERT (
+      !assert_excess_bytes_removed ("int_key",
+                                    "0B 00 00 00 10 00 63 C5 54 00 00",
+                                    /** no prefix **/ "63 C5 54 00",
+                                    0x99, /* invalid type */
+                                    &out));
+   bson_destroy (&wrapper);
+}
+
+static void
+_test_mongocrypt_buffer_copy_from_data_and_size (_mongocrypt_tester_t *tester)
+{
+   _mongocrypt_buffer_t buf;
+   const uint8_t data[] = {0, 1, 2};
+
+   ASSERT (_mongocrypt_buffer_copy_from_data_and_size (&buf, data, 3));
+   ASSERT_CMPBYTES (data, sizeof (data), buf.data, buf.len);
+   _mongocrypt_buffer_cleanup (&buf);
+}
+
+static void
+_test_mongocrypt_buffer_steal_from_data_and_size (_mongocrypt_tester_t *tester)
+{
+   _mongocrypt_buffer_t buf;
+   uint8_t *data = bson_malloc0 (3);
+
+   data[0] = 0;
+   data[1] = 1;
+   data[2] = 2;
+   ASSERT (_mongocrypt_buffer_steal_from_data_and_size (&buf, data, 3));
+   ASSERT_CMPBYTES (data, 3, buf.data, buf.len);
+   _mongocrypt_buffer_cleanup (&buf);
+}
+
+static void
+_test_mongocrypt_buffer_steal_from_string (_mongocrypt_tester_t *tester)
+{
+   _mongocrypt_buffer_t buf;
+   char *str = bson_strdup ("foo");
+
+   ASSERT (_mongocrypt_buffer_steal_from_string (&buf, str));
+   ASSERT_STREQUAL ((const char *) buf.data, str);
+   _mongocrypt_buffer_cleanup (&buf);
+}
+
+static void
+_test_mongocrypt_buffer_copy_from_uint64_le (_mongocrypt_tester_t *tester)
+{
+   _mongocrypt_buffer_t expect;
+   _mongocrypt_buffer_t got;
+
+   _mongocrypt_buffer_copy_from_hex (&expect, "0100000000000000");
+   _mongocrypt_buffer_copy_from_uint64_le (
+      &got, 0x0000000000000001ULL);
+   ASSERT_CMPBYTES (expect.data, expect.len, got.data, got.len);
+   _mongocrypt_buffer_cleanup (&expect);
+   _mongocrypt_buffer_cleanup (&got);
+
+   _mongocrypt_buffer_copy_from_hex (&expect, "1122334455667788");
+   _mongocrypt_buffer_copy_from_uint64_le (
+      &got, 0x8877665544332211ULL);
+   ASSERT_CMPBYTES (expect.data, expect.len, got.data, got.len);
+   _mongocrypt_buffer_cleanup (&expect);
+   _mongocrypt_buffer_cleanup (&got);
+}
+
+static void
+_test_mongocrypt_buffer_from_subrange (_mongocrypt_tester_t *tester)
+{
+   _mongocrypt_buffer_t input;
+   _mongocrypt_buffer_t expect;
+   _mongocrypt_buffer_t got;
+
+   _mongocrypt_buffer_copy_from_hex (&input, "010203");
+   _mongocrypt_buffer_copy_from_hex (&expect, "01");
+   ASSERT (_mongocrypt_buffer_from_subrange (&got, &input, 0, 1));
+   ASSERT_CMPBYTES (expect.data, expect.len, got.data, got.len);
+   _mongocrypt_buffer_cleanup (&expect);
+   _mongocrypt_buffer_cleanup (&input);
+
+   _mongocrypt_buffer_copy_from_hex (&input, "010203");
+   _mongocrypt_buffer_copy_from_hex (&expect, "010203");
+   ASSERT (_mongocrypt_buffer_from_subrange (&got, &input, 0, 3));
+   ASSERT_CMPBYTES (expect.data, expect.len, got.data, got.len);
+   _mongocrypt_buffer_cleanup (&expect);
+   _mongocrypt_buffer_cleanup (&input);
+
+   _mongocrypt_buffer_copy_from_hex (&input, "010203");
+   _mongocrypt_buffer_copy_from_hex (&expect, "0203");
+   ASSERT (_mongocrypt_buffer_from_subrange (&got, &input, 1, 2));
+   ASSERT_CMPBYTES (expect.data, expect.len, got.data, got.len);
+   _mongocrypt_buffer_cleanup (&expect);
+   _mongocrypt_buffer_cleanup (&input);
+
+   _mongocrypt_buffer_copy_from_hex (&input, "010203");
+   ASSERT (!_mongocrypt_buffer_from_subrange (&got, &input, 0, 4));
+   _mongocrypt_buffer_cleanup (&input);
+}
+
+void
+_mongocrypt_tester_install_buffer (_mongocrypt_tester_t *tester)
+{
+   INSTALL_TEST (_test_mongocrypt_buffer_from_iter);
+   INSTALL_TEST (_test_mongocrypt_buffer_copy_from_data_and_size);
+   INSTALL_TEST (_test_mongocrypt_buffer_steal_from_data_and_size);
+   INSTALL_TEST (_test_mongocrypt_buffer_steal_from_string);
+   INSTALL_TEST (_test_mongocrypt_buffer_copy_from_uint64_le);
+   INSTALL_TEST (_test_mongocrypt_buffer_from_subrange);
+}

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-cache-oauth.c

@@ -0,0 +1,57 @@
+/*
+ * Copyright 2021-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "test-mongocrypt.h"
+#include "mongocrypt-cache-oauth-private.h"
+
+static void _test_cache_oauth_expiration (_mongocrypt_tester_t *tester) {
+   _mongocrypt_cache_oauth_t* cache;
+   char *token;
+   bool ret;
+   mongocrypt_status_t* status;
+   
+   cache = _mongocrypt_cache_oauth_new ();
+   token = _mongocrypt_cache_oauth_get (cache);
+   BSON_ASSERT (!token);
+
+   status = mongocrypt_status_new ();
+   ret = _mongocrypt_cache_oauth_add (cache, TMP_BSON ("{'expires_in': 0, 'access_token': 'foo'}"), status);
+   ASSERT_OR_PRINT (ret, status);
+   /* Attempting to get the token will purge the new token from the cache. */
+   token = _mongocrypt_cache_oauth_get (cache);
+   BSON_ASSERT (!token);
+
+   /* Attempt to get again, to ensure MONGOCRYPT-321 is fixed. */
+   token = _mongocrypt_cache_oauth_get (cache);
+   BSON_ASSERT (!token);
+
+   /* Add an unexpired token. */
+   ret = _mongocrypt_cache_oauth_add (cache, TMP_BSON ("{'expires_in': 1000, 'access_token': 'bar'}"), status);
+   ASSERT_OR_PRINT (ret, status);
+   
+   token = _mongocrypt_cache_oauth_get (cache);
+   ASSERT_STREQUAL (token, "bar");
+   bson_free (token);
+
+   _mongocrypt_cache_oauth_destroy (cache);
+   mongocrypt_status_destroy (status);
+}
+
+void
+_mongocrypt_tester_install_cache_oauth (_mongocrypt_tester_t *tester)
+{
+   INSTALL_TEST (_test_cache_oauth_expiration);
+}