libmongocrypt-helper 1.7.0.0.1001 → 1.7.4.0.1000

data/ext/libmongocrypt/libmongocrypt/bindings/node/lib/autoEncrypter.js

@@ -0,0 +1,420 @@
+'use strict';
+
+module.exports = function (modules) {
+  const mc = require('bindings')('mongocrypt');
+  const common = require('./common');
+  const databaseNamespace = common.databaseNamespace;
+  const StateMachine = modules.stateMachine.StateMachine;
+  const MongocryptdManager = require('./mongocryptdManager').MongocryptdManager;
+  const MongoClient = modules.mongodb.MongoClient;
+  const MongoError = modules.mongodb.MongoError;
+  const BSON = modules.mongodb.BSON;
+  const { loadCredentials } = require('./credentialsProvider');
+  const cryptoCallbacks = require('./cryptoCallbacks');
+
+  /**
+   * Configuration options for a automatic client encryption.
+   *
+   * @typedef {Object} AutoEncrypter~AutoEncryptionOptions
+   * @property {MongoClient} [keyVaultClient] A `MongoClient` used to fetch keys from a key vault
+   * @property {string} [keyVaultNamespace] The namespace where keys are stored in the key vault
+   * @property {KMSProviders} [kmsProviders] Configuration options that are used by specific KMS providers during key generation, encryption, and decryption.
+   * @property {object} [schemaMap] A map of namespaces to a local JSON schema for encryption
+   * @property {boolean} [bypassAutoEncryption] Allows the user to bypass auto encryption, maintaining implicit decryption
+   * @property {AutoEncrypter~logger} [options.logger] An optional hook to catch logging messages from the underlying encryption engine
+   * @property {AutoEncrypter~AutoEncryptionExtraOptions} [extraOptions] Extra options related to the mongocryptd process
+   */
+
+  /**
+   * Extra options related to the mongocryptd process
+   * @typedef {object} AutoEncrypter~AutoEncryptionExtraOptions
+   * @property {string} [mongocryptdURI] A local process the driver communicates with to determine how to encrypt values in a command. Defaults to "mongodb://%2Fvar%2Fmongocryptd.sock" if domain sockets are available or "mongodb://localhost:27020" otherwise
+   * @property {boolean} [mongocryptdBypassSpawn=false] If true, autoEncryption will not attempt to spawn a mongocryptd before connecting
+   * @property {string} [mongocryptdSpawnPath] The path to the mongocryptd executable on the system
+   * @property {string[]} [mongocryptdSpawnArgs] Command line arguments to use when auto-spawning a mongocryptd
+   */
+
+  /**
+   * @callback AutoEncrypter~logger
+   * @description A callback that is invoked with logging information from
+   * the underlying C++ Bindings.
+   * @param {AutoEncrypter~logLevel} level The level of logging.
+   * @param {string} message The message to log
+   */
+
+  /**
+   * @name AutoEncrypter~logLevel
+   * @enum {number}
+   * @description
+   * The level of severity of the log message
+   *
+   * | Value | Level |
+   * |-------|-------|
+   * | 0 | Fatal Error |
+   * | 1 | Error |
+   * | 2 | Warning |
+   * | 3 | Info |
+   * | 4 | Trace |
+   */
+
+  /**
+   * @classdesc An internal class to be used by the driver for auto encryption
+   * **NOTE**: Not meant to be instantiated directly, this is for internal use only.
+   */
+  class AutoEncrypter {
+    /**
+     * Create an AutoEncrypter
+     *
+     * **Note**: Do not instantiate this class directly. Rather, supply the relevant options to a MongoClient
+     *
+     * **Note**: Supplying `options.schemaMap` provides more security than relying on JSON Schemas obtained from the server.
+     * It protects against a malicious server advertising a false JSON Schema, which could trick the client into sending unencrypted data that should be encrypted.
+     * Schemas supplied in the schemaMap only apply to configuring automatic encryption for Client-Side Field Level Encryption.
+     * Other validation rules in the JSON schema will not be enforced by the driver and will result in an error.
+     * @param {MongoClient} client The client autoEncryption is enabled on
+     * @param {AutoEncrypter~AutoEncryptionOptions} [options] Optional settings
+     *
+     * @example
+     * // Enabling autoEncryption via a MongoClient
+     * const { MongoClient } = require('mongodb');
+     * const client = new MongoClient(URL, {
+     *   autoEncryption: {
+     *     kmsProviders: {
+     *       aws: {
+     *         accessKeyId: AWS_ACCESS_KEY,
+     *         secretAccessKey: AWS_SECRET_KEY
+     *       }
+     *     }
+     *   }
+     * });
+     *
+     * await client.connect();
+     * // From here on, the client will be encrypting / decrypting automatically
+     */
+    constructor(client, options) {
+      this._client = client;
+      this._bson = options.bson || BSON || client.topology.bson;
+      this._bypassEncryption = options.bypassAutoEncryption === true;
+
+      this._keyVaultNamespace = options.keyVaultNamespace || 'admin.datakeys';
+      this._keyVaultClient = options.keyVaultClient || client;
+      this._metaDataClient = options.metadataClient || client;
+      this._proxyOptions = options.proxyOptions || {};
+      this._tlsOptions = options.tlsOptions || {};
+      this._onKmsProviderRefresh = options.onKmsProviderRefresh;
+      this._kmsProviders = options.kmsProviders || {};
+
+      const mongoCryptOptions = {};
+      if (options.schemaMap) {
+        mongoCryptOptions.schemaMap = Buffer.isBuffer(options.schemaMap)
+          ? options.schemaMap
+          : this._bson.serialize(options.schemaMap);
+      }
+
+      if (options.encryptedFieldsMap) {
+        mongoCryptOptions.encryptedFieldsMap = Buffer.isBuffer(options.encryptedFieldsMap)
+          ? options.encryptedFieldsMap
+          : this._bson.serialize(options.encryptedFieldsMap);
+      }
+
+      mongoCryptOptions.kmsProviders = !Buffer.isBuffer(this._kmsProviders)
+        ? this._bson.serialize(this._kmsProviders)
+        : this._kmsProviders;
+
+      if (options.logger) {
+        mongoCryptOptions.logger = options.logger;
+      }
+
+      if (options.extraOptions && options.extraOptions.cryptSharedLibPath) {
+        mongoCryptOptions.cryptSharedLibPath = options.extraOptions.cryptSharedLibPath;
+      }
+
+      if (options.bypassQueryAnalysis) {
+        mongoCryptOptions.bypassQueryAnalysis = options.bypassQueryAnalysis;
+      }
+
+      this._bypassMongocryptdAndCryptShared = this._bypassEncryption || options.bypassQueryAnalysis;
+
+      if (options.extraOptions && options.extraOptions.cryptSharedLibSearchPaths) {
+        // Only for driver testing
+        mongoCryptOptions.cryptSharedLibSearchPaths =
+          options.extraOptions.cryptSharedLibSearchPaths;
+      } else if (!this._bypassMongocryptdAndCryptShared) {
+        mongoCryptOptions.cryptSharedLibSearchPaths = ['$SYSTEM'];
+      }
+
+      Object.assign(mongoCryptOptions, { cryptoCallbacks });
+      this._mongocrypt = new mc.MongoCrypt(mongoCryptOptions);
+      this._contextCounter = 0;
+
+      if (
+        options.extraOptions &&
+        options.extraOptions.cryptSharedLibRequired &&
+        !this.cryptSharedLibVersionInfo
+      ) {
+        throw new MongoError('`cryptSharedLibRequired` set but no crypt_shared library loaded');
+      }
+
+      // Only instantiate mongocryptd manager/client once we know for sure
+      // that we are not using the CSFLE shared library.
+      if (!this._bypassMongocryptdAndCryptShared && !this.cryptSharedLibVersionInfo) {
+        this._mongocryptdManager = new MongocryptdManager(options.extraOptions);
+        const clientOptions = {
+          useNewUrlParser: true,
+          useUnifiedTopology: true,
+          serverSelectionTimeoutMS: 10000
+        };
+
+        if (
+          options.extraOptions == null ||
+          typeof options.extraOptions.mongocryptdURI !== 'string'
+        ) {
+          clientOptions.family = 4;
+        }
+
+        this._mongocryptdClient = new MongoClient(this._mongocryptdManager.uri, clientOptions);
+      }
+    }
+
+    /**
+     * @ignore
+     * @param {Function} callback Invoked when the mongocryptd client either successfully connects or errors
+     */
+    init(callback) {
+      if (this._bypassMongocryptdAndCryptShared || this.cryptSharedLibVersionInfo) {
+        return callback();
+      }
+      const _callback = (err, res) => {
+        if (
+          err &&
+          err.message &&
+          (err.message.match(/timed out after/) || err.message.match(/ENOTFOUND/))
+        ) {
+          callback(
+            new MongoError(
+              'Unable to connect to `mongocryptd`, please make sure it is running or in your PATH for auto-spawn'
+            )
+          );
+          return;
+        }
+
+        callback(err, res);
+      };
+
+      if (this._mongocryptdManager.bypassSpawn) {
+        return this._mongocryptdClient.connect().then(
+          result => {
+            return _callback(null, result);
+          },
+          error => {
+            _callback(error, null);
+          }
+        );
+      }
+
+      this._mongocryptdManager.spawn(() => {
+        this._mongocryptdClient.connect().then(
+          result => {
+            return _callback(null, result);
+          },
+          error => {
+            _callback(error, null);
+          }
+        );
+      });
+    }
+
+    /**
+     * @ignore
+     * @param {Function} callback Invoked when the mongocryptd client either successfully disconnects or errors
+     */
+    teardown(force, callback) {
+      if (this._mongocryptdClient) {
+        this._mongocryptdClient.close(force).then(
+          result => {
+            return callback(null, result);
+          },
+          error => {
+            callback(error);
+          }
+        );
+      } else {
+        callback();
+      }
+    }
+
+    /**
+     * @ignore
+     * Encrypt a command for a given namespace.
+     *
+     * @param {string} ns The namespace for this encryption context
+     * @param {object} cmd The command to encrypt
+     * @param {Function} callback
+     */
+    encrypt(ns, cmd, options, callback) {
+      if (typeof ns !== 'string') {
+        throw new TypeError('Parameter `ns` must be a string');
+      }
+
+      if (typeof cmd !== 'object') {
+        throw new TypeError('Parameter `cmd` must be an object');
+      }
+
+      if (typeof options === 'function' && callback == null) {
+        callback = options;
+        options = {};
+      }
+
+      // If `bypassAutoEncryption` has been specified, don't encrypt
+      if (this._bypassEncryption) {
+        callback(undefined, cmd);
+        return;
+      }
+
+      const bson = this._bson;
+      const commandBuffer = Buffer.isBuffer(cmd) ? cmd : bson.serialize(cmd, options);
+
+      let context;
+      try {
+        context = this._mongocrypt.makeEncryptionContext(databaseNamespace(ns), commandBuffer);
+      } catch (err) {
+        callback(err, null);
+        return;
+      }
+
+      // TODO: should these be accessors from the addon?
+      context.id = this._contextCounter++;
+      context.ns = ns;
+      context.document = cmd;
+
+      const stateMachine = new StateMachine({
+        bson,
+        ...options,
+        promoteValues: false,
+        promoteLongs: false,
+        proxyOptions: this._proxyOptions,
+        tlsOptions: this._tlsOptions
+      });
+      stateMachine.execute(this, context, callback);
+    }
+
+    /**
+     * @ignore
+     * Decrypt a command response
+     *
+     * @param {Buffer} buffer
+     * @param {Function} callback
+     */
+    decrypt(response, options, callback) {
+      if (typeof options === 'function' && callback == null) {
+        callback = options;
+        options = {};
+      }
+
+      const bson = this._bson;
+      const buffer = Buffer.isBuffer(response) ? response : bson.serialize(response, options);
+
+      let context;
+      try {
+        context = this._mongocrypt.makeDecryptionContext(buffer);
+      } catch (err) {
+        callback(err, null);
+        return;
+      }
+
+      // TODO: should this be an accessor from the addon?
+      context.id = this._contextCounter++;
+
+      const stateMachine = new StateMachine({
+        bson,
+        ...options,
+        proxyOptions: this._proxyOptions,
+        tlsOptions: this._tlsOptions
+      });
+
+      const decorateResult = this[Symbol.for('@@mdb.decorateDecryptionResult')];
+      stateMachine.execute(this, context, function (err, result) {
+        // Only for testing/internal usage
+        if (!err && result && decorateResult) {
+          err = decorateDecryptionResult(result, response, bson);
+          if (err) return callback(err);
+        }
+        callback(err, result);
+      });
+    }
+
+    /**
+     * Ask the user for KMS credentials.
+     *
+     * This returns anything that looks like the kmsProviders original input
+     * option. It can be empty, and any provider specified here will override
+     * the original ones.
+     */
+    async askForKMSCredentials() {
+      return this._onKmsProviderRefresh
+        ? this._onKmsProviderRefresh()
+        : loadCredentials(this._kmsProviders);
+    }
+
+    /**
+     * Return the current libmongocrypt's CSFLE shared library version
+     * as `{ version: bigint, versionStr: string }`, or `null` if no CSFLE
+     * shared library was loaded.
+     */
+    get cryptSharedLibVersionInfo() {
+      return this._mongocrypt.cryptSharedLibVersionInfo;
+    }
+
+    static get libmongocryptVersion() {
+      return mc.MongoCrypt.libmongocryptVersion;
+    }
+  }
+
+  return { AutoEncrypter };
+};
+
+/**
+ * Recurse through the (identically-shaped) `decrypted` and `original`
+ * objects and attach a `decryptedKeys` property on each sub-object that
+ * contained encrypted fields. Because we only call this on BSON responses,
+ * we do not need to worry about circular references.
+ *
+ * @internal
+ * @ignore
+ */
+function decorateDecryptionResult(decrypted, original, bson, isTopLevelDecorateCall = true) {
+  const decryptedKeys = Symbol.for('@@mdb.decryptedKeys');
+  if (isTopLevelDecorateCall) {
+    // The original value could have been either a JS object or a BSON buffer
+    if (Buffer.isBuffer(original)) {
+      original = bson.deserialize(original);
+    }
+    if (Buffer.isBuffer(decrypted)) {
+      return new Error('Expected result of decryption to be deserialized BSON object');
+    }
+  }
+
+  if (!decrypted || typeof decrypted !== 'object') return;
+  for (const k of Object.keys(decrypted)) {
+    const originalValue = original[k];
+
+    // An object was decrypted by libmongocrypt if and only if it was
+    // a BSON Binary object with subtype 6.
+    if (originalValue && originalValue._bsontype === 'Binary' && originalValue.sub_type === 6) {
+      if (!decrypted[decryptedKeys]) {
+        Object.defineProperty(decrypted, decryptedKeys, {
+          value: [],
+          configurable: true,
+          enumerable: false,
+          writable: false
+        });
+      }
+      decrypted[decryptedKeys].push(k);
+      // Do not recurse into this decrypted value. It could be a subdocument/array,
+      // in which case there is no original value associated with its subfields.
+      continue;
+    }
+
+    decorateDecryptionResult(decrypted[k], originalValue, bson, false);
+  }
+}

data/ext/libmongocrypt/libmongocrypt/bindings/node/lib/buffer_pool.js

@@ -0,0 +1,123 @@
+'use strict';
+
+/**
+ * @internal
+ * @ignore
+ * */
+const kBuffers = Symbol('buffers');
+/**
+ * @internal
+ * @ignore
+ *
+ * */
+const kLength = Symbol('length');
+
+/**
+ * A pool of Buffers which allow you to read them as if they were one
+ * @internal
+ * @ignore
+ */
+class BufferPool {
+  // [kBuffers]: Buffer[];
+  // [kLength]: number;
+
+  constructor() {
+    this[kBuffers] = [];
+    this[kLength] = 0;
+  }
+
+  get length() {
+    return this[kLength];
+  }
+
+  /**
+   * Adds a buffer to the internal buffer pool list
+   * @param {Buffer} buffer - buffer to append to the pool
+   * @returns {void}
+   */
+  append(buffer) {
+    this[kBuffers].push(buffer);
+    this[kLength] += buffer.length;
+  }
+
+  /**
+   * Returns the requested number of bytes without consuming them
+   * @param {number} size - the number of bytes to return from the head of the pool
+   * @returns {Buffer}
+   */
+  peek(size) {
+    return this.read(size, false);
+  }
+
+  /**
+   * Reads the requested number of bytes, optionally consuming them
+   * @param {number} size - the number of bytes to return from the head of the pool
+   * @param {boolean} [consume] - whether the bytes returned should be removed, defaults to true
+   * @returns {Buffer}
+   */
+  read(size, consume = true) {
+    if (typeof size !== 'number' || size < 0) {
+      throw new Error('Argument "size" must be a non-negative number');
+    }
+
+    if (size > this[kLength]) {
+      return Buffer.alloc(0);
+    }
+
+    let result;
+
+    // read the whole buffer
+    if (size === this.length) {
+      result = Buffer.concat(this[kBuffers]);
+
+      if (consume) {
+        this[kBuffers] = [];
+        this[kLength] = 0;
+      }
+    }
+
+    // size is within first buffer, no need to concat
+    else if (size <= this[kBuffers][0].length) {
+      result = this[kBuffers][0].slice(0, size);
+      if (consume) {
+        this[kBuffers][0] = this[kBuffers][0].slice(size);
+        this[kLength] -= size;
+      }
+    }
+
+    // size is beyond first buffer, need to track and copy
+    else {
+      result = Buffer.allocUnsafe(size);
+
+      let idx;
+      let offset = 0;
+      let bytesToCopy = size;
+      for (idx = 0; idx < this[kBuffers].length; ++idx) {
+        let bytesCopied;
+        if (bytesToCopy > this[kBuffers][idx].length) {
+          bytesCopied = this[kBuffers][idx].copy(result, offset, 0);
+          offset += bytesCopied;
+        } else {
+          bytesCopied = this[kBuffers][idx].copy(result, offset, 0, bytesToCopy);
+          if (consume) {
+            this[kBuffers][idx] = this[kBuffers][idx].slice(bytesCopied);
+          }
+          offset += bytesCopied;
+          break;
+        }
+
+        bytesToCopy -= bytesCopied;
+      }
+
+      // compact the internal buffer array
+      if (consume) {
+        this[kBuffers] = this[kBuffers].slice(idx);
+        this[kLength] -= size;
+      }
+    }
+
+    return result;
+  }
+}
+
+module.exports = { BufferPool };