mongo 2.11.2 → 2.13.0.beta1

data/spec/mongo/crypt/binding/status_spec.rb

@@ -0,0 +1,99 @@
+require 'mongo'
+require 'support/lite_constraints'
+
+RSpec.configure do |config|
+  config.extend(LiteConstraints)
+end
+
+describe 'Mongo::Crypt::Binding' do
+  describe 'mongocrypt_status_t binding' do
+    require_libmongocrypt
+
+    let(:status) { Mongo::Crypt::Binding.mongocrypt_status_new }
+    let(:message) { "Operation unauthorized" }
+
+    let(:status_with_info) do
+      Mongo::Crypt::Binding.mongocrypt_status_set(
+        status,
+        :error_client,
+        401,
+        message,
+        message.length + 1
+      )
+
+      status
+    end
+
+    after do
+      Mongo::Crypt::Binding.mongocrypt_status_destroy(status)
+    end
+
+    describe '#mongocrypt_status_new' do
+      it 'returns a pointer' do
+        expect(status).to be_a_kind_of(FFI::Pointer)
+      end
+    end
+
+    describe '#mongocrypt_status_type' do
+      context 'when status has no type' do
+        it 'returns :ok/0' do
+          expect(Mongo::Crypt::Binding.mongocrypt_status_type(status)).to eq(:ok)
+        end
+      end
+
+      context 'when status has type' do
+        it 'returns type' do
+          expect(Mongo::Crypt::Binding.mongocrypt_status_type(status_with_info)).to eq(:error_client)
+        end
+      end
+    end
+
+    describe '#mongocrypt_status_code' do
+      context 'when status has no code' do
+        it 'returns 0' do
+          expect(Mongo::Crypt::Binding.mongocrypt_status_code(status)).to eq(0)
+        end
+      end
+
+      context 'when status has code' do
+        it 'returns code' do
+          expect(Mongo::Crypt::Binding.mongocrypt_status_code(status_with_info)).to eq(401)
+        end
+      end
+    end
+
+    describe '#mongocrypt_status_message' do
+      context 'when status has no message' do
+        it 'returns nil' do
+          expect(Mongo::Crypt::Binding.mongocrypt_status_message(status, nil)).to eq(nil)
+        end
+      end
+
+      context 'when status has message' do
+        it 'returns message' do
+          expect(Mongo::Crypt::Binding.mongocrypt_status_message(status_with_info, nil)).to eq(message)
+        end
+      end
+    end
+
+    describe '#mongocrypt_status_ok' do
+      context 'when status_type is not ok' do
+        it 'returns false' do
+          expect(Mongo::Crypt::Binding.mongocrypt_status_ok(status_with_info)).to be false
+        end
+      end
+
+      context 'when status_type is ok' do
+        let(:message) { 'Operation successful' }
+        let(:status_with_info) do
+          Mongo::Crypt::Binding.mongocrypt_status_set(status, :ok, 200, message, message.length + 1)
+          status
+        end
+
+        it 'returns true' do
+          expect(Mongo::Crypt::Binding.mongocrypt_status_ok(status_with_info)).to be true
+        end
+      end
+    end
+  end
+end

data/spec/mongo/crypt/binding/version_spec.rb

@@ -0,0 +1,22 @@
+require 'mongo'
+require 'support/lite_constraints'
+
+RSpec.configure do |config|
+  config.extend(LiteConstraints)
+end
+
+describe 'Mongo::Crypt::Binding' do
+  require_libmongocrypt
+
+  describe '#mongocrypt_version' do
+    let(:version) { Mongo::Crypt::Binding.mongocrypt_version(nil) }
+
+    it 'is a string' do
+      expect(version).to be_a_kind_of(String)
+    end
+
+    it 'is in the x.y.z-tag format' do
+      expect(version).to match(/\A(\d+.){2}(\d+)?(-[A-Za-z\+\d]+)?\z/)
+    end
+  end
+end

data/spec/mongo/crypt/binding_unloaded_spec.rb

@@ -0,0 +1,20 @@
+require 'lite_spec_helper'
+
+describe 'Mongo::Crypt::Binding' do
+  require_no_libmongocrypt
+
+  context 'when load fails' do
+
+    it 'retries loading at the next reference' do
+      lambda do
+        Mongo::Crypt::Binding
+      end.should raise_error(LoadError, /no path to libmongocrypt specified/)
+
+      # second load should also be attempted and should fail with the
+      # LoadError exception
+      lambda do
+        Mongo::Crypt::Binding
+      end.should raise_error(LoadError, /no path to libmongocrypt specified/)
+    end
+  end
+end

data/spec/mongo/crypt/data_key_context_spec.rb

@@ -0,0 +1,213 @@
+require 'mongo'
+require 'base64'
+require 'lite_spec_helper'
+
+describe Mongo::Crypt::DataKeyContext do
+  require_libmongocrypt
+  include_context 'define shared FLE helpers'
+
+  let(:mongocrypt) do
+    Mongo::Crypt::Handle.new(kms_providers)
+  end
+
+  let(:io) { double("Mongo::Crypt::EncryptionIO") }
+
+  let(:context) { described_class.new(mongocrypt, io, kms_provider_name, options) }
+  let(:base_options) { {} }
+  let(:options) { base_options }
+
+  describe '#initialize' do
+    shared_examples 'it properly sets key_alt_names' do
+      context 'with one key_alt_names' do
+        let(:options) { base_options.merge(key_alt_names: ['keyAltName1']) }
+
+        it 'does not raise an exception' do
+          expect do
+            context
+          end.not_to raise_error
+        end
+      end
+
+      context 'with multiple key_alt_names' do
+        let(:options) { base_options.merge(key_alt_names: ['keyAltName1', 'keyAltName2']) }
+
+        it 'does not raise an exception' do
+          expect do
+            context
+          end.not_to raise_error
+        end
+      end
+
+      context 'with empty key_alt_names' do
+        let(:options) { base_options.merge(key_alt_names: []) }
+
+        it 'does not raise an exception' do
+          expect do
+            context
+          end.not_to raise_error
+        end
+      end
+
+      context 'with invalid key_alt_names' do
+        let(:options) { base_options.merge(key_alt_names: ['keyAltName1', 3]) }
+
+        it 'does raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /All values of the :key_alt_names option Array must be Strings/)
+        end
+      end
+
+      context 'with non-array key_alt_names' do
+        let(:options) { base_options.merge(key_alt_names: "keyAltName1") }
+
+        it 'does raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /key_alt_names option must be an Array/)
+        end
+      end
+    end
+
+    context 'with invalid kms provider'do
+      let(:kms_providers) { local_kms_providers }
+      let(:kms_provider_name) { 'invalid' }
+
+      it 'raises an exception' do
+        expect do
+          context
+        end.to raise_exception(/invalid is an invalid kms provider/)
+      end
+    end
+
+    context 'with local kms provider and empty options' do
+      include_context 'with local kms_providers'
+
+      it_behaves_like 'it properly sets key_alt_names'
+
+      it 'does not raise an exception' do
+        expect do
+          context
+        end.not_to raise_error
+      end
+    end
+
+    context 'with aws kms provider' do
+      include_context 'with AWS kms_providers'
+
+      let(:base_options) { { master_key: { region: 'us-east-2', key: 'arn' } } }
+
+      it_behaves_like 'it properly sets key_alt_names'
+
+      context 'with empty options' do
+        let(:options) { {} }
+
+        it 'raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /options Hash must contain a key named :master_key with a Hash value/)
+        end
+      end
+
+      context 'with an invalid master key option' do
+        let(:options) { { master_key: 'key' } }
+
+        it 'raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /:master_key option must be a Hash/)
+        end
+      end
+
+      context 'where master key is an empty hash' do
+        let(:options) { { master_key: {} } }
+
+        it 'raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /The value of :region option of the :master_key options hash cannot be nil/)
+        end
+      end
+
+      context 'with a nil region option' do
+        let(:options) { { master_key: { region: nil } } }
+
+        it 'raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /The value of :region option of the :master_key options hash cannot be nil/)
+        end
+      end
+
+      context 'with an invalid region option' do
+        let(:options) { { master_key: { region: 5 } } }
+
+        it 'raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /5 is an invalid AWS master_key region/)
+        end
+      end
+
+      context 'with an invalid key option' do
+        let(:options) { { master_key: { region: 'us-east-2', key: nil } } }
+
+        it 'raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /The value of :key option of the :master_key options hash cannot be nil/)
+        end
+      end
+
+      context 'with an invalid key option' do
+        let(:options) { { master_key: { region: 'us-east-2', key: 5 } } }
+
+        it 'raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /5 is an invalid AWS master_key key/)
+        end
+      end
+
+      context 'with an invalid endpoint option' do
+        let(:options) { { master_key: { region: 'us-east-2', key: 'arn', endpoint: 5 } } }
+
+        it 'raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /5 is an invalid AWS master_key endpoint/)
+        end
+      end
+
+      context 'with valid options' do
+        it 'does not raise an exception' do
+          expect do
+            context
+          end.not_to raise_error
+        end
+      end
+
+      context 'with valid endpoint' do
+        let(:options) { { master_key: { region: 'us-east-2', key: 'arn', endpoint: 'endpoint/to/kms' } } }
+
+        it 'does not raise an exception' do
+          expect do
+            context
+          end.not_to raise_error
+        end
+      end
+    end
+  end
+
+  describe '#run_state_machine' do
+    # TODO: test with AWS KMS provider
+
+    context 'with local KMS provider' do
+      include_context 'with local kms_providers'
+
+      it 'creates a data key' do
+        expect(context.run_state_machine).to be_a_kind_of(Hash)
+      end
+    end
+  end
+end

data/spec/mongo/crypt/encryption_io_spec.rb

@@ -0,0 +1,136 @@
+require 'mongo'
+require 'spec_helper'
+
+describe Mongo::Crypt::EncryptionIO do
+  let(:subject) do
+    described_class.new(
+      key_vault_namespace: 'foo.bar',
+      key_vault_client: authorized_client,
+      mongocryptd_options: mongocryptd_options,
+    )
+  end
+
+  describe '#spawn_mongocryptd' do
+    context 'no spawn path' do
+      let(:mongocryptd_options) do
+        {
+          mongocryptd_spawn_args: ['test'],
+        }
+      end
+
+      it 'fails with an exception' do
+        lambda do
+          subject.send(:spawn_mongocryptd)
+        end.should raise_error(ArgumentError, /Cannot spawn mongocryptd process when no.*mongocryptd_spawn_path/)
+      end
+    end
+
+    context 'no spawn args' do
+      let(:mongocryptd_options) do
+        {
+          mongocryptd_spawn_path: 'echo',
+        }
+      end
+
+      it 'fails with an exception' do
+        lambda do
+          subject.send(:spawn_mongocryptd)
+        end.should raise_error(ArgumentError, /Cannot spawn mongocryptd process when no.*mongocryptd_spawn_args/)
+      end
+    end
+
+    context 'empty array for spawn args' do
+      let(:mongocryptd_options) do
+        {
+          mongocryptd_spawn_path: 'echo',
+          mongocryptd_spawn_args: [],
+        }
+      end
+
+      it 'fails with an exception' do
+        lambda do
+          subject.send(:spawn_mongocryptd)
+        end.should raise_error(ArgumentError, /Cannot spawn mongocryptd process when no.*mongocryptd_spawn_args/)
+      end
+    end
+
+    context 'good spawn path and args' do
+      let(:mongocryptd_options) do
+        {
+          mongocryptd_spawn_path: 'echo',
+          mongocryptd_spawn_args: ['hi'],
+        }
+      end
+
+      it 'spawns' do
+        subject.send(:spawn_mongocryptd)
+      end
+    end
+
+    context '-- for args to emulate no args' do
+      let(:mongocryptd_options) do
+        {
+          mongocryptd_spawn_path: 'echo',
+          mongocryptd_spawn_args: ['--'],
+        }
+      end
+
+      it 'spawns' do
+        subject.send(:spawn_mongocryptd)
+      end
+    end
+  end
+
+  describe '#mark_command' do
+    let(:mock_client) do
+      double('mongocryptd client').tap do |client|
+        database = double('mock database')
+        expect(database).to receive(:command).and_raise(Mongo::Error::NoServerAvailable.new(Mongo::ServerSelector::Primary.new, nil, 'test message'))
+        allow(database).to receive(:command).and_return([])
+        expect(client).to receive(:database).at_least(:once).and_return(database)
+      end
+    end
+
+    let(:base_options) do
+      {
+        mongocryptd_spawn_path: 'echo',
+        mongocryptd_spawn_args: ['--'],
+      }
+    end
+
+    let(:subject) do
+      described_class.new(
+        mongocryptd_client: mock_client,
+        key_vault_namespace: 'foo.bar',
+        key_vault_client: authorized_client,
+        mongocryptd_options: mongocryptd_options,
+      )
+    end
+
+    context ':mongocryptd_bypass_spawn not given' do
+      let(:mongocryptd_options) do
+        base_options
+      end
+
+      it 'spawns' do
+        expect(subject).to receive(:spawn_mongocryptd)
+        subject.mark_command({})
+      end
+    end
+
+    context ':mongocryptd_bypass_spawn given' do
+      let(:mongocryptd_options) do
+        base_options.merge(
+          mongocryptd_bypass_spawn: true,
+        )
+      end
+
+      it 'does not spawn' do
+        expect(subject).not_to receive(:spawn_mongocryptd)
+        lambda do
+          subject.mark_command({})
+        end.should raise_error(Mongo::Error::NoServerAvailable, /test message/)
+      end
+    end
+  end
+end