libmongocrypt-helper 1.8.0.0.1001 → 1.11.0.0.1001

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-assert-match-bson.c

@@ -360,7 +360,7 @@ bool match_bson_with_ctx(const bson_t *doc, const bson_t *pattern, match_ctx_t *
                 goto fail;
             }
         } else if (!found) {
-            match_err(&derived, "not found");
+            match_err(&derived, "key '%s' not found", key);
             goto fail;
         } else if (is_empty_operator) {
             if (empty != is_empty_doc_or_array(&doc_value)) {
@@ -637,6 +637,10 @@ static bool match_bson_arrays(const bson_t *array, const bson_t *pattern, match_
         derive(ctx, &derived, bson_iter_key(&array_iter));
 
         if (!match_bson_value(array_value, pattern_value, &derived)) {
+            // Propagate error message.
+            if (strlen(derived.errmsg) > 0) {
+                memcpy(ctx->errmsg, derived.errmsg, sizeof(derived.errmsg));
+            }
             return false;
         }
     }
@@ -884,23 +888,16 @@ const char *_mongoc_bson_type_to_str(bson_type_t t) {
     }
 }
 
-void _assert_match_bson(const bson_t *doc, const bson_t *pattern) {
-    match_ctx_t ctx;
-
-    memset(&ctx, 0, sizeof(match_ctx_t));
-    if (!match_bson_with_ctx(doc, pattern, &ctx)) {
-        char *doc_str = doc ? bson_as_json(doc, NULL) : NULL;
-        char *pattern_str = bson_as_json(pattern, NULL);
-
-        TEST_ERROR("ASSERT_MATCH failed with document:\n\n"
-                   "%s\n"
-                   "pattern:\n%s\n"
-                   "%s\n",
-                   doc_str ? doc_str : "{}",
-                   pattern_str,
-                   ctx.errmsg);
-
-        bson_free(doc_str);
-        bson_free(pattern_str);
+bool _check_match_bson(const bson_t *doc, const bson_t *pattern, char *errmsg, size_t errmsg_len) {
+    // Set `retain_dots_in_keys` to interpret a pattern key "db.test" as a key, rather than a key path.
+    match_ctx_t ctx = {.retain_dots_in_keys = true};
+    bool matched = match_bson_with_ctx(doc, pattern, &ctx);
+    if (matched) {
+        bson_strncpy(errmsg, "", errmsg_len);
+    } else {
+        if (matched) {
+            bson_strncpy(errmsg, ctx.errmsg, errmsg_len);
+        }
     }
+    return matched;
 }

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-assert-match-bson.h

@@ -20,6 +20,27 @@
 #include <bson/bson.h>
 
 /* Copied from libmongoc. */
-void _assert_match_bson(const bson_t *doc, const bson_t *pattern);
+bool _check_match_bson(const bson_t *doc, const bson_t *pattern, char *errmsg, size_t errmsg_len);
+
+#define _assert_match_bson(doc, pattern)                                                                               \
+    if (1) {                                                                                                           \
+        char errmsg[1024] = "";                                                                                        \
+        if (!_check_match_bson(doc, pattern, errmsg, sizeof(errmsg))) {                                                \
+            char *doc_str = bson_as_json(doc, NULL);                                                                   \
+            char *pattern_str = bson_as_json(pattern, NULL);                                                           \
+                                                                                                                       \
+            TEST_ERROR("ASSERT_MATCH failed with document:\n\n"                                                        \
+                       "%s\n"                                                                                          \
+                       "pattern:\n%s\n"                                                                                \
+                       "%s\n",                                                                                         \
+                       doc_str ? doc_str : "{}",                                                                       \
+                       pattern_str,                                                                                    \
+                       errmsg);                                                                                        \
+                                                                                                                       \
+            bson_free(doc_str);                                                                                        \
+            bson_free(pattern_str);                                                                                    \
+        }                                                                                                              \
+    } else                                                                                                             \
+        (void)0
 
 #endif /* TEST_MONGOCRYPT_ASSERT_MATCH_BSON_H */

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-cache-oauth.c

@@ -18,38 +18,121 @@
 #include "test-mongocrypt.h"
 
 static void _test_cache_oauth_expiration(_mongocrypt_tester_t *tester) {
-    _mongocrypt_cache_oauth_t *cache;
+    mc_mapof_kmsid_to_token_t *cache;
     char *token;
     bool ret;
     mongocrypt_status_t *status;
 
-    cache = _mongocrypt_cache_oauth_new();
-    token = _mongocrypt_cache_oauth_get(cache);
+    cache = mc_mapof_kmsid_to_token_new();
+    token = mc_mapof_kmsid_to_token_get_token(cache, "aws");
     BSON_ASSERT(!token);
 
     status = mongocrypt_status_new();
-    ret = _mongocrypt_cache_oauth_add(cache, TMP_BSON("{'expires_in': 0, 'access_token': 'foo'}"), status);
+    ret = mc_mapof_kmsid_to_token_add_response(cache,
+                                               "aws",
+                                               TMP_BSON("{'expires_in': 0, 'access_token': 'foo'}"),
+                                               status);
     ASSERT_OR_PRINT(ret, status);
-    /* Attempting to get the token will purge the new token from the cache. */
-    token = _mongocrypt_cache_oauth_get(cache);
+    /* Does not return expired token. */
+    token = mc_mapof_kmsid_to_token_get_token(cache, "aws");
     BSON_ASSERT(!token);
 
     /* Attempt to get again, to ensure MONGOCRYPT-321 is fixed. */
-    token = _mongocrypt_cache_oauth_get(cache);
+    token = mc_mapof_kmsid_to_token_get_token(cache, "aws");
     BSON_ASSERT(!token);
 
     /* Add an unexpired token. */
-    ret = _mongocrypt_cache_oauth_add(cache, TMP_BSON("{'expires_in': 1000, 'access_token': 'bar'}"), status);
+    ret = mc_mapof_kmsid_to_token_add_response(cache,
+                                               "aws",
+                                               TMP_BSON("{'expires_in': 1000, 'access_token': 'bar'}"),
+                                               status);
     ASSERT_OR_PRINT(ret, status);
 
-    token = _mongocrypt_cache_oauth_get(cache);
+    token = mc_mapof_kmsid_to_token_get_token(cache, "aws");
     ASSERT_STREQUAL(token, "bar");
     bson_free(token);
 
-    _mongocrypt_cache_oauth_destroy(cache);
+    mc_mapof_kmsid_to_token_destroy(cache);
+    mongocrypt_status_destroy(status);
+}
+
+#define BSON_STR(...) #__VA_ARGS__
+
+static void test_mc_mapof_kmsid_to_token(_mongocrypt_tester_t *tester) {
+    mongocrypt_status_t *status = mongocrypt_status_new();
+    bson_t *response1 = TMP_BSON(BSON_STR({"access_token" : "foo", "expires_in" : 1234}));
+    bson_t *response2 = TMP_BSON(BSON_STR({"access_token" : "bar", "expires_in" : 4567}));
+
+    // Test inserting one entry.
+    {
+        mc_mapof_kmsid_to_token_t *k2t = mc_mapof_kmsid_to_token_new();
+        ASSERT(NULL == mc_mapof_kmsid_to_token_get_token(k2t, "local:1"));
+        ASSERT_OK_STATUS(mc_mapof_kmsid_to_token_add_response(k2t, "local:1", response1, status), status);
+        char *got = mc_mapof_kmsid_to_token_get_token(k2t, "local:1");
+        ASSERT_STREQUAL(got, "foo");
+        bson_free(got);
+        mc_mapof_kmsid_to_token_destroy(k2t);
+    }
+
+    // Test inserting two entries.
+    {
+        mc_mapof_kmsid_to_token_t *k2t = mc_mapof_kmsid_to_token_new();
+
+        // Insert first.
+        {
+            ASSERT(NULL == mc_mapof_kmsid_to_token_get_token(k2t, "local:1"));
+            ASSERT_OK_STATUS(mc_mapof_kmsid_to_token_add_response(k2t, "local:1", response1, status), status);
+            char *got = mc_mapof_kmsid_to_token_get_token(k2t, "local:1");
+            ASSERT_STREQUAL(got, "foo");
+            bson_free(got);
+        }
+
+        // Insert second.
+        {
+            ASSERT(NULL == mc_mapof_kmsid_to_token_get_token(k2t, "local:2"));
+            ASSERT_OK_STATUS(mc_mapof_kmsid_to_token_add_response(k2t, "local:2", response2, status), status);
+            char *got = mc_mapof_kmsid_to_token_get_token(k2t, "local:2");
+            ASSERT_STREQUAL(got, "bar");
+            bson_free(got);
+        }
+
+        mc_mapof_kmsid_to_token_destroy(k2t);
+    }
+
+    // Test overwriting an entry.
+    {
+        mc_mapof_kmsid_to_token_t *k2t = mc_mapof_kmsid_to_token_new();
+
+        // Insert first.
+        {
+            ASSERT(NULL == mc_mapof_kmsid_to_token_get_token(k2t, "local:1"));
+            ASSERT_OK_STATUS(mc_mapof_kmsid_to_token_add_response(k2t, "local:1", response1, status), status);
+            char *got = mc_mapof_kmsid_to_token_get_token(k2t, "local:1");
+            ASSERT_STREQUAL(got, "foo");
+            bson_free(got);
+        }
+
+        // Overwrite 'local:1' with a different token.
+        {
+            ASSERT_OK_STATUS(mc_mapof_kmsid_to_token_add_response(k2t, "local:1", response2, status), status);
+            char *got = mc_mapof_kmsid_to_token_get_token(k2t, "local:1");
+            ASSERT_STREQUAL(got, "bar");
+            bson_free(got);
+        }
+
+        mc_mapof_kmsid_to_token_destroy(k2t);
+    }
+    // Test getting a missing entry.
+    {
+        mc_mapof_kmsid_to_token_t *k2t = mc_mapof_kmsid_to_token_new();
+        ASSERT(NULL == mc_mapof_kmsid_to_token_get_token(k2t, "local:1"));
+        mc_mapof_kmsid_to_token_destroy(k2t);
+    }
+
     mongocrypt_status_destroy(status);
 }
 
 void _mongocrypt_tester_install_cache_oauth(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(_test_cache_oauth_expiration);
-}
+    INSTALL_TEST(test_mc_mapof_kmsid_to_token);
+}

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-cleanup.c

@@ -0,0 +1,374 @@
+/*
+ * Copyright 2023-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "test-mongocrypt.h"
+
+static void _test_cleanup_success(_mongocrypt_tester_t *tester) {
+    for (int use_range_v2 = 0; use_range_v2 <= 1; use_range_v2++) {
+        mongocrypt_t *crypt;
+        mongocrypt_ctx_t *ctx;
+
+        crypt =
+            _mongocrypt_tester_mongocrypt(use_range_v2 ? TESTER_MONGOCRYPT_WITH_RANGE_V2 : TESTER_MONGOCRYPT_DEFAULT);
+        ctx = mongocrypt_ctx_new(crypt);
+
+        ASSERT_OK(mongocrypt_ctx_encrypt_init(ctx, "db", -1, TEST_FILE("./test/data/cleanup/success/cmd.json")), ctx);
+
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_COLLINFO);
+        {
+            ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx, TEST_FILE("./test/data/cleanup/success/collinfo.json")), ctx);
+            ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+        }
+
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_KEYS);
+        {
+            ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                                TEST_FILE("./test/data/keys/"
+                                                          "12345678123498761234123456789012-local-document.json")),
+                      ctx);
+            ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                                TEST_FILE("./test/data/keys/"
+                                                          "ABCDEFAB123498761234123456789012-local-document.json")),
+                      ctx);
+            ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                                TEST_FILE("./test/data/keys/"
+                                                          "12345678123498761234123456789013-local-document.json")),
+                      ctx);
+            ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+        }
+
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_READY);
+        {
+            mongocrypt_binary_t *out = mongocrypt_binary_new();
+            ASSERT_OK(mongocrypt_ctx_finalize(ctx, out), ctx);
+            if (use_range_v2) {
+                ASSERT_MONGOCRYPT_BINARY_EQUAL_BSON(
+                    TEST_FILE("./test/data/cleanup/success/encrypted-payload-range-v2.json"),
+                    out);
+            } else {
+                ASSERT_MONGOCRYPT_BINARY_EQUAL_BSON(TEST_FILE("./test/data/cleanup/success/encrypted-payload.json"),
+                                                    out);
+            }
+            mongocrypt_binary_destroy(out);
+        }
+
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_DONE);
+
+        mongocrypt_ctx_destroy(ctx);
+        mongocrypt_destroy(crypt);
+    }
+}
+
+static void _test_cleanup_nonlocal_kms(_mongocrypt_tester_t *tester) {
+    mongocrypt_t *crypt;
+    mongocrypt_ctx_t *ctx;
+
+    crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+    ctx = mongocrypt_ctx_new(crypt);
+
+    ASSERT_OK(mongocrypt_ctx_encrypt_init(ctx, "db", -1, TEST_FILE("./test/data/cleanup/success/cmd.json")), ctx);
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_COLLINFO);
+    {
+        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx, TEST_FILE("./test/data/cleanup/success/collinfo.json")), ctx);
+        ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+    }
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_KEYS);
+    {
+        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                            TEST_FILE("./test/data/keys/"
+                                                      "12345678123498761234123456789012-aws-document.json")),
+                  ctx);
+        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                            TEST_FILE("./test/data/keys/"
+                                                      "ABCDEFAB123498761234123456789012-aws-document.json")),
+                  ctx);
+        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                            TEST_FILE("./test/data/keys/"
+                                                      "12345678123498761234123456789013-aws-document.json")),
+                  ctx);
+        ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+    }
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_KMS);
+    {
+        mongocrypt_kms_ctx_t *kms_ctx = mongocrypt_ctx_next_kms_ctx(ctx);
+        ASSERT(kms_ctx);
+        ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx,
+                                          TEST_FILE("./test/data/keys/"
+                                                    "12345678123498761234123456789013-"
+                                                    "aws-decrypt-reply.txt")),
+                  kms_ctx);
+        kms_ctx = mongocrypt_ctx_next_kms_ctx(ctx);
+        ASSERT(kms_ctx);
+        ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx,
+                                          TEST_FILE("./test/data/keys/"
+                                                    "ABCDEFAB123498761234123456789012-"
+                                                    "aws-decrypt-reply.txt")),
+                  kms_ctx);
+        kms_ctx = mongocrypt_ctx_next_kms_ctx(ctx);
+        ASSERT(kms_ctx);
+        ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx,
+                                          TEST_FILE("./test/data/keys/"
+                                                    "12345678123498761234123456789012-"
+                                                    "aws-decrypt-reply.txt")),
+                  kms_ctx);
+        ASSERT(!mongocrypt_ctx_next_kms_ctx(ctx));
+        ASSERT_OK(mongocrypt_ctx_kms_done(ctx), ctx);
+    }
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_READY);
+    {
+        mongocrypt_binary_t *out = mongocrypt_binary_new();
+        ASSERT_OK(mongocrypt_ctx_finalize(ctx, out), ctx);
+        ASSERT_MONGOCRYPT_BINARY_EQUAL_BSON(TEST_FILE("./test/data/cleanup/success/encrypted-payload.json"), out);
+        mongocrypt_binary_destroy(out);
+    }
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_DONE);
+
+    mongocrypt_ctx_destroy(ctx);
+    mongocrypt_destroy(crypt);
+}
+
+static void _test_cleanup_missing_key_id(_mongocrypt_tester_t *tester) {
+    mongocrypt_t *crypt;
+    mongocrypt_ctx_t *ctx;
+
+    crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+    ctx = mongocrypt_ctx_new(crypt);
+
+    ASSERT_OK(mongocrypt_ctx_encrypt_init(ctx, "db", -1, TEST_FILE("./test/data/cleanup/success/cmd.json")), ctx);
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_COLLINFO);
+    {
+        ASSERT_FAILS(mongocrypt_ctx_mongo_feed(ctx, TEST_FILE("./test/data/cleanup/missing-key-id/collinfo.json")),
+                     ctx,
+                     "unable to find 'keyId' in 'field' document");
+    }
+
+    mongocrypt_ctx_destroy(ctx);
+    mongocrypt_destroy(crypt);
+}
+
+static void _test_cleanup_key_not_provided(_mongocrypt_tester_t *tester) {
+    mongocrypt_t *crypt;
+    mongocrypt_ctx_t *ctx;
+
+    crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+    ctx = mongocrypt_ctx_new(crypt);
+
+    ASSERT_OK(mongocrypt_ctx_encrypt_init(ctx, "db", -1, TEST_FILE("./test/data/cleanup/success/cmd.json")), ctx);
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_COLLINFO);
+    {
+        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx, TEST_FILE("./test/data/cleanup/success/collinfo.json")), ctx);
+        ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+    }
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_KEYS);
+    {
+        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                            TEST_FILE("./test/data/keys/"
+                                                      "12345678123498761234123456789012-local-document.json")),
+                  ctx);
+        ASSERT_FAILS(mongocrypt_ctx_mongo_done(ctx), ctx, "not all keys requested were satisfied");
+    }
+
+    mongocrypt_ctx_destroy(ctx);
+    mongocrypt_destroy(crypt);
+}
+
+static void _test_cleanup_need_kms_credentials(_mongocrypt_tester_t *tester) {
+    mongocrypt_t *crypt;
+    mongocrypt_ctx_t *ctx;
+
+    crypt = mongocrypt_new();
+    mongocrypt_setopt_use_need_kms_credentials_state(crypt);
+    ASSERT_OK(mongocrypt_setopt_kms_providers(crypt, TEST_BSON("{'aws': {}}")), crypt);
+    mongocrypt_setopt_use_need_kms_credentials_state(crypt);
+    ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
+
+    ctx = mongocrypt_ctx_new(crypt);
+    ASSERT_OK(mongocrypt_ctx_encrypt_init(ctx, "db", -1, TEST_FILE("./test/data/cleanup/success/cmd.json")), ctx);
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_COLLINFO);
+    {
+        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx, TEST_FILE("./test/data/cleanup/success/collinfo.json")), ctx);
+        ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+    }
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS);
+    {
+        ASSERT_OK(mongocrypt_ctx_provide_kms_providers(ctx,
+                                                       TEST_BSON("{'aws': {"
+                                                                 "   'accessKeyId': 'example',"
+                                                                 "   'secretAccessKey': 'example'}}")),
+                  ctx);
+    }
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_KEYS);
+    {
+        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                            TEST_FILE("./test/data/keys/"
+                                                      "12345678123498761234123456789012-aws-document.json")),
+                  ctx);
+        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                            TEST_FILE("./test/data/keys/"
+                                                      "ABCDEFAB123498761234123456789012-aws-document.json")),
+                  ctx);
+        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                            TEST_FILE("./test/data/keys/"
+                                                      "12345678123498761234123456789013-aws-document.json")),
+                  ctx);
+        ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+    }
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_KMS);
+    {
+        mongocrypt_kms_ctx_t *kms_ctx = mongocrypt_ctx_next_kms_ctx(ctx);
+        ASSERT(kms_ctx);
+        ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx,
+                                          TEST_FILE("./test/data/keys/"
+                                                    "12345678123498761234123456789013-"
+                                                    "aws-decrypt-reply.txt")),
+                  kms_ctx);
+        kms_ctx = mongocrypt_ctx_next_kms_ctx(ctx);
+        ASSERT(kms_ctx);
+        ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx,
+                                          TEST_FILE("./test/data/keys/"
+                                                    "ABCDEFAB123498761234123456789012-"
+                                                    "aws-decrypt-reply.txt")),
+                  kms_ctx);
+        kms_ctx = mongocrypt_ctx_next_kms_ctx(ctx);
+        ASSERT(kms_ctx);
+        ASSERT_OK(mongocrypt_kms_ctx_feed(kms_ctx,
+                                          TEST_FILE("./test/data/keys/"
+                                                    "12345678123498761234123456789012-"
+                                                    "aws-decrypt-reply.txt")),
+                  kms_ctx);
+        ASSERT(!mongocrypt_ctx_next_kms_ctx(ctx));
+        ASSERT_OK(mongocrypt_ctx_kms_done(ctx), ctx);
+    }
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_READY);
+    {
+        mongocrypt_binary_t *out = mongocrypt_binary_new();
+        ASSERT_OK(mongocrypt_ctx_finalize(ctx, out), ctx);
+        ASSERT_MONGOCRYPT_BINARY_EQUAL_BSON(TEST_FILE("./test/data/cleanup/success/encrypted-payload.json"), out);
+        mongocrypt_binary_destroy(out);
+    }
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_DONE);
+
+    mongocrypt_ctx_destroy(ctx);
+    mongocrypt_destroy(crypt);
+}
+
+static void _test_cleanup_no_fields(_mongocrypt_tester_t *tester) {
+    mongocrypt_t *crypt;
+    mongocrypt_ctx_t *ctx;
+
+    crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+    ctx = mongocrypt_ctx_new(crypt);
+
+    ASSERT_OK(mongocrypt_ctx_encrypt_init(ctx, "db", -1, TEST_FILE("./test/data/cleanup/success/cmd.json")), ctx);
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_COLLINFO);
+    {
+        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx, TEST_FILE("./test/data/cleanup/no-fields/collinfo.json")), ctx);
+        ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+    }
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_READY);
+    {
+        mongocrypt_binary_t *out = mongocrypt_binary_new();
+        ASSERT_OK(mongocrypt_ctx_finalize(ctx, out), ctx);
+        ASSERT_MONGOCRYPT_BINARY_EQUAL_BSON(TEST_FILE("./test/data/cleanup/no-fields/encrypted-payload.json"), out);
+        mongocrypt_binary_destroy(out);
+    }
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_DONE);
+
+    mongocrypt_ctx_destroy(ctx);
+    mongocrypt_destroy(crypt);
+}
+
+static void _test_cleanup_from_encrypted_field_config_map(_mongocrypt_tester_t *tester) {
+    mongocrypt_t *crypt;
+    mongocrypt_ctx_t *ctx;
+
+    /* Initialize crypt with encrypted_field_config_map */
+    {
+        char localkey_data[MONGOCRYPT_KEY_LEN] = {0};
+        mongocrypt_binary_t *localkey;
+
+        crypt = mongocrypt_new();
+        mongocrypt_setopt_log_handler(crypt, _mongocrypt_stdout_log_fn, NULL);
+        localkey = mongocrypt_binary_new_from_data((uint8_t *)localkey_data, sizeof localkey_data);
+        mongocrypt_setopt_kms_provider_local(crypt, localkey);
+        mongocrypt_binary_destroy(localkey);
+        ASSERT_OK(mongocrypt_setopt_encrypted_field_config_map(
+                      crypt,
+                      TEST_FILE("./test/data/cleanup/success/encrypted-field-config-map.json")),
+                  crypt);
+        ASSERT_OK(_mongocrypt_init_for_test(crypt), crypt);
+    }
+    ctx = mongocrypt_ctx_new(crypt);
+
+    ASSERT_OK(mongocrypt_ctx_encrypt_init(ctx, "db", -1, TEST_FILE("./test/data/cleanup/success/cmd.json")), ctx);
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_KEYS);
+    {
+        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                            TEST_FILE("./test/data/keys/"
+                                                      "12345678123498761234123456789012-local-document.json")),
+                  ctx);
+        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                            TEST_FILE("./test/data/keys/"
+                                                      "ABCDEFAB123498761234123456789012-local-document.json")),
+                  ctx);
+        ASSERT_OK(mongocrypt_ctx_mongo_feed(ctx,
+                                            TEST_FILE("./test/data/keys/"
+                                                      "12345678123498761234123456789013-local-document.json")),
+                  ctx);
+        ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
+    }
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_READY);
+    {
+        mongocrypt_binary_t *out = mongocrypt_binary_new();
+        ASSERT_OK(mongocrypt_ctx_finalize(ctx, out), ctx);
+        ASSERT_MONGOCRYPT_BINARY_EQUAL_BSON(TEST_FILE("./test/data/cleanup/success/encrypted-payload.json"), out);
+        mongocrypt_binary_destroy(out);
+    }
+
+    ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_DONE);
+
+    mongocrypt_ctx_destroy(ctx);
+    mongocrypt_destroy(crypt);
+}
+
+void _mongocrypt_tester_install_cleanup(_mongocrypt_tester_t *tester) {
+    INSTALL_TEST(_test_cleanup_success);
+    INSTALL_TEST(_test_cleanup_nonlocal_kms);
+    INSTALL_TEST(_test_cleanup_missing_key_id);
+    INSTALL_TEST(_test_cleanup_key_not_provided);
+    INSTALL_TEST(_test_cleanup_need_kms_credentials);
+    INSTALL_TEST(_test_cleanup_no_fields);
+    INSTALL_TEST(_test_cleanup_from_encrypted_field_config_map);
+}