mongo 2.17.3 → 2.18.0.beta1

data/spec/mongo/crypt/kms/credentials_spec.rb

@@ -0,0 +1,404 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+require 'mongo'
+require 'lite_spec_helper'
+
+describe Mongo::Crypt::KMS::Credentials do
+  require_libmongocrypt
+  include_context 'define shared FLE helpers'
+
+  context 'AWS' do
+    let (:params) do
+      Mongo::Crypt::KMS::AWS::Credentials.new(kms_provider)
+    end
+
+    context 'with empty AWS kms_provider' do
+      let(:kms_provider) do
+        {}
+      end
+
+      it 'raises an exception' do
+        expect do
+          params
+        end.to raise_error(ArgumentError, /The specified KMS provider options are invalid: {}. AWS KMS provider options must be in the format: { access_key_id: 'YOUR-ACCESS-KEY-ID', secret_access_key: 'SECRET-ACCESS-KEY' }/)
+      end
+    end
+
+    %i(access_key_id secret_access_key).each do |key|
+      context "with nil AWS #{key}" do
+        let(:kms_provider) do
+          {
+            access_key_id: SpecConfig.instance.fle_aws_key,
+            secret_access_key: SpecConfig.instance.fle_aws_secret,
+          }.update({key => nil})
+        end
+
+        it 'raises an exception' do
+          expect do
+            params
+          end.to raise_error(ArgumentError, /The #{key} option must be a String with at least one character; currently have nil/)
+        end
+      end
+
+      context "with non-string AWS #{key}" do
+        let(:kms_provider) do
+          {
+            access_key_id: SpecConfig.instance.fle_aws_key,
+            secret_access_key: SpecConfig.instance.fle_aws_secret,
+          }.update({key => 5})
+        end
+
+        it 'raises an exception' do
+          expect do
+            params
+          end.to raise_error(ArgumentError, /The #{key} option must be a String with at least one character; currently have 5/)
+        end
+      end
+
+      context "with empty string AWS #{key}" do
+        let(:kms_provider) do
+          {
+            access_key_id: SpecConfig.instance.fle_aws_key,
+            secret_access_key: SpecConfig.instance.fle_aws_secret,
+          }.update({key => ''})
+        end
+
+        it 'raises an exception' do
+          expect do
+            params
+          end.to raise_error(ArgumentError, /The #{key} option must be a String with at least one character; it is currently an empty string/)
+        end
+      end
+    end
+
+    context 'with valid params' do
+      let(:kms_provider) do
+        {
+          access_key_id: SpecConfig.instance.fle_aws_key,
+          secret_access_key: SpecConfig.instance.fle_aws_secret,
+        }
+      end
+
+      it 'returns valid libmongocrypt credentials' do
+        expect(params.to_document).to eq(
+          BSON::Document.new({
+            accessKeyId: SpecConfig.instance.fle_aws_key,
+            secretAccessKey: SpecConfig.instance.fle_aws_secret,
+          })
+        )
+      end
+    end
+  end
+
+  context 'Azure' do
+    let (:params) do
+      Mongo::Crypt::KMS::Azure::Credentials.new(kms_provider)
+    end
+
+    context 'with empty Azure kms_provider' do
+      let(:kms_provider) do
+        {}
+      end
+
+      it 'raises an exception' do
+        expect do
+          params
+        end.to raise_error(ArgumentError, /The specified KMS provider options are invalid: {}. Azure KMS provider options must be in the format: { tenant_id: 'TENANT-ID', client_id: 'TENANT_ID', client_secret: 'CLIENT_SECRET' }/)
+      end
+    end
+
+    %i(tenant_id client_id client_secret).each do |param|
+
+      context "with nil azure #{param}" do
+        let(:kms_provider) do
+          {
+            tenant_id: SpecConfig.instance.fle_azure_tenant_id,
+            client_id: SpecConfig.instance.fle_azure_client_id,
+            client_secret: SpecConfig.instance.fle_azure_client_secret
+          }.update(param => nil)
+        end
+
+        it 'raises an exception' do
+          expect do
+            params
+          end.to raise_error(ArgumentError, /The #{param} option must be a String with at least one character; currently have nil/)
+        end
+      end
+
+      context "with non-string azure #{param}" do
+        let(:kms_provider) do
+          {
+            tenant_id: SpecConfig.instance.fle_azure_tenant_id,
+            client_id: SpecConfig.instance.fle_azure_client_id,
+            client_secret: SpecConfig.instance.fle_azure_client_secret
+          }.update(param => 5)
+        end
+
+        it 'raises an exception' do
+          expect do
+            params
+          end.to raise_error(ArgumentError, /The #{param} option must be a String with at least one character; currently have 5/)
+        end
+      end
+
+      context "with empty string azure #{param}" do
+        let(:kms_provider) do
+          {
+            tenant_id: SpecConfig.instance.fle_azure_tenant_id,
+            client_id: SpecConfig.instance.fle_azure_client_id,
+            client_secret: SpecConfig.instance.fle_azure_client_secret
+          }.update(param => '')
+        end
+
+        it 'raises an exception' do
+          expect do
+            params
+          end.to raise_error(ArgumentError, /The #{param} option must be a String with at least one character; it is currently an empty string/)
+        end
+      end
+    end
+
+    context "with non-string azure identity_platform_endpoint" do
+      let(:kms_provider) do
+        {
+          tenant_id: SpecConfig.instance.fle_azure_tenant_id,
+          client_id: SpecConfig.instance.fle_azure_client_id,
+          client_secret: SpecConfig.instance.fle_azure_client_secret,
+          identity_platform_endpoint: 5
+        }
+      end
+
+      it 'raises an exception' do
+        expect do
+          params
+        end.to raise_error(ArgumentError, /The identity_platform_endpoint option must be a String with at least one character; currently have 5/)
+      end
+    end
+
+    context "with empty string azure identity_platform_endpoint" do
+      let(:kms_provider) do
+        {
+          tenant_id: SpecConfig.instance.fle_azure_tenant_id,
+          client_id: SpecConfig.instance.fle_azure_client_id,
+          client_secret: SpecConfig.instance.fle_azure_client_secret,
+          identity_platform_endpoint: ''
+        }
+      end
+
+      it 'raises an exception' do
+        expect do
+          params
+        end.to raise_error(ArgumentError, /The identity_platform_endpoint option must be a String with at least one character; it is currently an empty string/)
+      end
+    end
+
+    context 'with valid params' do
+      let(:kms_provider) do
+        {
+          tenant_id: SpecConfig.instance.fle_azure_tenant_id,
+          client_id: SpecConfig.instance.fle_azure_client_id,
+          client_secret: SpecConfig.instance.fle_azure_client_secret,
+        }
+      end
+
+      it 'returns valid libmongocrypt credentials' do
+        expect(params.to_document).to eq(
+          BSON::Document.new({
+            tenantId: SpecConfig.instance.fle_azure_tenant_id,
+            clientId: SpecConfig.instance.fle_azure_client_id,
+            clientSecret: SpecConfig.instance.fle_azure_client_secret,
+          })
+        )
+      end
+    end
+  end
+
+  context 'GCP' do
+    let (:params) do
+      Mongo::Crypt::KMS::GCP::Credentials.new(kms_provider)
+    end
+
+    context 'with empty GCP kms_provider' do
+      let(:kms_provider) do
+        {}
+      end
+
+      it 'raises an exception' do
+        expect do
+          params
+        end.to raise_error(ArgumentError, /The specified KMS provider options are invalid: {}. GCP KMS provider options must be in the format: { email: 'EMAIL', private_key: 'PRIVATE-KEY' }/)
+      end
+    end
+
+    %i(email private_key).each do |key|
+      context "with nil GCP #{key}" do
+        let(:kms_provider) do
+          {
+            email: SpecConfig.instance.fle_gcp_email,
+            private_key: SpecConfig.instance.fle_gcp_private_key,
+          }.update({key => nil})
+        end
+
+        it 'raises an exception' do
+          expect do
+            params
+          end.to raise_error(ArgumentError, /The #{key} option must be a String with at least one character; currently have nil/)
+        end
+      end
+
+      context "with non-string GCP #{key}" do
+        let(:kms_provider) do
+          {
+            email: SpecConfig.instance.fle_gcp_email,
+            private_key: SpecConfig.instance.fle_gcp_private_key,
+          }.update({key => 5})
+        end
+
+        it 'raises an exception' do
+          expect do
+            params
+          end.to raise_error(ArgumentError, /The #{key} option must be a String with at least one character; currently have 5/)
+        end
+      end
+
+      context "with empty string GCP #{key}" do
+        let(:kms_provider) do
+          {
+            email: SpecConfig.instance.fle_gcp_email,
+            private_key: SpecConfig.instance.fle_gcp_private_key,
+          }.update({key => ''})
+        end
+
+        it 'raises an exception' do
+          expect do
+            params
+          end.to raise_error(ArgumentError, /The #{key} option must be a String with at least one character; it is currently an empty string/)
+        end
+      end
+    end
+
+    context 'with valid params' do
+      let(:kms_provider) do
+        {
+          email: SpecConfig.instance.fle_gcp_email,
+          private_key: SpecConfig.instance.fle_gcp_private_key,
+      }
+      end
+
+      it 'returns valid libmongocrypt credentials' do
+        expect(params.to_document).to eq(
+          BSON::Document.new({
+            email: SpecConfig.instance.fle_gcp_email,
+            privateKey: BSON::Binary.new(SpecConfig.instance.fle_gcp_private_key, :generic),
+          })
+        )
+      end
+
+      context 'PEM private key' do
+        require_mri
+        before(:all) do
+          if RUBY_VERSION < "3.0"
+            skip "Ruby version 3.0 or higher required"
+          end
+        end
+
+        let(:private_key_pem) do
+          OpenSSL::PKey.read(
+            Base64.decode64(SpecConfig.instance.fle_gcp_private_key)
+          ).export
+        end
+
+        let(:kms_provider) do
+          {
+            email: SpecConfig.instance.fle_gcp_email,
+            private_key: private_key_pem,
+        }
+        end
+
+        it 'returns valid libmongocrypt credentials' do
+          private_key = params.to_document[:privateKey]
+          expect(Base64.decode64(private_key.data)).to eq(
+            Base64.decode64(SpecConfig.instance.fle_gcp_private_key)
+          )
+        end
+      end
+    end
+  end
+
+  context 'KMIP' do
+    let (:params) do
+      Mongo::Crypt::KMS::KMIP::Credentials.new(kms_provider)
+    end
+
+    context 'with empty KMIP kms_provider' do
+      let(:kms_provider) do
+        {}
+      end
+
+      it 'raises an exception' do
+        expect do
+          params
+        end.to raise_error(ArgumentError, /The specified KMS provider options are invalid: {}. KMIP KMS provider options must be in the format: { endpoint: 'ENDPOINT' }/)
+      end
+    end
+
+    context "with nil KMIP endpoint" do
+      let(:kms_provider) do
+        {
+          endpoint: nil
+        }
+      end
+
+      it 'raises an exception' do
+        expect do
+          params
+        end.to raise_error(ArgumentError, /The endpoint option must be a String with at least one character; currently have nil/)
+      end
+    end
+
+    context "with non-string KMIP endpoint" do
+      let(:kms_provider) do
+        {
+          endpoint: 5,
+        }
+      end
+
+      it 'raises an exception' do
+        expect do
+          params
+        end.to raise_error(ArgumentError, /The endpoint option must be a String with at least one character; currently have 5/)
+      end
+    end
+
+    context "with empty string KMIP endpoint" do
+      let(:kms_provider) do
+        {
+          endpoint: '',
+        }
+      end
+
+      it 'raises an exception' do
+        expect do
+          params
+        end.to raise_error(ArgumentError, /The endpoint option must be a String with at least one character; it is currently an empty string/)
+      end
+    end
+
+    context 'with valid params' do
+      let(:kms_provider) do
+        {
+        endpoint: SpecConfig.instance.fle_kmip_endpoint,
+        }
+      end
+
+      it 'returns valid libmongocrypt credentials' do
+        expect(params.to_document).to eq(
+          BSON::Document.new({
+            endpoint: SpecConfig.instance.fle_kmip_endpoint,
+          })
+        )
+      end
+    end
+  end
+end

data/spec/mongo/crypt/kms_spec.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+require 'mongo'
+require 'lite_spec_helper'
+
+describe Mongo::Crypt::KMS do
+  context 'Validations' do
+    context '.validate_tls_options' do
+      it 'returns valid options for nil parameter' do
+        expect(
+          Mongo::Crypt::KMS::Validations.validate_tls_options(nil)
+        ).to eq({})
+      end
+
+      it 'accepts empty hash' do
+        expect(
+          Mongo::Crypt::KMS::Validations.validate_tls_options({})
+        ).to eq({})
+      end
+
+      it 'does not allow disabled ssl' do
+        expect {
+          Mongo::Crypt::KMS::Validations.validate_tls_options(
+            {
+              aws: {ssl: false}
+            }
+          )
+        }.to raise_error(ArgumentError, /TLS is required/)
+      end
+
+      it 'does not allow insecure tls options' do
+        %i(
+          ssl_verify_certificate
+          ssl_verify_hostname
+          ssl_verify_ocsp_endpoint
+        ).each do |insecure_opt|
+          expect {
+            Mongo::Crypt::KMS::Validations.validate_tls_options(
+              {
+                aws: {insecure_opt => false}
+              }
+            )
+          }.to raise_error(ArgumentError, /Insecure TLS options prohibited/)
+        end
+      end
+
+      it 'allows valid options' do
+        options = {
+          aws: {
+            ssl: true,
+            ssl_cert_string: 'Content is not validated',
+
+          }
+        }
+      end
+    end
+  end
+end

data/spec/mongo/cursor_spec.rb

@@ -353,7 +353,12 @@ describe Mongo::Cursor do
         cluster.instance_variable_get(:@periodic_executor).flush
         expect do
           cursor.to_a
-        end.to raise_exception(Mongo::Error::OperationFailure, /[cC]ursor.*not found/)
+        # Mongo::Error::SessionEnded is raised here because the periodic executor
+        # called above kills the cursor and closes the session.
+        # This code is normally scheduled in cursor finalizer, so the cursor object
+        # is garbage collected when the code is executed. So, a user won't get
+        # this exception.
+        end.to raise_exception(Mongo::Error::SessionEnded)
       end
 
       context 'when the cursor is unregistered before the kill cursors operations are executed' do
@@ -544,6 +549,36 @@ describe Mongo::Cursor do
         end
       end
     end
+
+    context 'when the result set is iterated fully and the cursor id is non-zero' do
+      min_server_fcv '5.0'
+
+      let(:documents) do
+        (1..5).map{ |i| { field: "test#{i}" }}
+      end
+
+      let(:view) { collection.find(field:{'$gte'=>BSON::MinKey.new}).sort(field:1).limit(5).batch_size(4) }
+
+      before do
+        view.to_a
+      end
+
+      it 'schedules a get more command' do
+        get_more_commands = subscriber.started_events.select { |e| e.command_name == 'getMore' }
+        expect(get_more_commands.length).to be 1
+      end
+
+      it 'has a non-zero cursor id on successful get more' do
+        get_more_commands = subscriber.succeeded_events.select { |e| e.command_name == 'getMore' }
+        expect(get_more_commands.length).to be 1
+        expect(get_more_commands[0].reply['cursor']['id']).to_not be 0
+      end
+
+      it 'schedules a kill cursors command' do
+        get_more_commands = subscriber.started_events.select { |e| e.command_name == 'killCursors' }
+        expect(get_more_commands.length).to be 1
+      end
+    end
   end
 
   describe '#inspect' do
@@ -569,6 +604,7 @@ describe Mongo::Cursor do
         allow(reply).to receive(:namespace)
         allow(reply).to receive(:connection_description).and_return(conn_desc)
         allow(reply).to receive(:cursor_id).and_return(42)
+        allow(reply).to receive(:connection_global_id).and_return(1)
       end
     end
 
@@ -698,54 +734,4 @@ describe Mongo::Cursor do
       end
     end
   end
-
-  describe '#batch_size' do
-    let(:subscriber) { Mrss::EventSubscriber.new }
-
-    let(:subscribed_client) do
-      authorized_client.tap do |client|
-        client.subscribe(Mongo::Monitoring::COMMAND, subscriber)
-      end
-    end
-
-    let(:collection) do
-      subscribed_client[TEST_COLL]
-    end
-
-    let(:view) do
-      collection.find({}, limit: limit)
-    end
-
-    before do
-      collection.drop
-      collection.insert_many([].fill({ "bar": "baz" }, 0, 102))
-    end
-
-    context 'when limit is 0 and batch_size is not set' do
-      let(:limit) do
-        0
-      end
-
-      it 'does not set batch_size' do
-        view.to_a
-        get_more_commands = subscriber.started_events.select { |e| e.command_name == 'getMore' }
-        expect(get_more_commands.length).to eq(1)
-        expect(get_more_commands.first.command.keys).not_to include('batchSize')
-      end
-    end
-
-    context 'when limit is not zero and batch_size is not set' do
-      let(:limit) do
-        1000
-      end
-
-      it 'sets batch_size' do
-        view.to_a
-        get_more_commands = subscriber.started_events.select { |e| e.command_name == 'getMore' }
-
-        expect(get_more_commands.length).to eq(1)
-        expect(get_more_commands.first.command.keys).to include('batchSize')
-      end
-    end
-  end
 end

data/spec/mongo/database_spec.rb

@@ -18,6 +18,14 @@ describe Mongo::Database do
     end
   end
 
+  let(:subscriber) { Mrss::EventSubscriber.new }
+
+  let(:monitored_client) do
+    root_authorized_client.tap do |client|
+      client.subscribe(Mongo::Monitoring::COMMAND, subscriber)
+    end
+  end
+
   describe '#==' do
 
     let(:database) do
@@ -278,6 +286,18 @@ describe Mongo::Database do
         collection_names.should include('coll-119')
       end
     end
+
+    context 'with comment' do
+      min_server_version '4.4'
+
+      it 'returns collection names and send comment' do
+        database = described_class.new(monitored_client, SpecConfig.instance.test_db)
+        database.collection_names(comment: "comment")
+        command = subscriber.command_started_events("listCollections").last&.command
+        expect(command).not_to be_nil
+        expect(command["comment"]).to eq("comment")
+      end
+    end
   end
 
   describe '#list_collections' do
@@ -479,6 +499,18 @@ describe Mongo::Database do
         collection_names.should include('coll-119')
       end
     end
+
+    context 'with comment' do
+      min_server_version '4.4'
+
+      it 'returns collection names and send comment' do
+        database = described_class.new(monitored_client, SpecConfig.instance.test_db)
+        database.list_collections(comment: "comment")
+        command = subscriber.command_started_events("listCollections").last&.command
+        expect(command).not_to be_nil
+        expect(command["comment"]).to eq("comment")
+      end
+    end
   end
 
   describe '#collections' do
@@ -591,7 +623,7 @@ describe Mongo::Database do
           end
         end
 
-        context 'when authorized_collections are provided' do
+        context 'when authorized_collections are provided as false' do
           let(:options) do
             { authorized_collections: false }
           end
@@ -612,6 +644,27 @@ describe Mongo::Database do
           end
         end
 
+        context 'when authorized_collections are provided as true' do
+          let(:options) do
+            { authorized_collections: true }
+          end
+
+          let!(:result) do
+            database.collections(options)
+          end
+
+          let(:events) do
+            subscriber.command_started_events('listCollections')
+          end
+
+          it 'authorized_collections not passed to server because false' do
+            expect(events.length).to eq(1)
+            command = events.first.command
+            expect(command['nameOnly']).to eq(true)
+            expect(command['authorizedCollections']).to eq(true)
+          end
+        end
+
         context 'when no options are provided' do
           let!(:result) do
             database.collections
@@ -647,6 +700,18 @@ describe Mongo::Database do
         collection_names.should include('coll-119')
       end
     end
+
+    context 'with comment' do
+      min_server_version '4.4'
+
+      it 'returns collection names and send comment' do
+        database = described_class.new(monitored_client, SpecConfig.instance.test_db)
+        database.collections(comment: "comment")
+        command = subscriber.command_started_events("listCollections").last&.command
+        expect(command).not_to be_nil
+        expect(command["comment"]).to eq("comment")
+      end
+    end
   end
 
   describe '#command' do