mongo 2.17.1 → 2.18.1

data/lib/mongo/config/options.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module Mongo
+  module Config
+
+    # Encapsulates logic for setting options.
+    module Options
+
+      # Get the defaults or initialize a new empty hash.
+      #
+      # @return [ Hash ] The default options.
+      def defaults
+        @defaults ||= {}
+      end
+
+      # Define a configuration option with a default.
+      #
+      # @param [ Symbol ] name The name of the configuration option.
+      # @param [ Hash ] options Extras for the option.
+      #
+      # @option options [ Object ] :default The default value.
+      def option(name, options = {})
+        defaults[name] = settings[name] = options[:default]
+
+        class_eval do
+          # log_level accessor is defined specially below
+          define_method(name) do
+            settings[name]
+          end
+
+          define_method("#{name}=") do |value|
+            settings[name] = value
+          end
+
+          define_method("#{name}?") do
+            !!send(name)
+          end
+        end
+      end
+
+      # Reset the configuration options to the defaults.
+      #
+      # @example Reset the configuration options.
+      #   config.reset
+      #
+      # @return [ Hash ] The defaults.
+      def reset
+        settings.replace(defaults)
+      end
+
+      # Get the settings or initialize a new empty hash.
+      #
+      # @example Get the settings.
+      #   options.settings
+      #
+      # @return [ Hash ] The setting options.
+      def settings
+        @settings ||= {}
+      end
+    end
+  end
+end

data/lib/mongo/config/validators/option.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Mongo
+  module Config
+    module Validators
+
+      # Validator for configuration options.
+      #
+      # @api private
+      module Option
+        extend self
+
+        # Validate a configuration option.
+        #
+        # @example Validate a configuration option.
+        #
+        # @param [ String ] option The name of the option.
+        def validate(option)
+          unless Config.settings.keys.include?(option.to_sym)
+            raise Mongo::Error::InvalidConfigOption.new(option)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/mongo/config.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+require "mongo/config/options"
+require "mongo/config/validators/option"
+
+module Mongo
+
+  # This module defines configuration options for Mongo.
+  #
+  # @api private
+  module Config
+    extend Forwardable
+    extend Options
+    extend self
+
+    # When this flag is off, an aggregation done on a view will be executed over
+    # the documents included in that view, instead of all documents in the
+    # collection. When this flag is on, the view fiter is ignored.
+    option :broken_view_aggregate, default: true
+
+    # When this flag is set to false, the view options will be correctly
+    # propagated to readable methods.
+    option :broken_view_options, default: true
+
+    # When this flag is set to true, the update and replace methods will
+    # validate the paramters and raise an error if they are invalid.
+    option :validate_update_replace, default: false
+
+    # Set the configuration options.
+    #
+    # @example Set the options.
+    #   config.options = { validate_update_replace: true }
+    #
+    # @param [ Hash ] options The configuration options.
+    def options=(options)
+      options.each_pair do |option, value|
+        Validators::Option.validate(option)
+        send("#{option}=", value)
+      end
+    end
+  end
+end

data/lib/mongo/crypt/auto_encrypter.rb

@@ -32,6 +32,7 @@ module Mongo
 
       attr_reader :mongocryptd_client
       attr_reader :key_vault_client
+      attr_reader :metadata_client
       attr_reader :options
 
       # A Hash of default values for the :extra_options option
@@ -56,31 +57,76 @@ module Mongo
       # @option options [ String ] :key_vault_namespace The namespace of the key
       #   vault in the format database.collection.
       # @option options [ Hash | nil ] :schema_map The JSONSchema of the collection(s)
-      #   with encrypted fields.
+      #   with encrypted fields. This option is mutually exclusive with :schema_map_path.
+      # @option options [ String | nil ] :schema_map_path A path to a file contains the JSON schema
+      #   of the collection that stores auto encrypted documents. This option is
+      #   mutually exclusive with :schema_map.
       # @option options [ Boolean | nil ] :bypass_auto_encryption When true, disables
       #   auto-encryption. Default is false.
       # @option options [ Hash | nil ] :extra_options Options related to spawning
       #   mongocryptd. These are set to default values if no option is passed in.
+      # @option options [ Hash ] :kms_providers A hash of key management service
+      #   configuration information.
+      #   @see Mongo::Crypt::KMS::Credentials for list of options for every
+      #   supported provider.
+      #   @note There may be more than one KMS provider specified.
+      # @option options [ Hash ] :kms_tls_options TLS options to connect to KMS
+      #   providers. Keys of the hash should be KSM provider names; values
+      #   should be hashes of TLS connection options. The options are equivalent
+      #   to TLS connection options of Mongo::Client.
+      #   @see Mongo::Client#initialize for list of TLS options.
+      # @option options [ Hash | nil ] :encrypted_fields_map maps a collection
+      #   namespace to an encryptedFields.
+      #   - Note: If a collection is present on both the encryptedFieldsMap
+      #     and schemaMap, an error will be raised.
+      # @option options [ Boolean | nil ] :bypass_query_analysis When true
+      #   disables automatic analysis of outgoing commands.
+      # @option options [ String | nil ] :crypt_shared_lib_path Path that should
+      #   be  the used to load the crypt shared library. Providing this option
+      #   overrides default crypt shared library load paths for libmongocrypt.
+      # @option options [ Boolean | nil ] :crypt_shared_lib_required Whether
+      #   crypt shared library is required. If 'true', an error will be raised
+      #   if a crypt_shared library cannot be loaded by libmongocrypt.
       #
       # @raise [ ArgumentError ] If required options are missing or incorrectly
       #   formatted.
       def initialize(options)
+        # Note that this call may eventually, via other method invocations,
+        # create additional clients which have to be cleaned up.
         @options = set_default_options(options).freeze
 
         @crypt_handle = Crypt::Handle.new(
-          @options[:kms_providers],
-          schema_map: @options[:schema_map]
+          Crypt::KMS::Credentials.new(@options[:kms_providers]),
+          Crypt::KMS::Validations.validate_tls_options(@options[:kms_tls_options]),
+          schema_map: @options[:schema_map],
+          schema_map_path: @options[:schema_map_path],
+          encrypted_fields_map: @options[:encrypted_fields_map],
+          bypass_query_analysis: @options[:bypass_query_analysis],
+          crypt_shared_lib_path: @options[:extra_options][:crypt_shared_lib_path],
+          crypt_shared_lib_required: @options[:extra_options][:crypt_shared_lib_required],
         )
 
-        @key_vault_client = @options[:key_vault_client]
-
-        # Set server selection timeout to 1 to prevent the client waiting for a
-        # long timeout before spawning mongocryptd
-        @mongocryptd_client = Client.new(
-          @options[:extra_options][:mongocryptd_uri],
-          monitoring_io: @options[:client].options[:monitoring_io],
-          server_selection_timeout: 10,
+        @mongocryptd_options = @options[:extra_options].slice(
+          :mongocryptd_uri,
+          :mongocryptd_bypass_spawn,
+          :mongocryptd_spawn_path,
+          :mongocryptd_spawn_args
         )
+        @mongocryptd_options[:mongocryptd_bypass_spawn] = @options[:bypass_auto_encryption] ||
+          @options[:extra_options][:mongocryptd_bypass_spawn] ||
+          @crypt_handle.crypt_shared_lib_available? ||
+          @options[:extra_options][:crypt_shared_lib_required]
+
+        if !@options[:extra_options][:crypt_shared_lib_required]
+          # Set server selection timeout to 1 to prevent the client waiting for a
+          # long timeout before spawning mongocryptd
+          @mongocryptd_client = Client.new(
+            @options[:extra_options][:mongocryptd_uri],
+            monitoring_io: @options[:client].options[:monitoring_io],
+            server_selection_timeout: 10,
+            database: @options[:client].options[:database]
+          )
+        end
 
         begin
           @encryption_io = EncryptionIO.new(
@@ -88,17 +134,42 @@ module Mongo
             mongocryptd_client: @mongocryptd_client,
             key_vault_namespace: @options[:key_vault_namespace],
             key_vault_client: @key_vault_client,
+            metadata_client: @metadata_client,
             mongocryptd_options: @options[:extra_options]
           )
         rescue
           begin
-            @mongocryptd_client.close
+            @mongocryptd_client&.close
           rescue => e
-            log_warn("Eror closing mongocryptd client in auto encrypter's constructor: #{e.class}: #{e}")
+            log_warn("Error closing mongocryptd client in auto encrypter's constructor: #{e.class}: #{e}")
             # Drop this exception so that the original exception is raised
           end
           raise
         end
+      rescue
+        if @key_vault_client && @key_vault_client != options[:client] &&
+          @key_vault_client.cluster != options[:client].cluster
+        then
+          begin
+            @key_vault_client.close
+          rescue => e
+            log_warn("Error closing key vault client in auto encrypter's constructor: #{e.class}: #{e}")
+            # Drop this exception so that the original exception is raised
+          end
+        end
+
+        if @metadata_client && @metadata_client != options[:client] &&
+          @metadata_client.cluster != options[:client].cluster
+        then
+          begin
+            @metadata_client.close
+          rescue => e
+            log_warn("Error closing metadata client in auto encrypter's constructor: #{e.class}: #{e}")
+            # Drop this exception so that the original exception is raised
+          end
+        end
+
+        raise
       end
 
       # Whether this encrypter should perform encryption (returns false if
@@ -144,6 +215,18 @@ module Mongo
       def close
         @mongocryptd_client.close if @mongocryptd_client
 
+        if @key_vault_client && @key_vault_client != options[:client] &&
+          @key_vault_client.cluster != options[:client].cluster
+        then
+          @key_vault_client.close
+        end
+
+        if @metadata_client && @metadata_client != options[:client] &&
+          @metadata_client.cluster != options[:client].cluster
+        then
+          @metadata_client.close
+        end
+
         true
       end
 
@@ -173,10 +256,49 @@ module Mongo
         end
 
         opts[:bypass_auto_encryption] ||= false
-        opts[:key_vault_client] ||= opts[:client]
+        set_or_create_clients(opts)
+        opts[:key_vault_client] = @key_vault_client
 
         Options::Redacted.new(opts).merge(extra_options: extra_options)
       end
+
+      # Create additional clients for auto encryption, if necessary
+      #
+      # @param [ Hash ] options Auto encryption options.
+      def set_or_create_clients(options)
+        client = options[:client]
+        @key_vault_client = if options[:key_vault_client]
+          options[:key_vault_client]
+        elsif client.options[:max_pool_size] == 0
+          client
+        else
+          internal_client(client)
+        end
+
+        @metadata_client = if options[:bypass_auto_encryption]
+          nil
+        elsif client.options[:max_pool_size] == 0
+          client
+        else
+          internal_client(client)
+        end
+      end
+
+      # Creates or return already created internal client to be used for
+      # auto encryption.
+      #
+      # @param [ Mongo::Client ] client  A client connected to the
+      #   encrypted collection.
+      #
+      # @return [ Mongo::Client ] Client to be used as internal client for
+      # auto encryption.
+      def internal_client(client)
+        @internal_client ||= client.with(
+          auto_encryption_options: nil,
+          min_pool_size: 0,
+          monitoring: client.send(:monitoring),
+        )
+      end
     end
   end
 end