mongo 2.11.2 → 2.13.0.beta1

data/spec/mongo/client_encryption_spec.rb

@@ -0,0 +1,405 @@
+require 'spec_helper'
+
+describe Mongo::ClientEncryption do
+  require_libmongocrypt
+  include_context 'define shared FLE helpers'
+
+  let(:client) do
+    ClientRegistry.instance.new_local_client(
+      SpecConfig.instance.addresses,
+      SpecConfig.instance.test_options
+    )
+  end
+
+  let(:client_encryption) do
+    described_class.new(client, {
+      key_vault_namespace: key_vault_namespace,
+      kms_providers: kms_providers
+    })
+  end
+
+  describe '#initialize' do
+    shared_examples 'a functioning ClientEncryption' do
+      context 'with nil key_vault_namespace' do
+        let(:key_vault_namespace) { nil }
+
+        it 'raises an exception' do
+          expect do
+            client_encryption
+          end.to raise_error(ArgumentError, /:key_vault_namespace option cannot be nil/)
+        end
+      end
+
+      context 'with invalid key_vault_namespace' do
+        let(:key_vault_namespace) { 'three.word.namespace' }
+
+        it 'raises an exception' do
+          expect do
+            client_encryption
+          end.to raise_error(ArgumentError, /invalid key vault namespace/)
+        end
+      end
+
+      context 'with valid options' do
+        it 'creates a ClientEncryption object' do
+          expect do
+            client_encryption
+          end.not_to raise_error
+        end
+      end
+    end
+
+    context 'with local KMS providers' do
+      include_context 'with local kms_providers'
+      it_behaves_like 'a functioning ClientEncryption'
+    end
+
+    context 'with AWS KMS providers' do
+      include_context 'with AWS kms_providers'
+      it_behaves_like 'a functioning ClientEncryption'
+    end
+
+    context 'with invalid KMS provider information' do
+      let(:kms_providers) { { random_key: {} } }
+
+      it 'raises an exception' do
+        expect do
+          client_encryption
+        end.to raise_error(ArgumentError, /kms_providers option must have one of the following keys/)
+      end
+    end
+  end
+
+  describe '#create_data_key' do
+    let(:data_key_id) { client_encryption.create_data_key(kms_provider_name, options) }
+    let(:key_alt_names) { nil }
+
+    shared_examples 'it creates a data key' do |with_key_alt_names: false|
+      it 'returns the data key id and inserts it into the key vault collection' do
+        expect(data_key_id).to be_uuid
+
+        documents = client.use(key_vault_db)[key_vault_coll].find(_id: data_key_id)
+
+        expect(documents.count).to eq(1)
+
+        if with_key_alt_names
+          expect(documents.first['keyAltNames']).to match_array(key_alt_names)
+        else
+          expect(documents.first['keyAltNames']).to be_nil
+        end
+      end
+    end
+
+    shared_examples 'it supports key_alt_names' do
+      let(:options) { base_options.merge(key_alt_names: key_alt_names) }
+
+      context 'with one value in key_alt_names' do
+        let(:key_alt_names) { ['keyAltName1'] }
+        it_behaves_like 'it creates a data key', **{ with_key_alt_names: true }
+      end
+
+      context 'with multiple values in key_alt_names' do
+        let(:key_alt_names) { ['keyAltName1', 'keyAltName2'] }
+        it_behaves_like 'it creates a data key', **{ with_key_alt_names: true }
+      end
+
+      context 'with empty key_alt_names' do
+        let(:key_alt_names) { [] }
+        it_behaves_like 'it creates a data key'
+      end
+
+      context 'with invalid key_alt_names option' do
+        let(:key_alt_names) { 'keyAltName1' }
+
+        it 'raises an exception' do
+          expect do
+            data_key_id
+          end.to raise_error(ArgumentError, /key_alt_names option must be an Array/)
+        end
+      end
+
+      context 'with invalid key_alt_names values' do
+        let(:key_alt_names) { ['keyAltNames1', 3] }
+
+        it 'raises an exception' do
+          expect do
+            data_key_id
+          end.to raise_error(ArgumentError, /values of the :key_alt_names option Array must be Strings/)
+        end
+      end
+    end
+
+    context 'with AWS KMS provider' do
+      include_context 'with AWS kms_providers'
+
+      let(:base_options) { { master_key: { region: aws_region, key: aws_arn } } }
+      it_behaves_like 'it supports key_alt_names'
+
+      context 'with nil options' do
+        let(:options) { nil }
+
+        it 'raises an exception' do
+          expect do
+            data_key_id
+          end.to raise_error(ArgumentError, /options cannot be nil/)
+        end
+      end
+
+      context 'with empty options' do
+        let(:options) { {} }
+
+        it 'raises an exception' do
+          expect do
+            data_key_id
+          end.to raise_error(ArgumentError, /options Hash must contain a key named :master_key/)
+        end
+      end
+
+      context 'with nil master key' do
+        let(:options) { { master_key: nil } }
+
+        it 'raises an exception' do
+          expect do
+            data_key_id
+          end.to raise_error(ArgumentError, /The :master_key option cannot be nil/)
+        end
+      end
+
+      context 'with invalid master key' do
+        let(:options) { { master_key: 'master-key' } }
+
+        it 'raises an exception' do
+          expect do
+            data_key_id
+          end.to raise_error(ArgumentError, /master-key is an invalid :master_key option/)
+        end
+      end
+
+      context 'with empty master key' do
+        let(:options) { { master_key: {} } }
+
+        it 'raises an exception' do
+          expect do
+            data_key_id
+          end.to raise_error(ArgumentError, /The value of :region option of the :master_key options hash cannot be nil/)
+        end
+      end
+
+      context 'with nil region' do
+        let(:options) { { master_key: { region: nil, key: aws_arn } } }
+
+        it 'raises an exception' do
+          expect do
+            data_key_id
+          end.to raise_error(ArgumentError, /The value of :region option of the :master_key options hash cannot be nil/)
+        end
+      end
+
+      context 'with invalid region' do
+        let(:options) { { master_key: { region: 5, key: aws_arn } } }
+
+        it 'raises an exception' do
+          expect do
+            data_key_id
+          end.to raise_error(ArgumentError, /5 is an invalid AWS master_key region. The value of :region option of the :master_key options hash must be a String/)
+        end
+      end
+
+      context 'with nil key' do
+        let(:options) { { master_key: { key: nil, region: aws_region } } }
+
+        it 'raises an exception' do
+          expect do
+            data_key_id
+          end.to raise_error(ArgumentError, /The value of :key option of the :master_key options hash cannot be nil/)
+        end
+      end
+
+      context 'with invalid key' do
+        let(:options) { { master_key: { key: 5, region: aws_region } } }
+
+        it 'raises an exception' do
+          expect do
+            data_key_id
+          end.to raise_error(ArgumentError, /5 is an invalid AWS master_key key. The value of :key option of the :master_key options hash must be a String/)
+        end
+      end
+
+      context 'with invalid endpoint' do
+        let(:options) { { master_key: { key: aws_arn, region: aws_region, endpoint: 5 } } }
+
+        it 'raises an exception' do
+          expect do
+            data_key_id
+          end.to raise_error(ArgumentError, /5 is an invalid AWS master_key endpoint. The value of :endpoint option of the :master_key options hash must be a String/)
+        end
+      end
+
+      context 'with nil endpoint' do
+        let(:options) do
+          {
+            master_key: {
+              key: aws_arn,
+              region: aws_region,
+              endpoint: nil
+            }
+          }
+        end
+
+        it_behaves_like 'it creates a data key'
+      end
+
+      context 'with valid endpoint, no port' do
+        let(:options) do
+          {
+            master_key: {
+              key: aws_arn,
+              region: aws_region,
+              endpoint: aws_endpoint_host
+            }
+          }
+        end
+
+        it_behaves_like 'it creates a data key'
+      end
+
+      context 'with valid endpoint' do
+        let(:options) { data_key_options }
+        it_behaves_like 'it creates a data key'
+      end
+
+      context 'with invalid endpoint' do
+        let(:options) do
+          {
+            master_key: {
+              key: aws_arn,
+              region: aws_region,
+              endpoint: "https://#{aws_endpoint_host}:#{aws_endpoint_port}"
+            }
+          }
+        end
+
+        let(:expected_message) do
+          # RUBY-2129: This error message could be more specific and inform the user
+          # that there is a problem with their KMS endpoint
+          if BSON::Environment.jruby?
+            /getservbyname.* failed/
+          else
+            /SocketError/
+          end
+        end
+
+        it 'raises an exception' do
+          expect do
+            data_key_id
+          end.to raise_error(Mongo::Error::KmsError, expected_message)
+        end
+      end
+
+      context 'when socket connect errors out' do
+        let(:options) { data_key_options }
+
+        before do
+          allow_any_instance_of(OpenSSL::SSL::SSLSocket)
+            .to receive(:connect)
+            .and_raise('Error while connecting to socket')
+        end
+
+        it 'raises a KmsError' do
+          expect do
+            data_key_id
+          end.to raise_error(Mongo::Error::KmsError, /Error while connecting to socket/)
+        end
+      end
+
+      context 'when socket connect errors out' do
+        let(:options) { data_key_options }
+
+        before do
+          allow_any_instance_of(OpenSSL::SSL::SSLSocket)
+            .to receive(:sysclose)
+            .and_raise('Error while closing socket')
+        end
+
+        it 'does not raise an exception' do
+          expect do
+            data_key_id
+          end.not_to raise_error
+        end
+      end
+    end
+
+    context 'with local KMS provider' do
+      include_context 'with local kms_providers'
+      let(:options) { {} }
+      let(:base_options) { {} }
+
+      it_behaves_like 'it supports key_alt_names'
+      it_behaves_like 'it creates a data key'
+    end
+  end
+
+  describe '#encrypt/decrypt' do
+    let(:value) { ssn }
+    let(:encrypted_value) { encrypted_ssn }
+
+    before do
+      key_vault_collection.drop
+      key_vault_collection.insert_one(data_key)
+    end
+
+    shared_examples 'an encrypter' do
+      let(:encrypted) do
+        client_encryption.encrypt(
+          value,
+          {
+            key_id: key_id,
+            key_alt_name: key_alt_name,
+            algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
+          }
+        )
+      end
+
+      context 'with key_id option' do
+        let(:key_alt_name) { nil }
+
+        it 'correctly encrypts a string' do
+          expect(encrypted).to be_ciphertext
+          expect(encrypted.data).to eq(Base64.decode64(encrypted_value))
+        end
+      end
+
+      context 'with key_alt_name option' do
+        let(:key_id) { nil }
+
+        it 'correctly encrypts a string' do
+          expect(encrypted).to be_ciphertext
+          expect(encrypted.data).to eq(Base64.decode64(encrypted_value))
+        end
+      end
+    end
+
+    shared_examples 'a decrypter' do
+      it 'correctly decrypts a string' do
+        encrypted = BSON::Binary.new(Base64.decode64(encrypted_value), :ciphertext)
+
+        result = client_encryption.decrypt(encrypted)
+        expect(result).to eq(value)
+      end
+    end
+
+    context 'with local KMS providers' do
+      include_context 'with local kms_providers'
+
+      it_behaves_like 'an encrypter'
+      it_behaves_like 'a decrypter'
+    end
+
+    context 'with AWS KMS providers' do
+      include_context 'with AWS kms_providers'
+
+      it_behaves_like 'an encrypter'
+      it_behaves_like 'a decrypter'
+    end
+  end
+end

data/spec/mongo/client_spec.rb

@@ -527,6 +527,17 @@ describe Mongo::Client do
     end
   end
 
+  shared_context 'ensure test db exists' do
+    before(:all) do
+      # Ensure the database we are querying exists.
+      # When the entire test suite is run, it will generally have been
+      # created by a previous test, but if this test is run on a fresh
+      # deployment the database won't exist.
+      client = ClientRegistry.instance.global_client('authorized')
+      client['any-collection-name'].insert_one(any: :value)
+    end
+  end
+
   describe '#database_names' do
 
     it 'returns a list of database names' do
@@ -538,6 +549,8 @@ describe Mongo::Client do
     context 'when filter criteria is present' do
       min_server_fcv '3.6'
 
+      include_context 'ensure test db exists'
+
       let(:result) do
         root_authorized_client.database_names(filter)
       end
@@ -565,6 +578,8 @@ describe Mongo::Client do
     context 'when filter criteria is present' do
       min_server_fcv '3.6'
 
+      include_context 'ensure test db exists'
+
       let(:result) do
         root_authorized_client.list_databases(filter)
       end
@@ -585,16 +600,18 @@ describe Mongo::Client do
         root_authorized_client.options.merge(heartbeat_frequency: 100, monitoring: true)
       end
 
+      let(:subscriber) { EventSubscriber.new }
+
       let(:client) do
         ClientRegistry.instance.new_local_client(
           SpecConfig.instance.addresses, client_options
         ).tap do |cl|
-          cl.subscribe(Mongo::Monitoring::COMMAND, EventSubscriber.clear_events!)
+          cl.subscribe(Mongo::Monitoring::COMMAND, subscriber)
         end
       end
 
       let(:command) do
-        EventSubscriber.started_events.find { |c| c.command_name == 'listDatabases' }.command
+        subscriber.started_events.find { |c| c.command_name == 'listDatabases' }.command
       end
 
       before do
@@ -632,6 +649,8 @@ describe Mongo::Client do
     context 'when filter criteria is present' do
       min_server_fcv '3.6'
 
+      include_context 'ensure test db exists'
+
       let(:result) do
         client.list_mongo_databases(filter)
       end