mongo 2.17.3 → 2.18.0.beta1

data/spec/mongo/crypt/auto_decryption_context_spec.rb

@@ -8,7 +8,8 @@ describe Mongo::Crypt::AutoDecryptionContext do
   require_libmongocrypt
   include_context 'define shared FLE helpers'
 
-  let(:mongocrypt) { Mongo::Crypt::Handle.new(kms_providers, logger: logger) }
+  let(:credentials) { Mongo::Crypt::KMS::Credentials.new(kms_providers) }
+  let(:mongocrypt) { Mongo::Crypt::Handle.new(credentials, logger: logger) }
   let(:context) { described_class.new(mongocrypt, io, command) }
 
   let(:logger) { nil }
@@ -62,6 +63,21 @@ describe Mongo::Crypt::AutoDecryptionContext do
       it_behaves_like 'a functioning AutoDecryptionContext'
     end
 
+    context 'when mongocrypt is initialized with Azure KMS provider options' do
+      include_context 'with Azure kms_providers'
+      it_behaves_like 'a functioning AutoDecryptionContext'
+    end
+
+    context 'when mongocrypt is initialized with GCP KMS provider options' do
+      include_context 'with GCP kms_providers'
+      it_behaves_like 'a functioning AutoDecryptionContext'
+    end
+
+    context 'when mongocrypt is initialized with KMIP KMS provider options' do
+      include_context 'with KMIP kms_providers'
+      it_behaves_like 'a functioning AutoDecryptionContext'
+    end
+
     context 'with verbose logging' do
       include_context 'with local kms_providers'
 

data/spec/mongo/crypt/auto_encrypter_spec.rb

@@ -104,6 +104,7 @@ describe Mongo::Crypt::AutoEncrypter do
     let(:auto_encryption_options) do
       {
         kms_providers: kms_providers,
+        kms_tls_options: kms_tls_options,
         key_vault_namespace: key_vault_namespace,
         schema_map: { "#{db_name}.#{collection_name}": schema_map },
       }
@@ -114,6 +115,21 @@ describe Mongo::Crypt::AutoEncrypter do
       it_behaves_like 'a functioning auto encrypter'
     end
 
+    context 'with Azure KMS providers' do
+      include_context 'with Azure kms_providers'
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
+    context 'with GCP KMS providers' do
+      include_context 'with GCP kms_providers'
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
+    context 'with KMIP KMS providers' do
+      include_context 'with KMIP kms_providers'
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
     context 'with local KMS providers' do
       include_context 'with local kms_providers'
       it_behaves_like 'a functioning auto encrypter'
@@ -126,6 +142,7 @@ describe Mongo::Crypt::AutoEncrypter do
     let(:auto_encryption_options) do
       {
         kms_providers: kms_providers,
+        kms_tls_options: kms_tls_options,
         key_vault_namespace: key_vault_namespace
       }
     end
@@ -135,6 +152,40 @@ describe Mongo::Crypt::AutoEncrypter do
       it_behaves_like 'a functioning auto encrypter'
     end
 
+    context 'with Azure KMS providers' do
+      include_context 'with Azure kms_providers'
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
+    context 'with GCP KMS providers' do
+      include_context 'with GCP kms_providers'
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
+    context 'with GCP KMS providers and PEM key' do
+      require_mri
+
+      include_context 'with GCP kms_providers'
+
+      let(:kms_providers) do
+        {
+          gcp: {
+            email: SpecConfig.instance.fle_gcp_email,
+            private_key: OpenSSL::PKey.read(
+              Base64.decode64(SpecConfig.instance.fle_gcp_private_key)
+            ).export,
+          }
+        }
+      end
+
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
+    context 'with KMIP KMS providers' do
+      include_context 'with KMIP kms_providers'
+      it_behaves_like 'a functioning auto encrypter'
+    end
+
     context 'with local KMS providers' do
       include_context 'with local kms_providers'
       it_behaves_like 'a functioning auto encrypter'
@@ -147,6 +198,7 @@ describe Mongo::Crypt::AutoEncrypter do
     let(:auto_encryption_options) do
       {
         kms_providers: kms_providers,
+        kms_tls_options: kms_tls_options,
         key_vault_namespace: key_vault_namespace,
       }
     end
@@ -169,6 +221,60 @@ describe Mongo::Crypt::AutoEncrypter do
       end
     end
 
+    context 'with Azure KMS providers' do
+      include_context 'with Azure kms_providers'
+
+      describe '#encrypt' do
+        it 'does not perform encryption' do
+          result = auto_encrypter.encrypt(db_name, command)
+          expect(result).to eq(command)
+        end
+      end
+
+      describe '#decrypt' do
+        it 'still performs decryption' do
+          result = auto_encrypter.decrypt(encrypted_command)
+          expect(result).to eq(command)
+        end
+      end
+    end
+
+    context 'with GCP KMS providers' do
+      include_context 'with GCP kms_providers'
+
+      describe '#encrypt' do
+        it 'does not perform encryption' do
+          result = auto_encrypter.encrypt(db_name, command)
+          expect(result).to eq(command)
+        end
+      end
+
+      describe '#decrypt' do
+        it 'still performs decryption' do
+          result = auto_encrypter.decrypt(encrypted_command)
+          expect(result).to eq(command)
+        end
+      end
+    end
+
+    context 'with KMIP KMS providers' do
+      include_context 'with KMIP kms_providers'
+
+      describe '#encrypt' do
+        it 'does not perform encryption' do
+          result = auto_encrypter.encrypt(db_name, command)
+          expect(result).to eq(command)
+        end
+      end
+
+      describe '#decrypt' do
+        it 'still performs decryption' do
+          result = auto_encrypter.decrypt(encrypted_command)
+          expect(result).to eq(command)
+        end
+      end
+    end
+
     context 'with local KMS providers' do
       include_context 'with local kms_providers'
 

data/spec/mongo/crypt/auto_encryption_context_spec.rb

@@ -8,7 +8,8 @@ describe Mongo::Crypt::AutoEncryptionContext do
   require_libmongocrypt
   include_context 'define shared FLE helpers'
 
-  let(:mongocrypt) { Mongo::Crypt::Handle.new(kms_providers, logger: logger) }
+  let(:credentials) { Mongo::Crypt::KMS::Credentials.new(kms_providers) }
+  let(:mongocrypt) { Mongo::Crypt::Handle.new(credentials, logger: logger) }
   let(:context) { described_class.new(mongocrypt, io, db_name, command) }
 
   let(:logger) { nil }
@@ -79,6 +80,21 @@ describe Mongo::Crypt::AutoEncryptionContext do
       it_behaves_like 'a functioning AutoEncryptionContext'
     end
 
+    context 'with Azure KMS providers' do
+      include_context 'with Azure kms_providers'
+      it_behaves_like 'a functioning AutoEncryptionContext'
+    end
+
+    context 'with GCP KMS providers' do
+      include_context 'with GCP kms_providers'
+      it_behaves_like 'a functioning AutoEncryptionContext'
+    end
+
+    context 'with KMIP KMS providers' do
+      include_context 'with KMIP kms_providers'
+      it_behaves_like 'a functioning AutoEncryptionContext'
+    end
+
     context 'with verbose logging' do
       include_context 'with local kms_providers'
 

data/spec/mongo/crypt/binding/context_spec.rb

@@ -6,17 +6,34 @@ require_relative '../helpers/mongo_crypt_spec_helper'
 
 shared_context 'initialized for data key creation' do
   let(:master_key) { "ru\xfe\x00" * 24 }
-  let(:binary) { MongoCryptSpecHelper.mongocrypt_binary_t_from(master_key)}
+
+  let(:kms_providers) do
+    BSON::Document.new({
+      local: {
+        key: BSON::Binary.new(master_key, :generic),
+      }
+    })
+  end
+
+  let(:binary) do
+    MongoCryptSpecHelper.mongocrypt_binary_t_from(kms_providers.to_bson.to_s)
+  end
+
+  let(:key_document) do
+    MongoCryptSpecHelper.mongocrypt_binary_t_from(
+      BSON::Document.new({provider: 'local'}).to_bson.to_s)
+  end
 
   before do
-    Mongo::Crypt::Binding.mongocrypt_setopt_kms_provider_local(mongocrypt, binary)
+    Mongo::Crypt::Binding.mongocrypt_setopt_kms_providers(mongocrypt, binary)
     MongoCryptSpecHelper.bind_crypto_hooks(mongocrypt)
     Mongo::Crypt::Binding.mongocrypt_init(mongocrypt)
 
-    Mongo::Crypt::Binding.mongocrypt_ctx_setopt_masterkey_local(context)
+    Mongo::Crypt::Binding.mongocrypt_ctx_setopt_key_encryption_key(context, key_document)
   end
 
   after do
+    Mongo::Crypt::Binding.mongocrypt_binary_destroy(key_document)
     Mongo::Crypt::Binding.mongocrypt_binary_destroy(binary)
   end
 end
@@ -84,20 +101,6 @@ describe 'Mongo::Crypt::Binding' do
       end
     end
 
-    describe '#mongocrypt_ctx_setopt_masterkey_local' do
-      let(:result) do
-        Mongo::Crypt::Binding.mongocrypt_ctx_setopt_masterkey_local(context)
-      end
-
-      before do
-        Mongo::Crypt::Binding.mongocrypt_init(mongocrypt)
-      end
-
-      it 'returns true' do
-        expect(result).to be true
-      end
-    end
-
     describe '#mongocrypt_ctx_datakey_init' do
       let(:result) do
         Mongo::Crypt::Binding.mongocrypt_ctx_datakey_init(context)
@@ -251,5 +254,84 @@ describe 'Mongo::Crypt::Binding' do
         end
       end
     end
+
+    describe '#mongocrypt_ctx_setopt_index_type' do
+      let(:result) do
+        Mongo::Crypt::Binding.mongocrypt_ctx_setopt_index_type(
+          context,
+          index_type
+        )
+      end
+
+      before do
+        Mongo::Crypt::Binding.mongocrypt_init(mongocrypt)
+      end
+
+      context 'with equality index type' do
+        let(:index_type) do
+          :equality
+        end
+
+        it 'returns true' do
+          expect(result).to be true
+        end
+      end
+
+      context 'with none index type' do
+        let(:index_type) do
+          :none
+        end
+
+        it 'returns true' do
+          expect(result).to be true
+        end
+      end
+    end
+
+    describe '#mongocrypt_ctx_setopt_query_type' do
+      let(:result) do
+        Mongo::Crypt::Binding.mongocrypt_ctx_setopt_query_type(
+          context,
+          query_type
+        )
+      end
+
+      before do
+        Mongo::Crypt::Binding.mongocrypt_init(mongocrypt)
+      end
+
+      context 'with equality query type' do
+        let(:query_type) do
+          :equality
+        end
+
+        it 'returns true' do
+          expect(result).to be true
+        end
+      end
+    end
+
+    describe '#mongocrypt_ctx_setopt_contention_factor' do
+      let(:result) do
+        Mongo::Crypt::Binding.mongocrypt_ctx_setopt_contention_factor(
+          context,
+          contention_factor
+        )
+      end
+
+      before do
+        Mongo::Crypt::Binding.mongocrypt_init(mongocrypt)
+      end
+
+      context 'with non zero contention factor' do
+        let(:contention_factor) do
+          10
+        end
+
+        it 'returns true' do
+          expect(result).to be true
+        end
+      end
+    end
   end
 end

data/spec/mongo/crypt/binding/mongocrypt_spec.rb

@@ -20,52 +20,29 @@ describe 'Mongo::Crypt::Binding' do
       end
     end
 
-    describe '#mongocrypt_setopt_kms_provider_local' do
-      let(:mongocrypt) { Mongo::Crypt::Binding.mongocrypt_new }
-
-      let(:binary) do
-        p = FFI::MemoryPointer.new(key_bytes.size)
-              .write_array_of_type(FFI::TYPE_UINT8, :put_uint8, key_bytes)
-
-        Mongo::Crypt::Binding.mongocrypt_binary_new_from_data(p, key_bytes.length)
-      end
-
-      after do
-        Mongo::Crypt::Binding.mongocrypt_binary_destroy(binary)
-      end
-
-      context 'with valid key' do
-        let(:key_bytes) { [114, 117, 98, 121] * 24 } # 96 bytes
-
-        it 'returns true' do
-          expect(Mongo::Crypt::Binding.mongocrypt_setopt_kms_provider_local(mongocrypt, binary)).to be true
-        end
-      end
-
-      context 'with invalid key' do
-        let(:key_bytes) { [114, 117, 98, 121] * 23 } # NOT 96 bytes
-
-        it 'returns false' do
-          expect(Mongo::Crypt::Binding.mongocrypt_setopt_kms_provider_local(mongocrypt, binary)).to be false
-        end
-      end
-    end
-
     describe '#mongocrypt_init' do
       let(:key_bytes) { [114, 117, 98, 121] * 24 } # 96 bytes
 
-      let(:binary) do
-        p = FFI::MemoryPointer.new(key_bytes.size)
-              .write_array_of_type(FFI::TYPE_UINT8, :put_uint8, key_bytes)
+      let(:kms_providers) do
+        BSON::Document.new({
+          local: {
+            key: BSON::Binary.new(key_bytes.pack('C*'), :generic),
+          }
+        })
+      end
 
-        Mongo::Crypt::Binding.mongocrypt_binary_new_from_data(p, key_bytes.length)
+      let(:binary) do
+        data = kms_providers.to_bson.to_s
+        Mongo::Crypt::Binding.mongocrypt_binary_new_from_data(
+          FFI::MemoryPointer.from_string(data),
+          data.bytesize,
+        )
       end
 
       let(:mongocrypt) do
-        mongocrypt = Mongo::Crypt::Binding.mongocrypt_new
-        Mongo::Crypt::Binding.mongocrypt_setopt_kms_provider_local(mongocrypt, binary)
-
-        mongocrypt
+        Mongo::Crypt::Binding.mongocrypt_new.tap do |mongocrypt|
+          Mongo::Crypt::Binding.mongocrypt_setopt_kms_providers(mongocrypt, binary)
+        end
       end
 
       after do
@@ -82,12 +59,6 @@ describe 'Mongo::Crypt::Binding' do
         end
       end
 
-      context 'without binding crypto hooks' do
-        it 'returns false' do
-          expect(Mongo::Crypt::Binding.mongocrypt_init(mongocrypt)).to be false
-        end
-      end
-
       context 'with invalid kms option' do
         before do
           MongoCryptSpecHelper.bind_crypto_hooks(mongocrypt)
@@ -131,7 +102,7 @@ describe 'Mongo::Crypt::Binding' do
         end
 
         it 'returns a error_client status' do
-          Mongo::Crypt::Binding.mongocrypt_setopt_kms_provider_local(mongocrypt, binary)
+          Mongo::Crypt::Binding.mongocrypt_setopt_kms_providers(mongocrypt, binary)
 
           Mongo::Crypt::Binding.mongocrypt_status(mongocrypt, status)
           expect(Mongo::Crypt::Binding.mongocrypt_status_type(status)).to eq(:error_client)

data/spec/mongo/crypt/binding/version_spec.rb

@@ -17,4 +17,29 @@ describe 'Mongo::Crypt::Binding' do
       expect(version).to match(/\A(\d+.){2}(\d+)?(-[A-Za-z\+\d]+)?\z/)
     end
   end
+
+  describe '#validate_version' do
+    context 'when not satisfied' do
+      let(:older_version) do
+        Mongo::Crypt::Binding::MIN_LIBMONGOCRYPT_VERSION.to_s.sub(/^\d+/, '0')
+      end
+
+      it 'raises an error' do
+        expect do
+          Mongo::Crypt::Binding.validate_version(older_version)
+        end.to raise_error(LoadError, /libmongocrypt version .* or above is required, but version .* was found./)
+      end
+    end
+
+    context 'when satisfied' do
+      let(:newer_version) do
+        Mongo::Crypt::Binding::MIN_LIBMONGOCRYPT_VERSION.bump.to_s
+      end
+      it 'does not raise and error' do
+        expect do
+          Mongo::Crypt::Binding.validate_version(newer_version)
+        end.not_to raise_error(LoadError, /libmongocrypt version .* or above is required, but version .* was found./)
+      end
+    end
+  end
 end

data/spec/mongo/crypt/binding_unloaded_spec.rb

@@ -6,8 +6,22 @@ require 'lite_spec_helper'
 describe 'Mongo::Crypt::Binding' do
   require_no_libmongocrypt
 
+  before(:all) do
+    if ENV['FLE'] == 'helper'
+      skip 'FLE=helper is incompatible with unloaded binding tests'
+    end
+  end
+
   context 'when load fails' do
 
+    # JRuby 9.3.2.0 converts our custom LoadErrors to generic NameErrors
+    # and trashes the exception messages.
+    # https://github.com/jruby/jruby/issues/7070
+    # JRuby 9.2 works correctly, this test is skipped on all JRuby versions
+    # because we intend to remove JRuby support altogether and therefore
+    # adding logic to condition on JRuby versions does not make sense.
+    fails_on_jruby
+
     it 'retries loading at the next reference' do
       lambda do
         Mongo::Crypt::Binding