mongo 2.11.2 → 2.13.0.beta1

data/spec/integration/{client_options_spec.rb → client_authentication_options_spec.rb}

@@ -1,6 +1,6 @@
-require 'spec_helper'
+require 'lite_spec_helper'
 
-describe 'Client options' do
+describe 'Client authentication options' do
   let(:uri) { "mongodb://#{credentials}127.0.0.1:27017/#{options}" }
 
   let(:credentials) { nil }
@@ -38,7 +38,7 @@ describe 'Client options' do
     end
   end
 
-  shared_examples_for 'auth mechanism that uses database or default auth source' do |default_auth_source:|
+  shared_examples_for 'auth mechanism that uses database or default auth source' do |default_auth_source|
     context 'where no database is provided' do
       context 'with URI options' do
         let(:credentials) { "#{user}:#{pwd}@" }
@@ -198,7 +198,7 @@ describe 'Client options' do
     let(:auth_mech_sym) { :mongodb_cr }
 
     it_behaves_like 'a supported auth mechanism'
-    it_behaves_like 'auth mechanism that uses database or default auth source', default_auth_source: 'admin'
+    it_behaves_like 'auth mechanism that uses database or default auth source', 'admin'
     it_behaves_like 'an auth mechanism that doesn\'t support auth_mech_properties'
   end
 
@@ -207,7 +207,7 @@ describe 'Client options' do
     let(:auth_mech_sym) { :scram }
 
     it_behaves_like 'a supported auth mechanism'
-    it_behaves_like 'auth mechanism that uses database or default auth source', default_auth_source: 'admin'
+    it_behaves_like 'auth mechanism that uses database or default auth source', 'admin'
     it_behaves_like 'an auth mechanism that doesn\'t support auth_mech_properties'
   end
 
@@ -216,7 +216,7 @@ describe 'Client options' do
     let(:auth_mech_sym) { :scram256 }
 
     it_behaves_like 'a supported auth mechanism'
-    it_behaves_like 'auth mechanism that uses database or default auth source', default_auth_source: 'admin'
+    it_behaves_like 'auth mechanism that uses database or default auth source', 'admin'
     it_behaves_like 'an auth mechanism that doesn\'t support auth_mech_properties'
   end
 
@@ -263,7 +263,7 @@ describe 'Client options' do
     let(:auth_mech_sym) { :plain }
 
     it_behaves_like 'a supported auth mechanism'
-    it_behaves_like 'auth mechanism that uses database or default auth source', default_auth_source: '$external'
+    it_behaves_like 'auth mechanism that uses database or default auth source', '$external'
     it_behaves_like 'an auth mechanism with ssl'
     it_behaves_like 'an auth mechanism that doesn\'t support auth_mech_properties'
   end
@@ -299,9 +299,9 @@ describe 'Client options' do
         let(:credentials) { "#{user}:password@" }
 
         it 'raises an exception on client creation' do
-          expect {
+          expect do
             client
-          }.to raise_error(Mongo::Auth::InvalidConfiguration, /password is not supported/)
+          end.to raise_error(Mongo::Auth::InvalidConfiguration, /Password is not supported/)
         end
       end
     end
@@ -325,9 +325,9 @@ describe 'Client options' do
         let(:client_opts) { { auth_mech: :mongodb_x509, user: user, password: 'password' } }
 
         it 'raises an exception on client creation' do
-          expect {
+          expect do
             client
-          }.to raise_error(Mongo::Auth::InvalidConfiguration, /password is not supported/)
+          end.to raise_error(Mongo::Auth::InvalidConfiguration, /Password is not supported/)
         end
       end
     end
@@ -346,9 +346,9 @@ describe 'Client options' do
         let(:credentials) { '@' }
 
         it 'raises an exception' do
-          expect {
+          expect do
             client
-          }.to raise_error(Mongo::Auth::InvalidConfiguration, /empty username is not supported/)
+          end.to raise_error(Mongo::Auth::InvalidConfiguration, /Empty username is not supported/)
         end
       end
     end
@@ -365,9 +365,9 @@ describe 'Client options' do
         let(:client_opts) { { user: '', password: '' } }
 
         it 'raises an exception' do
-          expect {
+          expect do
             client
-          }.to raise_error(Mongo::Auth::InvalidConfiguration, /empty username is not supported/)
+          end.to raise_error(Mongo::Auth::InvalidConfiguration, /Empty username is not supported/)
         end
       end
     end

data/spec/integration/client_construction_aws_auth_spec.rb

@@ -0,0 +1,191 @@
+require 'spec_helper'
+
+describe 'Client construction with AWS auth' do
+  require_aws_auth
+
+  let(:client) do
+    new_local_client(SpecConfig.instance.addresses,
+      SpecConfig.instance.ssl_options.merge(
+        auth_mech: :aws,
+        connect_timeout: 3.44, socket_timeout: 3.45,
+        server_selection_timeout: 3.46))
+  end
+
+  let(:authenticated_user_info) do
+    # https://stackoverflow.com/questions/21414608/mongodb-show-current-user
+    info = client.database.command(connectionStatus: 1).documents.first
+    info[:authInfo][:authenticatedUsers].first
+  end
+
+  let(:authenticated_user_name) { authenticated_user_info[:user] }
+
+  shared_examples_for 'connects successfully' do
+    it 'connects successfully' do
+      client['foo'].insert_one(test: true)
+    end
+  end
+
+  context 'credentials specified explicitly' do
+
+    let(:username) { ENV.fetch('MONGO_RUBY_DRIVER_AWS_AUTH_ACCESS_KEY_ID') }
+    let(:password) { ENV.fetch('MONGO_RUBY_DRIVER_AWS_AUTH_SECRET_ACCESS_KEY') }
+    let(:session_token) { ENV.fetch('MONGO_RUBY_DRIVER_AWS_AUTH_SESSION_TOKEN') }
+    let(:address_strs) { SpecConfig.instance.addresses.join(',') }
+
+    context 'regular credentials' do
+      require_auth 'aws-regular'
+
+      context 'via Ruby options' do
+        let(:client) do
+          new_local_client(SpecConfig.instance.addresses,
+            SpecConfig.instance.ssl_options.merge(
+              auth_mech: :aws,
+              user: username,
+              password: password,
+              connect_timeout: 3.34, socket_timeout: 3.35,
+              server_selection_timeout: 3.36))
+        end
+
+        it_behaves_like 'connects successfully'
+
+        it 'uses the expected user' do
+          puts "Authenticated as #{authenticated_user_name}"
+          authenticated_user_name.should =~ /^arn:aws:iam:/
+        end
+      end
+
+      context 'via URI' do
+        let(:client) do
+          new_local_client("mongodb://#{CGI.escape(username)}:#{CGI.escape(password)}@#{address_strs}/test?authMechanism=MONGODB-AWS&serverSelectionTimeoutMS=3.26")
+        end
+
+        it_behaves_like 'connects successfully'
+
+        it 'uses the expected user' do
+          puts "Authenticated as #{authenticated_user_name}"
+          authenticated_user_name.should =~ /^arn:aws:iam:/
+        end
+      end
+    end
+
+    context 'temporary credentials' do
+      require_auth 'aws-assume-role'
+
+      context 'via Ruby options' do
+        let(:client) do
+          new_local_client(SpecConfig.instance.addresses,
+            SpecConfig.instance.ssl_options.merge(
+              auth_mech: :aws,
+              user: username,
+              password: password,
+              auth_mech_properties: {
+                aws_session_token: session_token,
+              },
+              connect_timeout: 3.34, socket_timeout: 3.35,
+              server_selection_timeout: 3.36))
+        end
+
+        it_behaves_like 'connects successfully'
+
+        it 'uses the expected user' do
+          puts "Authenticated as #{authenticated_user_name}"
+          authenticated_user_name.should =~ /^arn:aws:sts:/
+        end
+      end
+
+      context 'via URI' do
+        let(:client) do
+          new_local_client("mongodb://#{CGI.escape(username)}:#{CGI.escape(password)}@#{address_strs}/test?authMechanism=MONGODB-AWS&serverSelectionTimeoutMS=3.26&authMechanismProperties=AWS_SESSION_TOKEN:#{CGI.escape(session_token)}")
+        end
+
+        it_behaves_like 'connects successfully'
+
+        it 'uses the expected user' do
+          puts "Authenticated as #{authenticated_user_name}"
+          authenticated_user_name.should =~ /^arn:aws:sts:/
+        end
+      end
+    end
+  end
+
+  context 'credentials specified via environment' do
+    require_auth 'aws-regular', 'aws-assume-role'
+
+    context 'no credentials given explicitly to Client constructor' do
+      context 'credentials not provided in environment' do
+        local_env(
+          'AWS_ACCESS_KEY_ID' => nil,
+          'AWS_SECRET_ACCESS_KEY' => nil,
+          'AWS_SESSION_TOKEN' => nil,
+        )
+
+        it 'does not connect' do
+          lambda do
+            client['foo'].insert_one(test: true)
+          end.should raise_error(Mongo::Auth::InvalidConfiguration, /Could not locate AWS credentials/)
+        end
+      end
+
+      context 'credentials provided in environment' do
+        local_env do
+          {
+            'AWS_ACCESS_KEY_ID' => ENV.fetch('MONGO_RUBY_DRIVER_AWS_AUTH_ACCESS_KEY_ID'),
+            'AWS_SECRET_ACCESS_KEY' => ENV.fetch('MONGO_RUBY_DRIVER_AWS_AUTH_SECRET_ACCESS_KEY'),
+            'AWS_SESSION_TOKEN' => ENV['MONGO_RUBY_DRIVER_AWS_AUTH_SESSION_TOKEN'],
+          }
+        end
+
+        it_behaves_like 'connects successfully'
+
+        context 'when using regular credentials' do
+          require_auth 'aws-regular'
+
+          it 'uses the expected user' do
+            puts "Authenticated as #{authenticated_user_name}"
+            authenticated_user_name.should =~ /^arn:/
+            authenticated_user_name.should_not =~ /^arn:.*assumed-role/
+          end
+        end
+
+        context 'when using assume role credentials' do
+          require_auth 'aws-assume-role'
+
+          it 'uses the expected user' do
+            puts "Authenticated as #{authenticated_user_name}"
+            authenticated_user_name.should =~ /^arn:.*assumed-role/
+          end
+        end
+      end
+    end
+  end
+
+  context 'credentials specified via instance/task metadata' do
+    require_auth 'aws-ec2', 'aws-ecs'
+
+    before(:all) do
+      # No explicit credentials are expected in the tested configurations
+      ENV['AWS_ACCESS_KEY_ID'].should be_nil
+    end
+
+    it_behaves_like 'connects successfully'
+
+    context 'when using ec2 instance role' do
+      require_auth 'aws-ec2'
+
+      it 'uses the expected user' do
+        puts "Authenticated as #{authenticated_user_name}"
+        authenticated_user_name.should =~ /^arn:aws:sts:.*assumed-role.*instance_profile_role/
+      end
+    end
+
+    context 'when using ecs task role' do
+      require_auth 'aws-ecs'
+
+      it 'uses the expected user' do
+        puts "Authenticated as #{authenticated_user_name}"
+        authenticated_user_name.should =~ /^arn:aws:sts:.*assumed-role.*ecstaskexecutionrole/i
+      end
+    end
+  end
+
+end

data/spec/integration/client_construction_spec.rb

@@ -7,7 +7,7 @@ describe 'Client construction' do
     SpecConfig.instance.test_options.merge(
       server_selection_timeout: 5,
       database: SpecConfig.instance.test_db,
-    ).merge(SpecConfig.instance.credentials_or_x509(
+    ).merge(SpecConfig.instance.credentials_or_external_user(
       user: SpecConfig.instance.test_user.name,
       password: SpecConfig.instance.test_user.password,
     ))
@@ -36,7 +36,7 @@ describe 'Client construction' do
 
     it 'creates connection pool and keeps it populated' do
       client = ClientRegistry.instance.new_local_client([SpecConfig.instance.addresses.first],
-        base_options.merge(min_pool_size: 1))
+        base_options.merge(min_pool_size: 1, max_pool_size: 1))
       # allow connection pool to populate
       sleep 0.1
 
@@ -133,4 +133,103 @@ describe 'Client construction' do
       expect(client.cluster.topology).not_to be_a(Mongo::Cluster::Topology::Unknown)
     end
   end
+
+  context 'with auto encryption options'do
+    require_libmongocrypt
+    require_enterprise
+    min_server_fcv '4.2'
+
+    # Diagnostics of leaked background threads only, these tests do not
+    # actually require a clean slate. https://jira.mongodb.org/browse/RUBY-2138
+    clean_slate
+
+    include_context 'define shared FLE helpers'
+    include_context 'with local kms_providers'
+
+    let(:options) { { auto_encryption_options: auto_encryption_options } }
+
+    let(:auto_encryption_options) do
+      {
+        key_vault_client: key_vault_client,
+        key_vault_namespace: key_vault_namespace,
+        kms_providers: kms_providers,
+        # Spawn mongocryptd on non-default port for sharded cluster tests
+        extra_options: extra_options,
+      }
+    end
+
+    let(:client) do
+      ClientRegistry.instance.new_local_client([SpecConfig.instance.addresses.first], options)
+    end
+
+    context 'with AWS kms providers with empty string credentials' do
+      let(:auto_encryption_options) do
+        {
+          key_vault_namespace: key_vault_namespace,
+          kms_providers: {
+            aws: {
+              access_key_id: '',
+              secret_access_key: '',
+            }
+          },
+          # Spawn mongocryptd on non-default port for sharded cluster tests
+          extra_options: extra_options,
+        }
+      end
+
+      it 'raises an exception' do
+        expect do
+          client
+        end.to raise_error(ArgumentError, /The aws access_key_id option must be a String with at least one character; it is currently an empty string/)
+      end
+    end
+
+    context 'with default key vault client' do
+      let(:key_vault_client) { nil }
+
+      it 'creates a working key vault client' do
+        key_vault_client = client.encrypter.key_vault_client
+
+        result = key_vault_client[:test].insert_one(test: 1)
+        expect(result).to be_ok
+      end
+
+      it 'creates a key vault client with the same cluster as the existing client' do
+        key_vault_client = client.encrypter.key_vault_client
+        expect(key_vault_client.cluster).to eq(client.cluster)
+      end
+    end
+  end
+
+  context 'when seed addresses are repeated in host list' do
+    require_topology :single
+
+    let(:primary_address) do
+      ClusterConfig.instance.primary_address_host
+    end
+
+    let(:client) do
+      new_local_client([primary_address, primary_address], SpecConfig.instance.test_options)
+    end
+
+    it 'deduplicates the addresses' do
+      expect(client.cluster.addresses).to eq([Mongo::Address.new(primary_address)])
+    end
+  end
+
+  context 'when seed addresses are repeated in URI' do
+    require_topology :single
+
+    let(:primary_address) do
+      ClusterConfig.instance.primary_address_host
+    end
+
+    let(:client) do
+      new_local_client("mongodb://#{primary_address},#{primary_address}", SpecConfig.instance.test_options)
+    end
+
+    it 'deduplicates the addresses' do
+      expect(client.cluster.addresses).to eq([Mongo::Address.new(primary_address)])
+    end
+  end
 end

data/spec/integration/client_side_encryption/auto_encryption_bulk_writes_spec.rb

@@ -0,0 +1,353 @@
+require 'spec_helper'
+
+describe 'Bulk writes with auto-encryption enabled' do
+  require_libmongocrypt
+  require_enterprise
+  min_server_fcv '4.2'
+
+  include_context 'define shared FLE helpers'
+  include_context 'with local kms_providers'
+
+  let(:subscriber) { EventSubscriber.new }
+
+  let(:client) do
+    new_local_client(
+      SpecConfig.instance.addresses,
+      SpecConfig.instance.test_options.merge(
+        auto_encryption_options: {
+          kms_providers: kms_providers,
+          key_vault_namespace: key_vault_namespace,
+          schema_map: { "auto_encryption.users" => schema_map },
+          # Spawn mongocryptd on non-default port for sharded cluster tests
+          extra_options: extra_options,
+        },
+        database: 'auto_encryption'
+      ),
+    ).tap do |client|
+      client.subscribe(Mongo::Monitoring::COMMAND, subscriber)
+    end
+  end
+
+  let(:size_limit) { Mongo::Server::ConnectionBase::REDUCED_MAX_BSON_SIZE }
+
+  before do
+    authorized_client.use('auto_encryption')['users'].drop
+
+    key_vault_collection.drop
+    key_vault_collection.insert_one(data_key)
+  end
+
+  let(:command_succeeded_events) do
+    subscriber.succeeded_events.select do |event|
+      event.command_name == command_name
+    end
+  end
+
+  shared_examples 'a functioning encrypted bulk write' do |options={}|
+    num_writes = options[:num_writes]
+
+    before do
+      perform_bulk_write
+    end
+
+    it 'executes an encrypted bulk write' do
+      documents = authorized_client.use('auto_encryption')['users'].find
+      ssns = documents.map { |doc| doc['ssn'] }
+      expect(ssns).to all(be_ciphertext)
+    end
+
+    it 'executes the correct number of writes' do
+      expect(command_succeeded_events.length).to eq(num_writes)
+    end
+  end
+
+  context 'using BulkWrite' do
+    let(:collection) { client['users'] }
+    let(:bulk_write) { Mongo::BulkWrite.new(collection, requests, {}) }
+    let(:perform_bulk_write) { bulk_write.execute }
+
+    context 'with insert operations' do
+      let(:command_name) { 'insert' }
+
+      context 'when total request size does not exceed 2MiB' do
+        let(:requests) do
+          [
+            { insert_one: { ssn: 'a' * (size_limit/2) } },
+            { insert_one: { ssn: 'a' * (size_limit/2) } }
+          ]
+        end
+
+        it_behaves_like 'a functioning encrypted bulk write', num_writes: 1
+      end
+
+      context 'when each operation is smaller than 2MiB, but the total request size is greater than 2MiB' do
+        let(:requests) do
+          [
+            { insert_one: { ssn: 'a' * (size_limit - 2000) } },
+            { insert_one: { ssn: 'a' * (size_limit - 2000) } }
+          ]
+        end
+
+        it_behaves_like 'a functioning encrypted bulk write', num_writes: 2
+      end
+
+      context 'when each operation is larger than 2MiB' do
+        let(:requests) do
+          [
+            { insert_one: { ssn: 'a' * (size_limit * 2) } },
+            { insert_one: { ssn: 'a' * (size_limit * 2) } }
+          ]
+        end
+
+        it_behaves_like 'a functioning encrypted bulk write', num_writes: 2
+      end
+
+      context 'when one operation is larger than 16MiB' do
+        let(:requests) do
+          [
+            { insert_one: { ssn: 'a' * (Mongo::Server::ConnectionBase::DEFAULT_MAX_BSON_OBJECT_SIZE + 1000) } },
+            { insert_one: { ssn: 'a' * size_limit } }
+          ]
+        end
+
+        it 'raises an exception' do
+          expect do
+            bulk_write.execute
+          end.to raise_error(Mongo::Error::MaxBSONSize, /maximum allowed size: 16777216 bytes/)
+        end
+      end
+    end
+
+    context 'with update operations' do
+      let(:command_name) { 'update' }
+
+      before do
+        client['users'].insert_one(_id: 1)
+        client['users'].insert_one(_id: 2)
+      end
+
+      context 'when total request size does not exceed 2MiB' do
+        let(:requests) do
+          [
+            { update_one: { filter: { _id: 1 }, update: { ssn: 'a' * (size_limit/2) } } },
+            { update_one: { filter: { _id: 2 }, update: { ssn: 'a' * (size_limit/2) } } },
+          ]
+        end
+
+        it_behaves_like 'a functioning encrypted bulk write', num_writes: 1
+      end
+
+      context 'when each operation is smaller than 2MiB, but the total request size is greater than 2MiB' do
+        let(:requests) do
+          [
+            { update_one: { filter: { _id: 1 }, update: { ssn: 'a' * (size_limit - 2000) } } },
+            { update_one: { filter: { _id: 2 }, update: { ssn: 'a' * (size_limit - 2000) } } },
+          ]
+        end
+
+        it_behaves_like 'a functioning encrypted bulk write', num_writes: 2
+      end
+
+      context 'when each operation is larger than 2MiB' do
+        let(:requests) do
+          [
+            { update_one: { filter: { _id: 1 }, update: { ssn: 'a' * (size_limit * 2) } } },
+            { update_one: { filter: { _id: 2 }, update: { ssn: 'a' * (size_limit * 2) } } },
+          ]
+        end
+
+        it_behaves_like 'a functioning encrypted bulk write', num_writes: 2
+      end
+
+      context 'when one operation is larger than 16MiB' do
+        let(:requests) do
+          [
+            { update_one: { filter: { _id: 1 }, update: { ssn: 'a' * (Mongo::Server::ConnectionBase::DEFAULT_MAX_BSON_OBJECT_SIZE - 100) } } },
+            { update_one: { filter: { _id: 2 }, update: { ssn: 'a' * size_limit } } },
+          ]
+        end
+
+        it 'raises an exception' do
+          expect do
+            bulk_write.execute
+          end.to raise_error(Mongo::Error::MaxBSONSize, /maximum allowed size: 16777216 bytes/)
+        end
+      end
+    end
+
+    context 'with delete operations' do
+      let(:command_name) { 'delete' }
+
+      context 'when total request size does not exceed 2MiB' do
+        before do
+          client['users'].insert_one(ssn: 'a' * (size_limit/2))
+          client['users'].insert_one(ssn: 'b' * (size_limit/2))
+        end
+
+        let(:requests) do
+          [
+            { delete_one: { filter: { ssn: 'a' * (size_limit/2) } } },
+            { delete_one: { filter: { ssn: 'b' * (size_limit/2) } } }
+          ]
+        end
+
+        it 'performs one delete' do
+          bulk_write.execute
+
+          documents = authorized_client.use('auto_encryption')['users'].find.to_a
+          expect(documents.length).to eq(0)
+          expect(command_succeeded_events.length).to eq(1)
+        end
+      end
+
+      context 'when each operation is smaller than 2MiB, but the total request size is greater than 2MiB' do
+        before do
+          client['users'].insert_one(ssn: 'a' * (size_limit - 2000))
+          client['users'].insert_one(ssn: 'b' * (size_limit - 2000))
+        end
+
+        let(:requests) do
+          [
+            { delete_one: { filter: { ssn: 'a' * (size_limit - 2000) } } },
+            { delete_one: { filter: { ssn: 'b' * (size_limit - 2000) } } }
+          ]
+        end
+
+        it 'performs two deletes' do
+          bulk_write.execute
+
+          documents = authorized_client.use('auto_encryption')['users'].find.to_a
+          expect(documents.length).to eq(0)
+          expect(command_succeeded_events.length).to eq(2)
+        end
+      end
+
+      context 'when each operation is larger than 2MiB' do
+        before do
+          client['users'].insert_one(ssn: 'a' * (size_limit * 2))
+          client['users'].insert_one(ssn: 'b' * (size_limit * 2))
+        end
+
+        let(:requests) do
+          [
+            { delete_one: { filter: { ssn: 'a' * (size_limit * 2) } } },
+            { delete_one: { filter: { ssn: 'b' * (size_limit * 2) } } }
+          ]
+        end
+
+        it 'performs two deletes' do
+          bulk_write.execute
+
+          documents = authorized_client.use('auto_encryption')['users'].find.to_a
+          expect(documents.length).to eq(0)
+          expect(command_succeeded_events.length).to eq(2)
+        end
+      end
+
+      context 'when one operation is larger than 16MiB' do
+        let(:requests) do
+          [
+            { delete_one: { filter: { ssn: 'a' * (Mongo::Server::ConnectionBase::DEFAULT_MAX_BSON_OBJECT_SIZE + 1000) } } },
+            { delete_one: { filter: { ssn: 'b' * (size_limit * 2) } } }
+          ]
+        end
+
+        it 'raises an exception' do
+          expect do
+            bulk_write.execute
+          end.to raise_error(Mongo::Error::MaxBSONSize, /maximum allowed size: 16777216 bytes/)
+        end
+      end
+    end
+
+    context 'with insert, update, and delete operations' do
+      context 'when total request size does not exceed 2MiB' do
+        let(:requests) do
+          [
+            { insert_one: { _id: 1, ssn: 'a' * (size_limit/3) } },
+            { update_one: { filter: { _id: 1 }, update: { ssn: 'b' * (size_limit/3) } } },
+            { delete_one: { filter: { ssn: 'b' * (size_limit/3) } } }
+          ]
+        end
+
+        it 'successfully performs the bulk write' do
+          bulk_write.execute
+
+          documents = authorized_client.use('auto_encryption')['users'].find.to_a
+          expect(documents.length).to eq(0)
+        end
+
+        # Bulk writes with different types of operations should
+        it 'performs 1 insert, 1 update, and 1 delete' do
+          bulk_write.execute
+
+          command_succeeded_events = subscriber.succeeded_events
+
+          inserts = command_succeeded_events.select { |event| event.command_name == 'insert' }
+          updates = command_succeeded_events.select { |event| event.command_name == 'update' }
+          deletes = command_succeeded_events.select { |event| event.command_name == 'delete' }
+
+          expect(inserts.length).to eq(1)
+          expect(updates.length).to eq(1)
+          expect(deletes.length).to eq(1)
+        end
+      end
+    end
+  end
+
+  context '#insert_many' do
+    let(:perform_bulk_write) do
+      client['users'].insert_many(documents)
+    end
+
+    let(:command_name) { 'insert' }
+
+    context 'when total request size does not exceed 2MiB' do
+      let(:documents) do
+        [
+          { ssn: 'a' * (size_limit/2) },
+          { ssn: 'a' * (size_limit/2) },
+        ]
+      end
+
+      it_behaves_like 'a functioning encrypted bulk write', num_writes: 1
+    end
+
+    context 'when each operation is smaller than 2MiB, but the total request size is greater than 2MiB' do
+      let(:documents) do
+        [
+          { ssn: 'a' * (size_limit - 2000) },
+          { ssn: 'a' * (size_limit - 2000) },
+        ]
+      end
+
+      it_behaves_like 'a functioning encrypted bulk write', num_writes: 2
+    end
+
+    context 'when each operation is larger than 2MiB' do
+      let(:documents) do
+        [
+          { ssn: 'a' * (size_limit * 2) },
+          { ssn: 'a' * (size_limit * 2) },
+        ]
+      end
+
+      it_behaves_like 'a functioning encrypted bulk write', num_writes: 2
+    end
+
+    context 'when one operation is larger than 16MiB' do
+      let(:documents) do
+        [
+          { ssn: 'a' * (Mongo::Server::ConnectionBase::DEFAULT_MAX_BSON_OBJECT_SIZE + 1000) },
+          { ssn: 'a' * size_limit },
+        ]
+      end
+
+      it 'raises an exception' do
+        expect do
+          perform_bulk_write
+        end.to raise_error(Mongo::Error::MaxBSONSize, /maximum allowed size: 16777216 bytes/)
+      end
+    end
+  end
+end