libmongocrypt-helper 1.8.0.0.1001 → 1.11.0.0.1001

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/asynchronous/explicit_encrypter.py

@@ -0,0 +1,156 @@
+# Copyright 2024-present MongoDB, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from pymongocrypt.asynchronous.state_machine import run_state_machine
+from pymongocrypt.mongocrypt import MongoCrypt
+from pymongocrypt.options import DataKeyOpts, ExplicitEncryptOpts
+
+
+class AsyncExplicitEncrypter:
+    def __init__(self, callback, mongo_crypt_opts):
+        """Encrypts and decrypts BSON values.
+
+        This class is used by a driver to support explicit encryption and
+        decryption of individual fields in a BSON document.
+
+        :Parameters:
+          - `callback`: A :class:`MongoCryptCallback`.
+          - `mongo_crypt_opts`: A :class:`MongoCryptOptions`.
+        """
+        self.callback = callback
+        if mongo_crypt_opts.schema_map is not None:
+            raise ValueError("mongo_crypt_opts.schema_map must be None")
+        self.mongocrypt = MongoCrypt(mongo_crypt_opts, callback)
+
+    async def create_data_key(
+        self, kms_provider, master_key=None, key_alt_names=None, key_material=None
+    ):
+        """Creates a data key used for explicit encryption.
+
+        :Parameters:
+          - `kms_provider`: The KMS provider to use. Supported values are
+            "aws", "azure", "gcp", "kmip", "local", or a named provider like
+            "kmip:name".
+          - `master_key`: See class:`DataKeyOpts`.
+          - `key_alt_names` (optional): An optional list of string alternate
+            names used to reference a key. If a key is created with alternate
+            names, then encryption may refer to the key by the unique
+            alternate name instead of by ``_id``.
+          - `key_material`: (optional) See class:`DataKeyOpts`.
+
+        :Returns:
+          The _id of the created data key document.
+        """
+        # CDRIVER-3275 each key_alt_name needs to be wrapped in a bson
+        # document.
+        encoded_names = []
+        if key_alt_names is not None:
+            for name in key_alt_names:
+                encoded_names.append(self.callback.bson_encode({"keyAltName": name}))
+
+        if key_material is not None:
+            key_material = self.callback.bson_encode({"keyMaterial": key_material})
+
+        opts = DataKeyOpts(master_key, encoded_names, key_material)
+        with self.mongocrypt.data_key_context(kms_provider, opts) as ctx:
+            key = await run_state_machine(ctx, self.callback)
+        return await self.callback.insert_data_key(key)
+
+    async def rewrap_many_data_key(self, filter, provider=None, master_key=None):
+        """Decrypts and encrypts all matching data keys with a possibly new `master_key` value.
+
+        :Parameters:
+          - `filter`: A document used to filter the data keys.
+          - `provider`: (optional) The name of a different kms provider.
+          - `master_key`: Optional document for the given provider.
+
+        :Returns:
+          A binary document with the rewrap data.
+        """
+        with self.mongocrypt.rewrap_many_data_key_context(
+            filter, provider, master_key
+        ) as ctx:
+            return await run_state_machine(ctx, self.callback)
+
+    async def encrypt(
+        self,
+        value,
+        algorithm,
+        key_id=None,
+        key_alt_name=None,
+        query_type=None,
+        contention_factor=None,
+        range_opts=None,
+        is_expression=False,
+    ):
+        """Encrypts a BSON value.
+
+        Note that exactly one of ``key_id`` or  ``key_alt_name`` must be
+        provided.
+
+        :Parameters:
+          - `value` (bytes): The BSON value to encrypt.
+          - `algorithm` (string): The encryption algorithm to use. See
+            :class:`Algorithm` for some valid options.
+          - `key_id` (bytes): The bytes of the binary subtype 4 ``_id`` data
+            key. For example, ``uuid.bytes`` or ``bytes(bson_binary)``.
+          - `key_alt_name` (string): Identifies a key vault document by
+            'keyAltName'.
+          - `query_type` (str): The query type to execute.
+          - `contention_factor` (int): The contention factor to use
+            when the algorithm is "Indexed".
+          - `range_opts` (bytes): Options for explicit encryption
+            with the "range" algorithm encoded as a BSON document.
+          - `is_expression` (boolean): True if this is an encryptExpression()
+            context. Defaults to False.
+
+        :Returns:
+          The encrypted BSON value.
+
+        .. versionchanged:: 1.3
+           Added the `query_type` and `contention_factor` parameters.
+        .. versionchanged:: 1.5
+           Added the `range_opts` and `is_expression` parameters.
+        """
+        # CDRIVER-3275 key_alt_name needs to be wrapped in a bson document.
+        if key_alt_name is not None:
+            key_alt_name = self.callback.bson_encode({"keyAltName": key_alt_name})
+        opts = ExplicitEncryptOpts(
+            algorithm,
+            key_id,
+            key_alt_name,
+            query_type,
+            contention_factor,
+            range_opts,
+            is_expression,
+        )
+        with self.mongocrypt.explicit_encryption_context(value, opts) as ctx:
+            return await run_state_machine(ctx, self.callback)
+
+    async def decrypt(self, value):
+        """Decrypts a BSON value.
+
+        :Parameters:
+          - `value`: The encoded document to decrypt, which must be in the
+            form { "v" : encrypted BSON value }}.
+
+        :Returns:
+          The decrypted BSON value.
+        """
+        with self.mongocrypt.explicit_decryption_context(value) as ctx:
+            return await run_state_machine(ctx, self.callback)
+
+    def close(self):
+        """Cleanup resources."""
+        self.mongocrypt.close()

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/asynchronous/state_machine.py

@@ -0,0 +1,149 @@
+# Copyright 2024-present MongoDB, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from abc import abstractmethod
+
+from pymongocrypt.asynchronous.credentials import _ask_for_kms_credentials
+from pymongocrypt.binding import lib
+from pymongocrypt.compat import ABC
+from pymongocrypt.errors import MongoCryptError
+
+
+class AsyncMongoCryptCallback(ABC):
+    """Callback ABC to perform I/O on behalf of libbmongocrypt."""
+
+    @abstractmethod
+    async def kms_request(self, kms_context):
+        """Complete a KMS request.
+
+        :Parameters:
+          - `kms_context`: A :class:`MongoCryptKmsContext`.
+
+        :Returns:
+          None
+        """
+
+    @abstractmethod
+    async def collection_info(self, database, filter):
+        """Get the collection info for a namespace.
+
+        The returned collection info is passed to libmongocrypt which reads
+        the JSON schema.
+
+        :Parameters:
+          - `database`: The database on which to run listCollections.
+          - `filter`: The filter to pass to listCollections.
+
+        :Returns:
+          The first document from the listCollections command response as BSON.
+        """
+
+    @abstractmethod
+    async def mark_command(self, database, cmd):
+        """Mark a command for encryption.
+
+        :Parameters:
+          - `database`: The database on which to run this command.
+          - `cmd`: The BSON command to run.
+
+        :Returns:
+          The marked command response from mongocryptd.
+        """
+
+    @abstractmethod
+    async def fetch_keys(self, filter):
+        """Yields one or more keys from the key vault.
+
+        :Parameters:
+          - `filter`: The filter to pass to find.
+
+        :Returns:
+          A generator which yields the requested keys from the key vault.
+        """
+
+    @abstractmethod
+    async def insert_data_key(self, data_key):
+        """Insert a data key into the key vault.
+
+        :Parameters:
+          - `data_key`: The data key document to insert.
+
+        :Returns:
+          The _id of the inserted data key document.
+        """
+
+    @abstractmethod
+    def bson_encode(self, doc):
+        """Encode a document to BSON.
+
+        A document can be any mapping type (like :class:`dict`).
+
+        :Parameters:
+          - `doc`: mapping type representing a document
+
+        :Returns:
+          The encoded BSON bytes.
+        """
+
+    @abstractmethod
+    async def close(self):
+        """Release resources."""
+
+
+async def run_state_machine(ctx, callback):
+    """Run the libmongocrypt state machine until completion.
+
+    :Parameters:
+      - `ctx`: A :class:`MongoCryptContext`.
+      - `callback`: A :class:`AsyncMongoCryptCallback`.
+
+    :Returns:
+      The completed libmongocrypt operation.
+    """
+    while True:
+        state = ctx.state
+        # Check for terminal states first.
+        if state == lib.MONGOCRYPT_CTX_ERROR:
+            ctx._raise_from_status()
+        elif state == lib.MONGOCRYPT_CTX_READY:
+            return ctx.finish()
+        elif state == lib.MONGOCRYPT_CTX_DONE:
+            return None
+
+        if state == lib.MONGOCRYPT_CTX_NEED_MONGO_COLLINFO:
+            list_colls_filter = ctx.mongo_operation()
+            coll_info = await callback.collection_info(ctx.database, list_colls_filter)
+            if coll_info:
+                ctx.add_mongo_operation_result(coll_info)
+            ctx.complete_mongo_operation()
+        elif state == lib.MONGOCRYPT_CTX_NEED_MONGO_MARKINGS:
+            mongocryptd_cmd = ctx.mongo_operation()
+            result = await callback.mark_command(ctx.database, mongocryptd_cmd)
+            ctx.add_mongo_operation_result(result)
+            ctx.complete_mongo_operation()
+        elif state == lib.MONGOCRYPT_CTX_NEED_MONGO_KEYS:
+            key_filter = ctx.mongo_operation()
+            for key in await callback.fetch_keys(key_filter):
+                ctx.add_mongo_operation_result(key)
+            ctx.complete_mongo_operation()
+        elif state == lib.MONGOCRYPT_CTX_NEED_KMS:
+            for kms_ctx in ctx.kms_contexts():
+                with kms_ctx:
+                    await callback.kms_request(kms_ctx)
+            ctx.complete_kms()
+        elif state == lib.MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS:
+            creds = await _ask_for_kms_credentials(ctx.kms_providers)
+            ctx.provide_kms_providers(callback.bson_encode(creds))
+        else:
+            raise MongoCryptError(f"unknown state: {state}")

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/auto_encrypter.py

@@ -12,50 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-from pymongocrypt.mongocrypt import MongoCrypt
-from pymongocrypt.state_machine import run_state_machine
+# Alias file for import compatibility
 
-
-class AutoEncrypter(object):
-    def __init__(self, callback, mongo_crypt_opts):
-        """Encrypts and decrypts MongoDB commands.
-
-        This class is used by a driver to support automatic encryption and
-        decryption of MongoDB commands.
-
-        :Parameters:
-          - `callback`: A :class:`MongoCryptCallback`.
-          - `mongo_crypt_opts`: A :class:`MongoCryptOptions`.
-        """
-        self.callback = callback
-        self.mongocrypt = MongoCrypt(mongo_crypt_opts, callback)
-
-    def encrypt(self, database, cmd):
-        """Encrypt a MongoDB command.
-
-        :Parameters:
-          - `database`: The database for this command.
-          - `cmd`: A MongoDB command as BSON.
-
-        :Returns:
-          The encrypted command.
-        """
-        with self.mongocrypt.encryption_context(database, cmd) as ctx:
-            return run_state_machine(ctx, self.callback)
-
-    def decrypt(self, response):
-        """Decrypt a MongoDB command response.
-
-        :Parameters:
-          - `response`: A MongoDB command response as BSON.
-
-        :Returns:
-          The decrypted command response.
-        """
-        with self.mongocrypt.decryption_context(response) as ctx:
-            return run_state_machine(ctx, self.callback)
-
-    def close(self):
-        """Cleanup resources."""
-        self.mongocrypt.close()
-        self.callback.close()
+from pymongocrypt.synchronous.auto_encrypter import *

data/ext/libmongocrypt/libmongocrypt/bindings/python/pymongocrypt/binary.py

@@ -20,30 +20,29 @@ from pymongocrypt.errors import MongoCryptError
 
 def _to_bytes(mongocrypt_binary):
     """Returns this mongocrypt_binary_t as bytes."""
-    data = lib.mongocrypt_binary_data(mongocrypt_binary)
+    data = mongocrypt_binary.data
     if data == ffi.NULL:
-        raise MongoCryptError('mongocrypt_binary_data returned NULL')
-    data_len = lib.mongocrypt_binary_len(mongocrypt_binary)
-    return ffi.unpack(ffi.cast("char*", data), data_len)
+        raise MongoCryptError("mongocrypt_binary_t.data returned NULL")
+    return ffi.unpack(ffi.cast("char*", data), mongocrypt_binary.len)
 
 
 def _write_bytes(mongocrypt_binary, data):
     """Writes the given data to a mongocrypt_binary_t."""
-    buf = lib.mongocrypt_binary_data(mongocrypt_binary)
+    buf = mongocrypt_binary.data
     if buf == ffi.NULL:
-        raise MongoCryptError('mongocrypt_binary_data returned NULL')
+        raise MongoCryptError("mongocrypt_binary_t.data returned NULL")
 
     ffi.memmove(buf, data, len(data))
+    mongocrypt_binary.len = len(data)
 
 
-class _MongoCryptBinary(object):
+class _MongoCryptBinary:
     __slots__ = ("bin",)
 
     def __init__(self, binary):
         """Wraps a mongocrypt_binary_t."""
         if binary == ffi.NULL:
-            raise MongoCryptError(
-                "unable to create new mongocrypt_binary object")
+            raise MongoCryptError("unable to create new mongocrypt_binary object")
         self.bin = binary
 
     def _close(self):
@@ -60,11 +59,10 @@ class _MongoCryptBinary(object):
 
     def to_bytes(self):
         """Returns this mongocrypt_binary_t as bytes."""
-        data = lib.mongocrypt_binary_data(self.bin)
+        data = self.bin.data
         if data == ffi.NULL:
-            return b''
-        data_len = lib.mongocrypt_binary_len(self.bin)
-        return ffi.unpack(ffi.cast("char*", data), data_len)
+            return b""
+        return ffi.unpack(ffi.cast("char*", data), self.bin.len)
 
 
 class MongoCryptBinaryOut(_MongoCryptBinary):
@@ -72,7 +70,7 @@ class MongoCryptBinaryOut(_MongoCryptBinary):
 
     def __init__(self):
         """Wraps a mongocrypt_binary_t."""
-        super(MongoCryptBinaryOut, self).__init__(lib.mongocrypt_binary_new())
+        super().__init__(lib.mongocrypt_binary_new())
 
 
 class MongoCryptBinaryIn(_MongoCryptBinary):
@@ -83,12 +81,11 @@ class MongoCryptBinaryIn(_MongoCryptBinary):
         # mongocrypt_binary_t does not own the data it is passed so we need to
         # create a separate reference to keep the data alive.
         self.cref = ffi.from_buffer("uint8_t[]", data)
-        super(MongoCryptBinaryIn, self).__init__(
-            lib.mongocrypt_binary_new_from_data(self.cref, len(data)))
+        super().__init__(lib.mongocrypt_binary_new_from_data(self.cref, len(data)))
 
     def _close(self):
         """Cleanup resources."""
-        super(MongoCryptBinaryIn, self)._close()
+        super()._close()
         if self.cref is not None:
             ffi.release(self.cref)
             self.cref = None