mongo 2.17.4 → 2.18.0.beta1

data/spec/integration/change_stream_spec.rb

@@ -3,7 +3,8 @@
 
 require 'spec_helper'
 
-describe 'Change stream integration', retry: 4 do
+describe 'Change stream integration' do
+  retry_test 4
   require_mri
   max_example_run_time 7
   min_server_fcv '3.6'
@@ -101,7 +102,7 @@ describe 'Change stream integration', retry: 4 do
       it 'watch raises error' do
         expect do
           client['change-stream'].watch
-        end.to raise_error(Mongo::Error::OperationFailure, /10107\b.*Failing command due to 'failCommand' failpoint/)
+        end.to raise_error(Mongo::Error::OperationFailure, /10107\b.*Failing command (due to|via) 'failCommand' failpoint/)
       end
     end
 
@@ -286,7 +287,7 @@ describe 'Change stream integration', retry: 4 do
 
         expect do
           enum.next
-        end.to raise_error(Mongo::Error::OperationFailure, /101\b.*Failing command due to 'failCommand' failpoint/)
+        end.to raise_error(Mongo::Error::OperationFailure, /101\b.*Failing command (due to|via) 'failCommand' failpoint/)
       end
     end
   end
@@ -417,7 +418,7 @@ describe 'Change stream integration', retry: 4 do
 
           expect do
             enum.try_next
-          end.to raise_error(Mongo::Error::OperationFailure, /10107\b.*Failing command due to 'failCommand' failpoint/)
+          end.to raise_error(Mongo::Error::OperationFailure, /10107\b.*Failing command (due to|via) 'failCommand' failpoint/)
         end
       end
 
@@ -444,7 +445,7 @@ describe 'Change stream integration', retry: 4 do
 
           expect do
             enum.try_next
-          end.to raise_error(Mongo::Error::OperationFailure, /10107\b.*Failing command due to 'failCommand' failpoint/)
+          end.to raise_error(Mongo::Error::OperationFailure, /10107\b.*Failing command (due to|via) 'failCommand' failpoint/)
         end
       end
     end

data/spec/integration/client_construction_spec.rb

@@ -184,7 +184,7 @@ describe 'Client construction' do
       it 'raises an exception' do
         expect do
           client
-        end.to raise_error(ArgumentError, /The aws access_key_id option must be a String with at least one character; it is currently an empty string/)
+        end.to raise_error(ArgumentError, /The access_key_id option must be a String with at least one character; it is currently an empty string/)
       end
     end
 

data/spec/integration/client_side_encryption/auto_encryption_bulk_writes_spec.rb

@@ -132,8 +132,8 @@ describe 'Bulk writes with auto-encryption enabled' do
       context 'when total request size does not exceed 2MiB' do
         let(:requests) do
           [
-            { update_one: { filter: { _id: 1 }, update: { ssn: 'a' * (size_limit/2) } } },
-            { update_one: { filter: { _id: 2 }, update: { ssn: 'a' * (size_limit/2) } } },
+            { replace_one: { filter: { _id: 1 }, replacement: { ssn: 'a' * (size_limit/2) } } },
+            { replace_one: { filter: { _id: 2 }, replacement: { ssn: 'a' * (size_limit/2) } } },
           ]
         end
 
@@ -143,8 +143,8 @@ describe 'Bulk writes with auto-encryption enabled' do
       context 'when each operation is smaller than 2MiB, but the total request size is greater than 2MiB' do
         let(:requests) do
           [
-            { update_one: { filter: { _id: 1 }, update: { ssn: 'a' * (size_limit - 2000) } } },
-            { update_one: { filter: { _id: 2 }, update: { ssn: 'a' * (size_limit - 2000) } } },
+            { replace_one: { filter: { _id: 1 }, replacement: { ssn: 'a' * (size_limit - 2000) } } },
+            { replace_one: { filter: { _id: 2 }, replacement: { ssn: 'a' * (size_limit - 2000) } } },
           ]
         end
 
@@ -154,8 +154,8 @@ describe 'Bulk writes with auto-encryption enabled' do
       context 'when each operation is larger than 2MiB' do
         let(:requests) do
           [
-            { update_one: { filter: { _id: 1 }, update: { ssn: 'a' * (size_limit * 2) } } },
-            { update_one: { filter: { _id: 2 }, update: { ssn: 'a' * (size_limit * 2) } } },
+            { replace_one: { filter: { _id: 1 }, replacement: { ssn: 'a' * (size_limit * 2) } } },
+            { replace_one: { filter: { _id: 2 }, replacement: { ssn: 'a' * (size_limit * 2) } } },
           ]
         end
 
@@ -165,8 +165,8 @@ describe 'Bulk writes with auto-encryption enabled' do
       context 'when one operation is larger than 16MiB' do
         let(:requests) do
           [
-            { update_one: { filter: { _id: 1 }, update: { ssn: 'a' * (Mongo::Server::ConnectionBase::DEFAULT_MAX_BSON_OBJECT_SIZE) } } },
-            { update_one: { filter: { _id: 2 }, update: { ssn: 'a' * size_limit } } },
+            { replace_one: { filter: { _id: 1 }, replacement: { ssn: 'a' * (Mongo::Server::ConnectionBase::DEFAULT_MAX_BSON_OBJECT_SIZE) } } },
+            { replace_one: { filter: { _id: 2 }, replacement: { ssn: 'a' * size_limit } } },
           ]
         end
 
@@ -272,7 +272,7 @@ describe 'Bulk writes with auto-encryption enabled' do
         let(:requests) do
           [
             { insert_one: { _id: 1, ssn: 'a' * (size_limit/3) } },
-            { update_one: { filter: { _id: 1 }, update: { ssn: 'b' * (size_limit/3) } } },
+            { replace_one: { filter: { _id: 1 }, replacement: { ssn: 'b' * (size_limit/3) } } },
             { delete_one: { filter: { ssn: 'b' * (size_limit/3) } } }
           ]
         end

data/spec/integration/client_side_encryption/auto_encryption_command_monitoring_spec.rb

@@ -32,7 +32,7 @@ describe 'Auto Encryption' do
         database: db_name
       ),
     ).tap do |client|
-      client.subscribe(Mongo::Monitoring::COMMAND, subscriber)
+      client.encrypter.key_vault_client.subscribe(Mongo::Monitoring::COMMAND, subscriber)
     end
   end
 
@@ -62,10 +62,9 @@ describe 'Auto Encryption' do
     end
   end
 
-  shared_examples 'it has an encrypted key_vault_client' do
-    it 'registers a listCollections event on the key vault client' do
-      expect(key_vault_list_collections_event).not_to be_nil
-      expect(key_vault_list_collections_event.command['$db']).to eq(key_vault_db)
+  shared_examples 'it has a non-encrypted key_vault_client' do
+    it 'does not register a listCollections event on the key vault client' do
+      expect(key_vault_list_collections_event).to be_nil
     end
   end
 
@@ -86,7 +85,7 @@ describe 'Auto Encryption' do
       expect(succeeded_event.reply["cursor"]["firstBatch"].first["ssn"]).to be_ciphertext
     end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
+    it_behaves_like 'it has a non-encrypted key_vault_client'
   end
 
   describe '#count' do
@@ -102,7 +101,7 @@ describe 'Auto Encryption' do
       expect(started_event.command["query"]["ssn"]["$eq"]).to be_ciphertext
     end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
+    it_behaves_like 'it has a non-encrypted key_vault_client'
   end
 
   describe '#distinct' do
@@ -118,7 +117,7 @@ describe 'Auto Encryption' do
       expect(succeeded_event.reply["values"].first).to be_ciphertext
     end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
+    it_behaves_like 'it has a non-encrypted key_vault_client'
   end
 
   describe '#delete_one' do
@@ -134,7 +133,7 @@ describe 'Auto Encryption' do
       expect(started_event.command["deletes"].first["q"]["ssn"]["$eq"]).to be_ciphertext
     end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
+    it_behaves_like 'it has a non-encrypted key_vault_client'
   end
 
   describe '#delete_many' do
@@ -150,7 +149,7 @@ describe 'Auto Encryption' do
       expect(started_event.command["deletes"].first["q"]["ssn"]["$eq"]).to be_ciphertext
     end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
+    it_behaves_like 'it has a non-encrypted key_vault_client'
   end
 
   describe '#find' do
@@ -168,7 +167,7 @@ describe 'Auto Encryption' do
       expect(succeeded_event.reply["cursor"]["firstBatch"].first["ssn"]).to be_ciphertext
     end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
+    it_behaves_like 'it has a non-encrypted key_vault_client'
   end
 
   describe '#find_one_and_delete' do
@@ -186,7 +185,7 @@ describe 'Auto Encryption' do
       expect(succeeded_event.reply["value"]["ssn"]).to be_ciphertext
     end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
+    it_behaves_like 'it has a non-encrypted key_vault_client'
   end
 
   describe '#find_one_and_replace' do
@@ -208,7 +207,7 @@ describe 'Auto Encryption' do
       expect(succeeded_event.reply["value"]["ssn"]).to be_ciphertext
     end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
+    it_behaves_like 'it has a non-encrypted key_vault_client'
   end
 
   describe '#find_one_and_update' do
@@ -231,7 +230,7 @@ describe 'Auto Encryption' do
       expect(succeeded_event.reply["value"]["ssn"]).to be_ciphertext
     end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
+    it_behaves_like 'it has a non-encrypted key_vault_client'
   end
 
   describe '#insert_one' do
@@ -247,7 +246,7 @@ describe 'Auto Encryption' do
       expect(started_event.command["documents"].first["ssn"]).to be_ciphertext
     end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
+    it_behaves_like 'it has a non-encrypted key_vault_client'
   end
 
   describe '#replace_one' do
@@ -267,14 +266,14 @@ describe 'Auto Encryption' do
       expect(started_event.command["updates"].first["u"]["ssn"]).to be_ciphertext
     end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
+    it_behaves_like 'it has a non-encrypted key_vault_client'
   end
 
   describe '#update_one' do
     let(:command_name) { 'update' }
 
     before do
-      encryption_client['users'].update_one({ ssn: ssn }, { ssn: '555-555-5555' })
+      encryption_client['users'].replace_one({ ssn: ssn }, { ssn: '555-555-5555' })
     end
 
     it 'has encrypted data in command monitoring' do
@@ -284,7 +283,7 @@ describe 'Auto Encryption' do
       expect(started_event.command["updates"].first["u"]["ssn"]).to be_ciphertext
     end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
+    it_behaves_like 'it has a non-encrypted key_vault_client'
   end
 
   describe '#update_many' do
@@ -301,6 +300,6 @@ describe 'Auto Encryption' do
       expect(started_event.command["updates"].first["q"]["ssn"]["$eq"]).to be_ciphertext
     end
 
-    it_behaves_like 'it has an encrypted key_vault_client'
+    it_behaves_like 'it has a non-encrypted key_vault_client'
   end
 end

data/spec/integration/client_side_encryption/auto_encryption_mongocryptd_spawn_spec.rb

@@ -51,7 +51,6 @@ describe 'Auto Encryption' do
         .with(
           hash_including(
             'insert' => 'users',
-            '$db' => 'auto_encryption',
             'ordered' => true,
             'lsid' => kind_of(Hash),
             'documents' => kind_of(Array),

data/spec/integration/client_side_encryption/auto_encryption_reconnect_spec.rb

@@ -21,6 +21,7 @@ describe 'Client with auto encryption #reconnect' do
         {
           auto_encryption_options: {
             kms_providers: kms_providers,
+            kms_tls_options: kms_tls_options,
             key_vault_namespace: key_vault_namespace,
             key_vault_client: key_vault_client_option,
             schema_map: { 'auto_encryption.users': schema_map },
@@ -197,6 +198,21 @@ describe 'Client with auto encryption #reconnect' do
       it_behaves_like 'an auto-encryption client that reconnects properly'
     end
 
+    context 'with Azure KMS providers' do
+      include_context 'with Azure kms_providers'
+      it_behaves_like 'an auto-encryption client that reconnects properly'
+    end
+
+    context 'with GCP KMS providers' do
+      include_context 'with GCP kms_providers'
+      it_behaves_like 'an auto-encryption client that reconnects properly'
+    end
+
+    context 'with KMIP KMS providers' do
+      include_context 'with KMIP kms_providers'
+      it_behaves_like 'an auto-encryption client that reconnects properly'
+    end
+
     context 'with local KMS providers' do
       include_context 'with local kms_providers'
       it_behaves_like 'an auto-encryption client that reconnects properly'
@@ -216,6 +232,21 @@ describe 'Client with auto encryption #reconnect' do
       it_behaves_like 'an auto-encryption client that reconnects properly'
     end
 
+    context 'with Azure KMS providers' do
+      include_context 'with Azure kms_providers'
+      it_behaves_like 'an auto-encryption client that reconnects properly'
+    end
+
+    context 'with GCP KMS providers' do
+      include_context 'with GCP kms_providers'
+      it_behaves_like 'an auto-encryption client that reconnects properly'
+    end
+
+    context 'with KMIP KMS providers' do
+      include_context 'with KMIP kms_providers'
+      it_behaves_like 'an auto-encryption client that reconnects properly'
+    end
+
     context 'with local KMS providers' do
       include_context 'with local kms_providers'
       it_behaves_like 'an auto-encryption client that reconnects properly'

data/spec/integration/client_side_encryption/auto_encryption_spec.rb

@@ -22,6 +22,7 @@ describe 'Auto Encryption' do
       SpecConfig.instance.test_options.merge(
         auto_encryption_options: {
           kms_providers: kms_providers,
+          kms_tls_options: kms_tls_options,
           key_vault_namespace: key_vault_namespace,
           schema_map: local_schema,
           bypass_auto_encryption: bypass_auto_encryption,
@@ -99,6 +100,48 @@ describe 'Auto Encryption' do
       end
     end
 
+    context 'with Azure KMS provider' do
+      include_context 'with Azure kms_providers'
+
+      context 'with validator' do
+        include_context 'jsonSchema validator on collection'
+        it_behaves_like 'it performs an encrypted command'
+      end
+
+      context 'with schema map' do
+        include_context 'schema map in client options'
+        it_behaves_like 'it performs an encrypted command'
+      end
+    end
+
+    context 'with GCP KMS provider' do
+      include_context 'with GCP kms_providers'
+
+      context 'with validator' do
+        include_context 'jsonSchema validator on collection'
+        it_behaves_like 'it performs an encrypted command'
+      end
+
+      context 'with schema map' do
+        include_context 'schema map in client options'
+        it_behaves_like 'it performs an encrypted command'
+      end
+    end
+
+    context 'with KMIP KMS provider' do
+      include_context 'with KMIP kms_providers'
+
+      context 'with validator' do
+        include_context 'jsonSchema validator on collection'
+        it_behaves_like 'it performs an encrypted command'
+      end
+
+      context 'with schema map' do
+        include_context 'schema map in client options'
+        it_behaves_like 'it performs an encrypted command'
+      end
+    end
+
     context 'with local KMS provider' do
       include_context 'with local kms_providers'
 
@@ -446,6 +489,22 @@ describe 'Auto Encryption' do
         it_behaves_like 'it obeys bypass_auto_encryption option'
       end
 
+      context 'with Azure KMS provider' do
+        include_context 'with Azure kms_providers'
+        it_behaves_like 'it obeys bypass_auto_encryption option'
+      end
+
+      context 'with GCP KMS provider' do
+        include_context 'with GCP kms_providers'
+        it_behaves_like 'it obeys bypass_auto_encryption option'
+      end
+
+      context 'with KMIP KMS provider' do
+        include_context 'with KMIP kms_providers'
+        it_behaves_like 'it obeys bypass_auto_encryption option'
+      end
+
+
       context 'with local KMS provider and ' do
         include_context 'with local kms_providers'
         it_behaves_like 'it obeys bypass_auto_encryption option'
@@ -493,6 +552,54 @@ describe 'Auto Encryption' do
         end
       end
 
+      context 'with Azure KMS provider' do
+        include_context 'with Azure kms_providers and key alt names'
+        it 'encrypts the ssn field' do
+          expect(result).to be_ok
+          expect(result.inserted_ids.length).to eq(1)
+
+          id = result.inserted_ids.first
+
+          document = client['users'].find(_id: id).first
+          document.should_not be_nil
+          # Auto-encryption with key alt names only works with random encryption,
+          # so it will not generate the same result on every test run.
+          expect(document['ssn']).to be_ciphertext
+        end
+
+        context 'with GCP KMS provider' do
+          include_context 'with GCP kms_providers and key alt names'
+          it 'encrypts the ssn field' do
+            expect(result).to be_ok
+            expect(result.inserted_ids.length).to eq(1)
+
+            id = result.inserted_ids.first
+
+            document = client['users'].find(_id: id).first
+            document.should_not be_nil
+            # Auto-encryption with key alt names only works with random encryption,
+            # so it will not generate the same result on every test run.
+            expect(document['ssn']).to be_ciphertext
+          end
+        end
+
+        context 'with KMIP KMS provider' do
+          include_context 'with KMIP kms_providers and key alt names'
+          it 'encrypts the ssn field' do
+            expect(result).to be_ok
+            expect(result.inserted_ids.length).to eq(1)
+
+            id = result.inserted_ids.first
+
+            document = client['users'].find(_id: id).first
+            document.should_not be_nil
+            # Auto-encryption with key alt names only works with random encryption,
+            # so it will not generate the same result on every test run.
+            expect(document['ssn']).to be_ciphertext
+          end
+        end
+      end
+
       context 'with local KMS provider' do
         include_context 'with local kms_providers and key alt names'
         it 'encrypts the ssn field' do
@@ -548,7 +655,7 @@ describe 'Auto Encryption' do
       include_context 'encrypted document in collection'
 
       let(:result) do
-        encryption_client['users'].update_one({ ssn: ssn }, { ssn: '098-765-4321' })
+        encryption_client['users'].replace_one({ ssn: ssn }, { ssn: '098-765-4321' })
       end
 
       it 'encrypts the ssn field' do

data/spec/integration/client_side_encryption/bson_size_limit_spec.rb

@@ -33,7 +33,7 @@ describe 'Client-Side Encryption' do
             kms_providers: {
               local: { key: local_master_key },
             },
-            key_vault_namespace: 'admin.datakeys',
+            key_vault_namespace: 'keyvault.datakeys',
             # Spawn mongocryptd on non-default port for sharded cluster tests
             extra_options: extra_options,
           },
@@ -52,7 +52,7 @@ describe 'Client-Side Encryption' do
         }
       ].create
 
-      key_vault_collection = client.use('admin')['datakeys', write_concern: { w: :majority }]
+      key_vault_collection = client.use('keyvault')['datakeys', write_concern: { w: :majority }]
 
       key_vault_collection.drop
       key_vault_collection.insert_one(

data/spec/integration/client_side_encryption/bypass_mongocryptd_spawn_spec.rb

@@ -26,7 +26,7 @@ describe 'Client-Side Encryption' do
           SpecConfig.instance.test_options.merge(
             auto_encryption_options: {
               kms_providers: local_kms_providers,
-              key_vault_namespace: 'admin.datakeys',
+              key_vault_namespace: 'keyvault.datakeys',
               schema_map: { 'db.coll' => test_schema_map },
               extra_options: {
                 mongocryptd_bypass_spawn: true,
@@ -53,7 +53,7 @@ describe 'Client-Side Encryption' do
           SpecConfig.instance.test_options.merge(
             auto_encryption_options: {
               kms_providers: local_kms_providers,
-              key_vault_namespace: 'admin.datakeys',
+              key_vault_namespace: 'keyvault.datakeys',
               bypass_auto_encryption: true,
               extra_options: {
                 mongocryptd_spawn_args: [ "--pidfilepath=bypass-spawning-mongocryptd.pid", "--port=#{mongocryptd_port}"],

data/spec/integration/client_side_encryption/client_close_spec.rb

@@ -18,7 +18,7 @@ describe 'Auto encryption client' do
         SpecConfig.instance.test_options.merge(
           auto_encryption_options: {
             kms_providers: kms_providers,
-            key_vault_namespace: 'admin.datakeys',
+            key_vault_namespace: 'keyvault.datakeys',
             schema_map: { 'auto_encryption.users' => schema_map },
             # Spawn mongocryptd on non-default port for sharded cluster tests
             extra_options: extra_options,