mongo 2.11.6 → 2.12.0.rc0

data/spec/mongo/crypt/binding/helpers_spec.rb

@@ -0,0 +1,46 @@
+require 'mongo'
+require 'support/lite_constraints'
+
+RSpec.configure do |config|
+  config.extend(LiteConstraints)
+end
+
+describe 'Mongo::Crypt::Binding' do
+  describe 'helper methods' do
+    require_libmongocrypt
+
+    describe '#validate_document' do
+      context 'with BSON::Document data' do
+        it 'does not raise an exception' do
+          expect do
+            Mongo::Crypt::Binding.validate_document(BSON::Document.new)
+          end.not_to raise_error
+        end
+      end
+
+      context 'with Hash data' do
+        it 'does not raise an exception' do
+          expect do
+            Mongo::Crypt::Binding.validate_document({})
+          end.not_to raise_error
+        end
+      end
+
+      context 'with nil data' do
+        it 'raises an exception' do
+          expect do
+            Mongo::Crypt::Binding.validate_document(nil)
+          end.to raise_error(Mongo::Error::CryptError, /Attempted to pass nil data to libmongocrypt/)
+        end
+      end
+
+      context 'with non-document data' do
+        it 'raises an exception' do
+          expect do
+            Mongo::Crypt::Binding.validate_document('not a bson document')
+          end.to raise_error(Mongo::Error::CryptError, /Attempted to pass invalid data to libmongocrypt/)
+        end
+      end
+    end
+  end
+end

data/spec/mongo/crypt/binding/mongocrypt_spec.rb

@@ -0,0 +1,144 @@
+require 'mongo'
+require 'support/lite_constraints'
+require 'mongo/crypt/helpers/mongo_crypt_spec_helper'
+
+RSpec.configure do |config|
+  config.extend(LiteConstraints)
+end
+
+describe 'Mongo::Crypt::Binding' do
+  describe 'mongocrypt_t binding' do
+    require_libmongocrypt
+
+    after do
+      Mongo::Crypt::Binding.mongocrypt_destroy(mongocrypt)
+    end
+
+    describe '#mongocrypt_new' do
+      let(:mongocrypt) { Mongo::Crypt::Binding.mongocrypt_new }
+
+      it 'returns a pointer' do
+        expect(mongocrypt).to be_a_kind_of(FFI::Pointer)
+      end
+    end
+
+    describe '#mongocrypt_setopt_kms_provider_local' do
+      let(:mongocrypt) { Mongo::Crypt::Binding.mongocrypt_new }
+
+      let(:binary) do
+        p = FFI::MemoryPointer.new(key_bytes.size)
+              .write_array_of_type(FFI::TYPE_UINT8, :put_uint8, key_bytes)
+
+        Mongo::Crypt::Binding.mongocrypt_binary_new_from_data(p, key_bytes.length)
+      end
+
+      after do
+        Mongo::Crypt::Binding.mongocrypt_binary_destroy(binary)
+      end
+
+      context 'with valid key' do
+        let(:key_bytes) { [114, 117, 98, 121] * 24 } # 96 bytes
+
+        it 'returns true' do
+          expect(Mongo::Crypt::Binding.mongocrypt_setopt_kms_provider_local(mongocrypt, binary)).to be true
+        end
+      end
+
+      context 'with invalid key' do
+        let(:key_bytes) { [114, 117, 98, 121] * 23 } # NOT 96 bytes
+
+        it 'returns false' do
+          expect(Mongo::Crypt::Binding.mongocrypt_setopt_kms_provider_local(mongocrypt, binary)).to be false
+        end
+      end
+    end
+
+    describe '#mongocrypt_init' do
+      let(:key_bytes) { [114, 117, 98, 121] * 24 } # 96 bytes
+
+      let(:binary) do
+        p = FFI::MemoryPointer.new(key_bytes.size)
+              .write_array_of_type(FFI::TYPE_UINT8, :put_uint8, key_bytes)
+
+        Mongo::Crypt::Binding.mongocrypt_binary_new_from_data(p, key_bytes.length)
+      end
+
+      let(:mongocrypt) do
+        mongocrypt = Mongo::Crypt::Binding.mongocrypt_new
+        Mongo::Crypt::Binding.mongocrypt_setopt_kms_provider_local(mongocrypt, binary)
+
+        mongocrypt
+      end
+
+      after do
+        Mongo::Crypt::Binding.mongocrypt_binary_destroy(binary)
+      end
+
+      context 'with valid kms option' do
+        before do
+          MongoCryptSpecHelper.bind_crypto_hooks(mongocrypt)
+        end
+
+        it 'returns true' do
+          expect(Mongo::Crypt::Binding.mongocrypt_init(mongocrypt)).to be true
+        end
+      end
+
+      context 'without binding crypto hooks' do
+        it 'returns false' do
+          expect(Mongo::Crypt::Binding.mongocrypt_init(mongocrypt)).to be false
+        end
+      end
+
+      context 'with invalid kms option' do
+        before do
+          MongoCryptSpecHelper.bind_crypto_hooks(mongocrypt)
+        end
+
+        let(:key_bytes) { [114, 117, 98, 121] * 23 } # NOT 96 bytes
+
+        it 'returns false' do
+          expect(Mongo::Crypt::Binding.mongocrypt_init(mongocrypt)).to be false
+        end
+      end
+    end
+
+    describe '#mongocrypt_status' do
+      let(:status) { Mongo::Crypt::Binding.mongocrypt_status_new }
+      let(:mongocrypt) { mongocrypt = Mongo::Crypt::Binding.mongocrypt_new }
+
+      after do
+        Mongo::Crypt::Binding.mongocrypt_status_destroy(status)
+      end
+
+      context 'for a new mongocrypt_t object' do
+        it 'returns an ok status' do
+          Mongo::Crypt::Binding.mongocrypt_status(mongocrypt, status)
+          expect(Mongo::Crypt::Binding.mongocrypt_status_type(status)).to eq(:ok)
+        end
+      end
+
+      context 'for a mongocrypt_t object with invalid kms options' do
+        let(:key_bytes) { [114, 117, 98, 121] * 23 } # NOT 96 bytes
+
+        let(:binary) do
+          p = FFI::MemoryPointer.new(key_bytes.size)
+                .write_array_of_type(FFI::TYPE_UINT8, :put_uint8, key_bytes)
+
+          Mongo::Crypt::Binding.mongocrypt_binary_new_from_data(p, key_bytes.length)
+        end
+
+        after do
+          Mongo::Crypt::Binding.mongocrypt_binary_destroy(binary)
+        end
+
+        it 'returns a error_client status' do
+          Mongo::Crypt::Binding.mongocrypt_setopt_kms_provider_local(mongocrypt, binary)
+
+          Mongo::Crypt::Binding.mongocrypt_status(mongocrypt, status)
+          expect(Mongo::Crypt::Binding.mongocrypt_status_type(status)).to eq(:error_client)
+        end
+      end
+    end
+  end
+end

data/spec/mongo/crypt/binding/status_spec.rb

@@ -0,0 +1,99 @@
+require 'mongo'
+require 'support/lite_constraints'
+
+RSpec.configure do |config|
+  config.extend(LiteConstraints)
+end
+
+describe 'Mongo::Crypt::Binding' do
+  describe 'mongocrypt_status_t binding' do
+    require_libmongocrypt
+
+    let(:status) { Mongo::Crypt::Binding.mongocrypt_status_new }
+    let(:message) { "Operation unauthorized" }
+
+    let(:status_with_info) do
+      Mongo::Crypt::Binding.mongocrypt_status_set(
+        status,
+        :error_client,
+        401,
+        message,
+        message.length + 1
+      )
+
+      status
+    end
+
+    after do
+      Mongo::Crypt::Binding.mongocrypt_status_destroy(status)
+    end
+
+    describe '#mongocrypt_status_new' do
+      it 'returns a pointer' do
+        expect(status).to be_a_kind_of(FFI::Pointer)
+      end
+    end
+
+    describe '#mongocrypt_status_type' do
+      context 'when status has no type' do
+        it 'returns :ok/0' do
+          expect(Mongo::Crypt::Binding.mongocrypt_status_type(status)).to eq(:ok)
+        end
+      end
+
+      context 'when status has type' do
+        it 'returns type' do
+          expect(Mongo::Crypt::Binding.mongocrypt_status_type(status_with_info)).to eq(:error_client)
+        end
+      end
+    end
+
+    describe '#mongocrypt_status_code' do
+      context 'when status has no code' do
+        it 'returns 0' do
+          expect(Mongo::Crypt::Binding.mongocrypt_status_code(status)).to eq(0)
+        end
+      end
+
+      context 'when status has code' do
+        it 'returns code' do
+          expect(Mongo::Crypt::Binding.mongocrypt_status_code(status_with_info)).to eq(401)
+        end
+      end
+    end
+
+    describe '#mongocrypt_status_message' do
+      context 'when status has no message' do
+        it 'returns nil' do
+          expect(Mongo::Crypt::Binding.mongocrypt_status_message(status, nil)).to eq(nil)
+        end
+      end
+
+      context 'when status has message' do
+        it 'returns message' do
+          expect(Mongo::Crypt::Binding.mongocrypt_status_message(status_with_info, nil)).to eq(message)
+        end
+      end
+    end
+
+    describe '#mongocrypt_status_ok' do
+      context 'when status_type is not ok' do
+        it 'returns false' do
+          expect(Mongo::Crypt::Binding.mongocrypt_status_ok(status_with_info)).to be false
+        end
+      end
+
+      context 'when status_type is ok' do
+        let(:message) { 'Operation successful' }
+        let(:status_with_info) do
+          Mongo::Crypt::Binding.mongocrypt_status_set(status, :ok, 200, message, message.length + 1)
+          status
+        end
+
+        it 'returns true' do
+          expect(Mongo::Crypt::Binding.mongocrypt_status_ok(status_with_info)).to be true
+        end
+      end
+    end
+  end
+end

data/spec/mongo/crypt/binding/version_spec.rb

@@ -0,0 +1,22 @@
+require 'mongo'
+require 'support/lite_constraints'
+
+RSpec.configure do |config|
+  config.extend(LiteConstraints)
+end
+
+describe 'Mongo::Crypt::Binding' do
+  require_libmongocrypt
+
+  describe '#mongocrypt_version' do
+    let(:version) { Mongo::Crypt::Binding.mongocrypt_version(nil) }
+
+    it 'is a string' do
+      expect(version).to be_a_kind_of(String)
+    end
+
+    it 'is in the x.y.z-tag format' do
+      expect(version).to match(/\A(\d+.){2}(\d+)?(-[A-Za-z\+\d]+)?\z/)
+    end
+  end
+end

data/spec/mongo/crypt/binding_unloaded_spec.rb

@@ -0,0 +1,20 @@
+require 'lite_spec_helper'
+
+describe 'Mongo::Crypt::Binding' do
+  require_no_libmongocrypt
+
+  context 'when load fails' do
+
+    it 'retries loading at the next reference' do
+      lambda do
+        Mongo::Crypt::Binding
+      end.should raise_error(LoadError, /no path to libmongocrypt specified/)
+
+      # second load should also be attempted and should fail with the
+      # LoadError exception
+      lambda do
+        Mongo::Crypt::Binding
+      end.should raise_error(LoadError, /no path to libmongocrypt specified/)
+    end
+  end
+end

data/spec/mongo/crypt/data_key_context_spec.rb

@@ -0,0 +1,213 @@
+require 'mongo'
+require 'base64'
+require 'lite_spec_helper'
+
+describe Mongo::Crypt::DataKeyContext do
+  require_libmongocrypt
+  include_context 'define shared FLE helpers'
+
+  let(:mongocrypt) do
+    Mongo::Crypt::Handle.new(kms_providers)
+  end
+
+  let(:io) { double("Mongo::Crypt::EncryptionIO") }
+
+  let(:context) { described_class.new(mongocrypt, io, kms_provider_name, options) }
+  let(:base_options) { {} }
+  let(:options) { base_options }
+
+  describe '#initialize' do
+    shared_examples 'it properly sets key_alt_names' do
+      context 'with one key_alt_names' do
+        let(:options) { base_options.merge(key_alt_names: ['keyAltName1']) }
+
+        it 'does not raise an exception' do
+          expect do
+            context
+          end.not_to raise_error
+        end
+      end
+
+      context 'with multiple key_alt_names' do
+        let(:options) { base_options.merge(key_alt_names: ['keyAltName1', 'keyAltName2']) }
+
+        it 'does not raise an exception' do
+          expect do
+            context
+          end.not_to raise_error
+        end
+      end
+
+      context 'with empty key_alt_names' do
+        let(:options) { base_options.merge(key_alt_names: []) }
+
+        it 'does not raise an exception' do
+          expect do
+            context
+          end.not_to raise_error
+        end
+      end
+
+      context 'with invalid key_alt_names' do
+        let(:options) { base_options.merge(key_alt_names: ['keyAltName1', 3]) }
+
+        it 'does raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /All values of the :key_alt_names option Array must be Strings/)
+        end
+      end
+
+      context 'with non-array key_alt_names' do
+        let(:options) { base_options.merge(key_alt_names: "keyAltName1") }
+
+        it 'does raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /key_alt_names option must be an Array/)
+        end
+      end
+    end
+
+    context 'with invalid kms provider'do
+      let(:kms_providers) { local_kms_providers }
+      let(:kms_provider_name) { 'invalid' }
+
+      it 'raises an exception' do
+        expect do
+          context
+        end.to raise_exception(/invalid is an invalid kms provider/)
+      end
+    end
+
+    context 'with local kms provider and empty options' do
+      include_context 'with local kms_providers'
+
+      it_behaves_like 'it properly sets key_alt_names'
+
+      it 'does not raise an exception' do
+        expect do
+          context
+        end.not_to raise_error
+      end
+    end
+
+    context 'with aws kms provider' do
+      include_context 'with AWS kms_providers'
+
+      let(:base_options) { { master_key: { region: 'us-east-2', key: 'arn' } } }
+
+      it_behaves_like 'it properly sets key_alt_names'
+
+      context 'with empty options' do
+        let(:options) { {} }
+
+        it 'raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /options Hash must contain a key named :master_key with a Hash value/)
+        end
+      end
+
+      context 'with an invalid master key option' do
+        let(:options) { { master_key: 'key' } }
+
+        it 'raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /:master_key option must be a Hash/)
+        end
+      end
+
+      context 'where master key is an empty hash' do
+        let(:options) { { master_key: {} } }
+
+        it 'raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /The value of :region option of the :master_key options hash cannot be nil/)
+        end
+      end
+
+      context 'with a nil region option' do
+        let(:options) { { master_key: { region: nil } } }
+
+        it 'raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /The value of :region option of the :master_key options hash cannot be nil/)
+        end
+      end
+
+      context 'with an invalid region option' do
+        let(:options) { { master_key: { region: 5 } } }
+
+        it 'raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /5 is an invalid AWS master_key region/)
+        end
+      end
+
+      context 'with an invalid key option' do
+        let(:options) { { master_key: { region: 'us-east-2', key: nil } } }
+
+        it 'raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /The value of :key option of the :master_key options hash cannot be nil/)
+        end
+      end
+
+      context 'with an invalid key option' do
+        let(:options) { { master_key: { region: 'us-east-2', key: 5 } } }
+
+        it 'raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /5 is an invalid AWS master_key key/)
+        end
+      end
+
+      context 'with an invalid endpoint option' do
+        let(:options) { { master_key: { region: 'us-east-2', key: 'arn', endpoint: 5 } } }
+
+        it 'raises an exception' do
+          expect do
+            context
+          end.to raise_error(ArgumentError, /5 is an invalid AWS master_key endpoint/)
+        end
+      end
+
+      context 'with valid options' do
+        it 'does not raise an exception' do
+          expect do
+            context
+          end.not_to raise_error
+        end
+      end
+
+      context 'with valid endpoint' do
+        let(:options) { { master_key: { region: 'us-east-2', key: 'arn', endpoint: 'endpoint/to/kms' } } }
+
+        it 'does not raise an exception' do
+          expect do
+            context
+          end.not_to raise_error
+        end
+      end
+    end
+  end
+
+  describe '#run_state_machine' do
+    # TODO: test with AWS KMS provider
+
+    context 'with local KMS provider' do
+      include_context 'with local kms_providers'
+
+      it 'creates a data key' do
+        expect(context.run_state_machine).to be_a_kind_of(Hash)
+      end
+    end
+  end
+end