mongo 2.15.0 → 2.18.1

data/spec/integration/client_construction_spec.rb

@@ -184,23 +184,89 @@ describe 'Client construction' do
       it 'raises an exception' do
         expect do
           client
-        end.to raise_error(ArgumentError, /The aws access_key_id option must be a String with at least one character; it is currently an empty string/)
+        end.to raise_error(ArgumentError, /The access_key_id option must be a String with at least one character; it is currently an empty string/)
       end
     end
 
     context 'with default key vault client' do
       let(:key_vault_client) { nil }
 
-      it 'creates a working key vault client' do
-        key_vault_client = client.encrypter.key_vault_client
+      shared_examples 'creates a working key vault client' do
+        it 'creates a working key vault client' do
+          key_vault_client = client.encrypter.key_vault_client
 
-        result = key_vault_client[:test].insert_one(test: 1)
-        expect(result).to be_ok
+          result = key_vault_client[:test].insert_one(test: 1)
+          expect(result).to be_ok
+        end
       end
 
-      it 'creates a key vault client with the same cluster as the existing client' do
-        key_vault_client = client.encrypter.key_vault_client
-        expect(key_vault_client.cluster).to eq(client.cluster)
+      context 'when top-level max pool size is not 0' do
+        include_examples 'creates a working key vault client'
+
+        shared_examples 'limited connection pool' do
+          it 'creates a key vault client with a different cluster than the existing client' do
+            key_vault_client = client.encrypter.key_vault_client
+            expect(key_vault_client.cluster).not_to eq(client.cluster)
+          end
+
+          # min pool size for the key vault client can be greater than 0
+          # when the key vault client is the same as the top-level client.
+          # This is OK because we aren't making any more connections for FLE,
+          # the minimum was requested by application for its own needs.
+          it 'uses min pool size 0 for key vault client' do
+            key_vault_client = client.encrypter.key_vault_client
+            key_vault_client.options[:min_pool_size].should be 0
+          end
+        end
+
+        context 'when top-level max pool size is not specified' do
+          before do
+            client.options[:max_pool_size].should be nil
+          end
+
+          include_examples 'limited connection pool'
+
+          it 'uses unspecified max pool size for key vault client' do
+            key_vault_client = client.encrypter.key_vault_client
+            key_vault_client.options[:max_pool_size].should be nil
+          end
+        end
+
+        context 'when top-level max pool size is specified' do
+          let(:options) do
+            {
+              auto_encryption_options: auto_encryption_options,
+              max_pool_size: 42,
+            }
+          end
+
+          include_examples 'limited connection pool'
+
+          it 'uses the same max pool size for key vault client' do
+            key_vault_client = client.encrypter.key_vault_client
+            key_vault_client.options[:max_pool_size].should be 42
+          end
+        end
+      end
+
+      context 'when top-level max pool size is 0' do
+        let(:options) do
+          {
+            auto_encryption_options: auto_encryption_options,
+            max_pool_size: 0,
+          }
+        end
+
+        before do
+          client.options[:max_pool_size].should be 0
+        end
+
+        include_examples 'creates a working key vault client'
+
+        it 'creates a key vault client with the same cluster as the existing client' do
+          key_vault_client = client.encrypter.key_vault_client
+          expect(key_vault_client.cluster).to eq(client.cluster)
+        end
       end
     end
   end
@@ -236,4 +302,58 @@ describe 'Client construction' do
       expect(client.cluster.addresses).to eq([Mongo::Address.new(primary_address)])
     end
   end
+
+  context 'when deployment is not a sharded cluster' do
+    require_topology :single, :replica_set
+
+    let(:client) do
+      ClientRegistry.instance.new_local_client(
+        [SpecConfig.instance.addresses.first],
+        SpecConfig.instance.test_options.merge(options),
+      )
+    end
+
+    context 'when load-balanced topology is requested' do
+      let(:options) do
+        {connect: :load_balanced, replica_set: nil}
+      end
+
+      it 'creates the client successfully' do
+        client.should be_a(Mongo::Client)
+      end
+
+      it 'fails all operations' do
+        lambda do
+          client.command(ping: true)
+        end.should raise_error(Mongo::Error::BadLoadBalancerTarget)
+      end
+    end
+  end
+
+  context 'when in load-balanced mode' do
+    require_topology :load_balanced
+
+    let(:client) do
+      ClientRegistry.instance.new_local_client(
+        [SpecConfig.instance.addresses.first],
+        SpecConfig.instance.test_options.merge(options),
+      )
+    end
+
+    context 'when load-balanced topology is requested via the URI option' do
+      let(:options) do
+        {connect: nil, load_balanced: true}
+      end
+
+      it 'creates the client successfully' do
+        client.should be_a(Mongo::Client)
+      end
+
+      it 'fails all operations' do
+        lambda do
+          client.command(ping: true)
+        end.should raise_error(Mongo::Error::MissingServiceId)
+      end
+    end
+  end
 end

data/spec/integration/client_side_encryption/auto_encryption_bulk_writes_spec.rb

@@ -11,7 +11,7 @@ describe 'Bulk writes with auto-encryption enabled' do
   include_context 'define shared FLE helpers'
   include_context 'with local kms_providers'
 
-  let(:subscriber) { EventSubscriber.new }
+  let(:subscriber) { Mrss::EventSubscriber.new }
 
   let(:client) do
     new_local_client(
@@ -132,8 +132,8 @@ describe 'Bulk writes with auto-encryption enabled' do
       context 'when total request size does not exceed 2MiB' do
         let(:requests) do
           [
-            { update_one: { filter: { _id: 1 }, update: { ssn: 'a' * (size_limit/2) } } },
-            { update_one: { filter: { _id: 2 }, update: { ssn: 'a' * (size_limit/2) } } },
+            { replace_one: { filter: { _id: 1 }, replacement: { ssn: 'a' * (size_limit/2) } } },
+            { replace_one: { filter: { _id: 2 }, replacement: { ssn: 'a' * (size_limit/2) } } },
           ]
         end
 
@@ -143,8 +143,8 @@ describe 'Bulk writes with auto-encryption enabled' do
       context 'when each operation is smaller than 2MiB, but the total request size is greater than 2MiB' do
         let(:requests) do
           [
-            { update_one: { filter: { _id: 1 }, update: { ssn: 'a' * (size_limit - 2000) } } },
-            { update_one: { filter: { _id: 2 }, update: { ssn: 'a' * (size_limit - 2000) } } },
+            { replace_one: { filter: { _id: 1 }, replacement: { ssn: 'a' * (size_limit - 2000) } } },
+            { replace_one: { filter: { _id: 2 }, replacement: { ssn: 'a' * (size_limit - 2000) } } },
           ]
         end
 
@@ -154,8 +154,8 @@ describe 'Bulk writes with auto-encryption enabled' do
       context 'when each operation is larger than 2MiB' do
         let(:requests) do
           [
-            { update_one: { filter: { _id: 1 }, update: { ssn: 'a' * (size_limit * 2) } } },
-            { update_one: { filter: { _id: 2 }, update: { ssn: 'a' * (size_limit * 2) } } },
+            { replace_one: { filter: { _id: 1 }, replacement: { ssn: 'a' * (size_limit * 2) } } },
+            { replace_one: { filter: { _id: 2 }, replacement: { ssn: 'a' * (size_limit * 2) } } },
           ]
         end
 
@@ -165,8 +165,8 @@ describe 'Bulk writes with auto-encryption enabled' do
       context 'when one operation is larger than 16MiB' do
         let(:requests) do
           [
-            { update_one: { filter: { _id: 1 }, update: { ssn: 'a' * (Mongo::Server::ConnectionBase::DEFAULT_MAX_BSON_OBJECT_SIZE) } } },
-            { update_one: { filter: { _id: 2 }, update: { ssn: 'a' * size_limit } } },
+            { replace_one: { filter: { _id: 1 }, replacement: { ssn: 'a' * (Mongo::Server::ConnectionBase::DEFAULT_MAX_BSON_OBJECT_SIZE) } } },
+            { replace_one: { filter: { _id: 2 }, replacement: { ssn: 'a' * size_limit } } },
           ]
         end
 
@@ -272,7 +272,7 @@ describe 'Bulk writes with auto-encryption enabled' do
         let(:requests) do
           [
             { insert_one: { _id: 1, ssn: 'a' * (size_limit/3) } },
-            { update_one: { filter: { _id: 1 }, update: { ssn: 'b' * (size_limit/3) } } },
+            { replace_one: { filter: { _id: 1 }, replacement: { ssn: 'b' * (size_limit/3) } } },
             { delete_one: { filter: { ssn: 'b' * (size_limit/3) } } }
           ]
         end

data/spec/integration/client_side_encryption/auto_encryption_command_monitoring_spec.rb

@@ -15,7 +15,7 @@ describe 'Auto Encryption' do
   include_context 'define shared FLE helpers'
   include_context 'with local kms_providers'
 
-  let(:subscriber) { EventSubscriber.new }
+  let(:subscriber) { Mrss::EventSubscriber.new }
   let(:db_name) { 'auto_encryption' }
 
   let(:encryption_client) do
@@ -41,19 +41,14 @@ describe 'Auto Encryption' do
     key_vault_collection.insert_one(data_key)
 
     encryption_client['users'].drop
-    result = encryption_client['users'].insert_one(ssn: ssn, age: 23)
   end
 
   let(:started_event) do
-    subscriber.started_events.find do |event|
-      event.command_name == command_name && event.database_name == db_name
-    end
+    subscriber.single_command_started_event(command_name, database_name: db_name)
   end
 
   let(:succeeded_event) do
-    subscriber.succeeded_events.find do |event|
-      event.command_name == command_name && event.database_name == db_name
-    end
+    subscriber.single_command_succeeded_event(command_name, database_name: db_name)
   end
 
   let(:key_vault_list_collections_event) do
@@ -62,245 +57,250 @@ describe 'Auto Encryption' do
     end
   end
 
-  shared_examples 'it has an encrypted key_vault_client' do
-    it 'registers a listCollections event on the key vault client' do
-      expect(key_vault_list_collections_event).not_to be_nil
-      expect(key_vault_list_collections_event.command['$db']).to eq(key_vault_db)
+  shared_examples 'it has a non-encrypted key_vault_client' do
+    it 'does not register a listCollections event on the key vault client' do
+      expect(key_vault_list_collections_event).to be_nil
     end
   end
 
-  describe '#aggregate' do
-    let(:command_name) { 'aggregate' }
-
+  context 'when performing operations that need a document in the database' do
     before do
-      encryption_client['users'].aggregate([{ '$match' => { 'ssn' => ssn } }]).first
+      result = encryption_client['users'].insert_one(ssn: ssn, age: 23)
     end
 
-    it 'has encrypted data in command monitoring' do
-      # Command started event occurs after ssn is encrypted
-      expect(
-        started_event.command["pipeline"].first["$match"]["ssn"]["$eq"]
-      ).to be_ciphertext
+    describe '#aggregate' do
+      let(:command_name) { 'aggregate' }
 
-      # Command succeeded event occurs before ssn is decrypted
-      expect(succeeded_event.reply["cursor"]["firstBatch"].first["ssn"]).to be_ciphertext
-    end
+      before do
+        encryption_client['users'].aggregate([{ '$match' => { 'ssn' => ssn } }]).first
+      end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
-  end
+      it 'has encrypted data in command monitoring' do
+        # Command started event occurs after ssn is encrypted
+        expect(
+          started_event.command["pipeline"].first["$match"]["ssn"]["$eq"]
+        ).to be_ciphertext
 
-  describe '#count' do
-    let(:command_name) { 'count' }
+        # Command succeeded event occurs before ssn is decrypted
+        expect(succeeded_event.reply["cursor"]["firstBatch"].first["ssn"]).to be_ciphertext
+      end
 
-    before do
-      encryption_client['users'].count(ssn: ssn)
+      it_behaves_like 'it has a non-encrypted key_vault_client'
     end
 
-    it 'has encrypted data in command monitoring' do
-      # Command started event occurs after ssn is encrypted
-      # Command succeeded event does not contain any data to be decrypted
-      expect(started_event.command["query"]["ssn"]["$eq"]).to be_ciphertext
-    end
+    describe '#count' do
+      let(:command_name) { 'count' }
 
-    it_behaves_like 'it has an encrypted key_vault_client'
-  end
+      before do
+        encryption_client['users'].count(ssn: ssn)
+      end
 
-  describe '#distinct' do
-    let(:command_name) { 'distinct' }
+      it 'has encrypted data in command monitoring' do
+        # Command started event occurs after ssn is encrypted
+        # Command succeeded event does not contain any data to be decrypted
+        expect(started_event.command["query"]["ssn"]["$eq"]).to be_ciphertext
+      end
 
-    before do
-      encryption_client['users'].distinct(:ssn)
+      it_behaves_like 'it has a non-encrypted key_vault_client'
     end
 
-    it 'has encrypted data in command monitoring' do
-      # Command started event does not contain any data to be encrypted
-      # Command succeeded event occurs before ssn is decrypted
-      expect(succeeded_event.reply["values"].first).to be_ciphertext
-    end
+    describe '#distinct' do
+      let(:command_name) { 'distinct' }
 
-    it_behaves_like 'it has an encrypted key_vault_client'
-  end
+      before do
+        encryption_client['users'].distinct(:ssn)
+      end
 
-  describe '#delete_one' do
-    let(:command_name) { 'delete' }
+      it 'has encrypted data in command monitoring' do
+        # Command started event does not contain any data to be encrypted
+        # Command succeeded event occurs before ssn is decrypted
+        expect(succeeded_event.reply["values"].first).to be_ciphertext
+      end
 
-    before do
-      encryption_client['users'].delete_one(ssn: ssn)
+      it_behaves_like 'it has a non-encrypted key_vault_client'
     end
 
-    it 'has encrypted data in command monitoring' do
-      # Command started event occurs after ssn is encrypted
-      # Command succeeded event does not contain any data to be decrypted
-      expect(started_event.command["deletes"].first["q"]["ssn"]["$eq"]).to be_ciphertext
-    end
+    describe '#delete_one' do
+      let(:command_name) { 'delete' }
 
-    it_behaves_like 'it has an encrypted key_vault_client'
-  end
+      before do
+        encryption_client['users'].delete_one(ssn: ssn)
+      end
 
-  describe '#delete_many' do
-    let(:command_name) { 'delete' }
+      it 'has encrypted data in command monitoring' do
+        # Command started event occurs after ssn is encrypted
+        # Command succeeded event does not contain any data to be decrypted
+        expect(started_event.command["deletes"].first["q"]["ssn"]["$eq"]).to be_ciphertext
+      end
 
-    before do
-      encryption_client['users'].delete_many(ssn: ssn)
+      it_behaves_like 'it has a non-encrypted key_vault_client'
     end
 
-    it 'has encrypted data in command monitoring' do
-      # Command started event occurs after ssn is encrypted
-      # Command succeeded event does not contain any data to be decrypted
-      expect(started_event.command["deletes"].first["q"]["ssn"]["$eq"]).to be_ciphertext
-    end
+    describe '#delete_many' do
+      let(:command_name) { 'delete' }
 
-    it_behaves_like 'it has an encrypted key_vault_client'
-  end
+      before do
+        encryption_client['users'].delete_many(ssn: ssn)
+      end
 
-  describe '#find' do
-    let(:command_name) { 'find' }
+      it 'has encrypted data in command monitoring' do
+        # Command started event occurs after ssn is encrypted
+        # Command succeeded event does not contain any data to be decrypted
+        expect(started_event.command["deletes"].first["q"]["ssn"]["$eq"]).to be_ciphertext
+      end
 
-    before do
-      encryption_client['users'].find(ssn: ssn).first
+      it_behaves_like 'it has a non-encrypted key_vault_client'
     end
 
-    it 'has encrypted data in command monitoring' do
-      # Command started event occurs after ssn is encrypted
-      expect(started_event.command["filter"]["ssn"]["$eq"]).to be_ciphertext
+    describe '#find' do
+      let(:command_name) { 'find' }
 
-      # Command succeeded event occurs before ssn is decrypted
-      expect(succeeded_event.reply["cursor"]["firstBatch"].first["ssn"]).to be_ciphertext
-    end
+      before do
+        encryption_client['users'].find(ssn: ssn).first
+      end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
-  end
+      it 'has encrypted data in command monitoring' do
+        # Command started event occurs after ssn is encrypted
+        expect(started_event.command["filter"]["ssn"]["$eq"]).to be_ciphertext
 
-  describe '#find_one_and_delete' do
-    let(:command_name) { 'findAndModify' }
+        # Command succeeded event occurs before ssn is decrypted
+        expect(succeeded_event.reply["cursor"]["firstBatch"].first["ssn"]).to be_ciphertext
+      end
 
-    before do
-      encryption_client['users'].find_one_and_delete(ssn: ssn)
+      it_behaves_like 'it has a non-encrypted key_vault_client'
     end
 
-    it 'has encrypted data in command monitoring' do
-      # Command started event occurs after ssn is encrypted
-      expect(started_event.command["query"]["ssn"]["$eq"]).to be_ciphertext
+    describe '#find_one_and_delete' do
+      let(:command_name) { 'findAndModify' }
 
-      # Command succeeded event occurs before ssn is decrypted
-      expect(succeeded_event.reply["value"]["ssn"]).to be_ciphertext
-    end
+      before do
+        encryption_client['users'].find_one_and_delete(ssn: ssn)
+      end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
-  end
+      it 'has encrypted data in command monitoring' do
+        # Command started event occurs after ssn is encrypted
+        expect(started_event.command["query"]["ssn"]["$eq"]).to be_ciphertext
 
-  describe '#find_one_and_replace' do
-    let(:command_name) { 'findAndModify' }
+        # Command succeeded event occurs before ssn is decrypted
+        expect(succeeded_event.reply["value"]["ssn"]).to be_ciphertext
+      end
 
-    before do
-      encryption_client['users'].find_one_and_replace(
-        { ssn: ssn },
-        { ssn: '555-555-5555' }
-      )
+      it_behaves_like 'it has a non-encrypted key_vault_client'
     end
 
-    it 'has encrypted data in command monitoring' do
-      # Command started event occurs after ssn is encrypted
-      expect(started_event.command["query"]["ssn"]["$eq"]).to be_ciphertext
-      expect(started_event.command["update"]["ssn"]).to be_ciphertext
+    describe '#find_one_and_replace' do
+      let(:command_name) { 'findAndModify' }
 
-      # Command succeeded event occurs before ssn is decrypted
-      expect(succeeded_event.reply["value"]["ssn"]).to be_ciphertext
-    end
+      before do
+        encryption_client['users'].find_one_and_replace(
+          { ssn: ssn },
+          { ssn: '555-555-5555' }
+        )
+      end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
-  end
+      it 'has encrypted data in command monitoring' do
+        # Command started event occurs after ssn is encrypted
+        expect(started_event.command["query"]["ssn"]["$eq"]).to be_ciphertext
+        expect(started_event.command["update"]["ssn"]).to be_ciphertext
 
-  describe '#find_one_and_update' do
-    let(:command_name) { 'findAndModify' }
+        # Command succeeded event occurs before ssn is decrypted
+        expect(succeeded_event.reply["value"]["ssn"]).to be_ciphertext
+      end
 
-    before do
-      encryption_client['users'].find_one_and_update(
-        { ssn: ssn },
-        { ssn: '555-555-5555' }
-      )
+      it_behaves_like 'it has a non-encrypted key_vault_client'
     end
 
-    it 'has encrypted data in command monitoring' do
+    describe '#find_one_and_update' do
+      let(:command_name) { 'findAndModify' }
 
-      # Command started event occurs after ssn is encrypted
-      expect(started_event.command["query"]["ssn"]["$eq"]).to be_ciphertext
-      expect(started_event.command["update"]["ssn"]).to be_ciphertext
+      before do
+        encryption_client['users'].find_one_and_update(
+          { ssn: ssn },
+          { ssn: '555-555-5555' }
+        )
+      end
 
-      # Command succeeded event occurs before ssn is decrypted
-      expect(succeeded_event.reply["value"]["ssn"]).to be_ciphertext
-    end
+      it 'has encrypted data in command monitoring' do
 
-    it_behaves_like 'it has an encrypted key_vault_client'
-  end
+        # Command started event occurs after ssn is encrypted
+        expect(started_event.command["query"]["ssn"]["$eq"]).to be_ciphertext
+        expect(started_event.command["update"]["ssn"]).to be_ciphertext
 
-  describe '#insert_one' do
-    let(:command_name) { 'insert' }
+        # Command succeeded event occurs before ssn is decrypted
+        expect(succeeded_event.reply["value"]["ssn"]).to be_ciphertext
+      end
 
-    before do
-      encryption_client['users'].insert_one(ssn: ssn)
+      it_behaves_like 'it has a non-encrypted key_vault_client'
     end
 
-    it 'has encrypted data in command monitoring' do
-      # Command started event occurs after ssn is encrypted
-      # Command succeeded event does not contain any data to be decrypted
-      expect(started_event.command["documents"].first["ssn"]).to be_ciphertext
-    end
+    describe '#replace_one' do
+      let(:command_name) { 'update' }
 
-    it_behaves_like 'it has an encrypted key_vault_client'
-  end
+      before do
+        encryption_client['users'].replace_one(
+          { ssn: ssn },
+          { ssn: '555-555-5555' }
+        )
+      end
 
-  describe '#replace_one' do
-    let(:command_name) { 'update' }
+      it 'has encrypted data in command monitoring' do
+        # Command started event occurs after ssn is encrypted
+        # Command succeeded event does not contain any data to be decrypted
+        expect(started_event.command["updates"].first["q"]["ssn"]["$eq"]).to be_ciphertext
+        expect(started_event.command["updates"].first["u"]["ssn"]).to be_ciphertext
+      end
 
-    before do
-      encryption_client['users'].replace_one(
-        { ssn: ssn },
-        { ssn: '555-555-5555' }
-      )
+      it_behaves_like 'it has a non-encrypted key_vault_client'
     end
 
-    it 'has encrypted data in command monitoring' do
-      # Command started event occurs after ssn is encrypted
-      # Command succeeded event does not contain any data to be decrypted
-      expect(started_event.command["updates"].first["q"]["ssn"]["$eq"]).to be_ciphertext
-      expect(started_event.command["updates"].first["u"]["ssn"]).to be_ciphertext
-    end
+    describe '#update_one' do
+      let(:command_name) { 'update' }
 
-    it_behaves_like 'it has an encrypted key_vault_client'
-  end
+      before do
+        encryption_client['users'].replace_one({ ssn: ssn }, { ssn: '555-555-5555' })
+      end
 
-  describe '#update_one' do
-    let(:command_name) { 'update' }
+      it 'has encrypted data in command monitoring' do
+        # Command started event occurs after ssn is encrypted
+        # Command succeeded event does not contain any data to be decrypted
+        expect(started_event.command["updates"].first["q"]["ssn"]["$eq"]).to be_ciphertext
+        expect(started_event.command["updates"].first["u"]["ssn"]).to be_ciphertext
+      end
 
-    before do
-      encryption_client['users'].update_one({ ssn: ssn }, { ssn: '555-555-5555' })
+      it_behaves_like 'it has a non-encrypted key_vault_client'
     end
 
-    it 'has encrypted data in command monitoring' do
-      # Command started event occurs after ssn is encrypted
-      # Command succeeded event does not contain any data to be decrypted
-      expect(started_event.command["updates"].first["q"]["ssn"]["$eq"]).to be_ciphertext
-      expect(started_event.command["updates"].first["u"]["ssn"]).to be_ciphertext
-    end
+    describe '#update_many' do
+      let(:command_name) { 'update' }
+
+      before do
+        # update_many does not support replacement-style updates
+        encryption_client['users'].update_many({ ssn: ssn }, { "$inc" => { :age => 1 } })
+      end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
+      it 'has encrypted data in command monitoring' do
+        # Command started event occurs after ssn is encrypted
+        # Command succeeded event does not contain any data to be decrypted
+        expect(started_event.command["updates"].first["q"]["ssn"]["$eq"]).to be_ciphertext
+      end
+
+      it_behaves_like 'it has a non-encrypted key_vault_client'
+    end
   end
 
-  describe '#update_many' do
-    let(:command_name) { 'update' }
+  describe '#insert_one' do
+    let(:command_name) { 'insert' }
 
     before do
-      # update_many does not support replacement-style updates
-      encryption_client['users'].update_many({ ssn: ssn }, { "$inc" => { :age => 1 } })
+      encryption_client['users'].insert_one(ssn: ssn)
     end
 
     it 'has encrypted data in command monitoring' do
       # Command started event occurs after ssn is encrypted
       # Command succeeded event does not contain any data to be decrypted
-      expect(started_event.command["updates"].first["q"]["ssn"]["$eq"]).to be_ciphertext
+      expect(started_event.command["documents"].first["ssn"]).to be_ciphertext
     end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
+    it_behaves_like 'it has a non-encrypted key_vault_client'
   end
 end