mongo 2.17.4 → 2.18.0.beta1

data/spec/mongo/crypt/data_key_context_spec.rb

@@ -9,20 +9,26 @@ describe Mongo::Crypt::DataKeyContext do
   require_libmongocrypt
   include_context 'define shared FLE helpers'
 
+  let(:credentials) { Mongo::Crypt::KMS::Credentials.new(kms_providers) }
+
+  let(:kms_tls_options) do
+    {}
+  end
+
   let(:mongocrypt) do
-    Mongo::Crypt::Handle.new(kms_providers)
+    Mongo::Crypt::Handle.new(credentials, kms_tls_options)
   end
 
   let(:io) { double("Mongo::Crypt::EncryptionIO") }
 
-  let(:context) { described_class.new(mongocrypt, io, kms_provider_name, options) }
-  let(:base_options) { {} }
-  let(:options) { base_options }
+  let(:key_alt_names) { [] }
+
+  let(:context) { described_class.new(mongocrypt, io, key_document, key_alt_names) }
 
   describe '#initialize' do
     shared_examples 'it properly sets key_alt_names' do
       context 'with one key_alt_names' do
-        let(:options) { base_options.merge(key_alt_names: ['keyAltName1']) }
+        let(:key_alt_names) { ['keyAltName1'] }
 
         it 'does not raise an exception' do
           expect do
@@ -32,7 +38,7 @@ describe Mongo::Crypt::DataKeyContext do
       end
 
       context 'with multiple key_alt_names' do
-        let(:options) { base_options.merge(key_alt_names: ['keyAltName1', 'keyAltName2']) }
+        let(:key_alt_names) { ['keyAltName1', 'keyAltName2'] }
 
         it 'does not raise an exception' do
           expect do
@@ -42,7 +48,7 @@ describe Mongo::Crypt::DataKeyContext do
       end
 
       context 'with empty key_alt_names' do
-        let(:options) { base_options.merge(key_alt_names: []) }
+        let(:key_alt_names) { [] }
 
         it 'does not raise an exception' do
           expect do
@@ -52,7 +58,7 @@ describe Mongo::Crypt::DataKeyContext do
       end
 
       context 'with invalid key_alt_names' do
-        let(:options) { base_options.merge(key_alt_names: ['keyAltName1', 3]) }
+        let(:key_alt_names) { ['keyAltName1', 3] }
 
         it 'does raises an exception' do
           expect do
@@ -62,7 +68,7 @@ describe Mongo::Crypt::DataKeyContext do
       end
 
       context 'with non-array key_alt_names' do
-        let(:options) { base_options.merge(key_alt_names: "keyAltName1") }
+        let(:key_alt_names) { "keyAltName1" }
 
         it 'does raises an exception' do
           expect do
@@ -72,115 +78,17 @@ describe Mongo::Crypt::DataKeyContext do
       end
     end
 
-    context 'with invalid kms provider'do
-      let(:kms_providers) { local_kms_providers }
-      let(:kms_provider_name) { 'invalid' }
-
-      it 'raises an exception' do
-        expect do
-          context
-        end.to raise_exception(/invalid is an invalid kms provider/)
-      end
-    end
-
-    context 'with local kms provider and empty options' do
-      include_context 'with local kms_providers'
-
-      it_behaves_like 'it properly sets key_alt_names'
-
-      it 'does not raise an exception' do
-        expect do
-          context
-        end.not_to raise_error
-      end
-    end
-
     context 'with aws kms provider' do
       include_context 'with AWS kms_providers'
 
-      let(:base_options) { { master_key: { region: 'us-east-2', key: 'arn' } } }
-
-      it_behaves_like 'it properly sets key_alt_names'
-
-      context 'with empty options' do
-        let(:options) { {} }
-
-        it 'raises an exception' do
-          expect do
-            context
-          end.to raise_error(ArgumentError, /options Hash must contain a key named :master_key with a Hash value/)
-        end
-      end
-
-      context 'with an invalid master key option' do
-        let(:options) { { master_key: 'key' } }
-
-        it 'raises an exception' do
-          expect do
-            context
-          end.to raise_error(ArgumentError, /:master_key option must be a Hash/)
-        end
-      end
-
-      context 'where master key is an empty hash' do
-        let(:options) { { master_key: {} } }
-
-        it 'raises an exception' do
-          expect do
-            context
-          end.to raise_error(ArgumentError, /The value of :region option of the :master_key options hash cannot be nil/)
-        end
+      let(:key_document) do
+        Mongo::Crypt::KMS::MasterKeyDocument.new(
+          'aws',
+          { master_key: { region: 'us-east-2', key: 'arn' } }
+        )
       end
 
-      context 'with a nil region option' do
-        let(:options) { { master_key: { region: nil } } }
-
-        it 'raises an exception' do
-          expect do
-            context
-          end.to raise_error(ArgumentError, /The value of :region option of the :master_key options hash cannot be nil/)
-        end
-      end
-
-      context 'with an invalid region option' do
-        let(:options) { { master_key: { region: 5 } } }
-
-        it 'raises an exception' do
-          expect do
-            context
-          end.to raise_error(ArgumentError, /5 is an invalid AWS master_key region/)
-        end
-      end
-
-      context 'with an invalid key option' do
-        let(:options) { { master_key: { region: 'us-east-2', key: nil } } }
-
-        it 'raises an exception' do
-          expect do
-            context
-          end.to raise_error(ArgumentError, /The value of :key option of the :master_key options hash cannot be nil/)
-        end
-      end
-
-      context 'with an invalid key option' do
-        let(:options) { { master_key: { region: 'us-east-2', key: 5 } } }
-
-        it 'raises an exception' do
-          expect do
-            context
-          end.to raise_error(ArgumentError, /5 is an invalid AWS master_key key/)
-        end
-      end
-
-      context 'with an invalid endpoint option' do
-        let(:options) { { master_key: { region: 'us-east-2', key: 'arn', endpoint: 5 } } }
-
-        it 'raises an exception' do
-          expect do
-            context
-          end.to raise_error(ArgumentError, /5 is an invalid AWS master_key endpoint/)
-        end
-      end
+      it_behaves_like 'it properly sets key_alt_names'
 
       context 'with valid options' do
         it 'does not raise an exception' do
@@ -191,7 +99,18 @@ describe Mongo::Crypt::DataKeyContext do
       end
 
       context 'with valid endpoint' do
-        let(:options) { { master_key: { region: 'us-east-2', key: 'arn', endpoint: 'kms.us-east-2.amazonaws.com:443' } } }
+        let(:key_document) do
+          Mongo::Crypt::KMS::MasterKeyDocument.new(
+            'aws',
+            {
+              master_key: {
+                region: 'us-east-2',
+                key: 'arn',
+                endpoint: 'kms.us-east-2.amazonaws.com:443'
+              }
+            }
+          )
+        end
 
         it 'does not raise an exception' do
           expect do
@@ -208,6 +127,15 @@ describe Mongo::Crypt::DataKeyContext do
     context 'with local KMS provider' do
       include_context 'with local kms_providers'
 
+      let(:key_document) do
+        Mongo::Crypt::KMS::MasterKeyDocument.new(
+          'local',
+          {
+            master_key: { key: 'MASTER-KEY' }
+          }
+        )
+      end
+
       it 'creates a data key' do
         expect(context.run_state_machine).to be_a_kind_of(Hash)
       end

data/spec/mongo/crypt/encryption_io_spec.rb

@@ -9,6 +9,7 @@ describe Mongo::Crypt::EncryptionIO do
     described_class.new(
       key_vault_namespace: 'foo.bar',
       key_vault_client: authorized_client,
+      metadata_client: authorized_client.with(auto_encryption_options: nil),
       mongocryptd_options: mongocryptd_options,
     )
   end
@@ -106,6 +107,7 @@ describe Mongo::Crypt::EncryptionIO do
         mongocryptd_client: mock_client,
         key_vault_namespace: 'foo.bar',
         key_vault_client: authorized_client,
+        metadata_client: authorized_client.with(auto_encryption_options: nil),
         mongocryptd_options: mongocryptd_options,
       )
     end

data/spec/mongo/crypt/explicit_decryption_context_spec.rb

@@ -8,7 +8,8 @@ describe Mongo::Crypt::ExplicitDecryptionContext do
   require_libmongocrypt
   include_context 'define shared FLE helpers'
 
-  let(:mongocrypt) { Mongo::Crypt::Handle.new(kms_providers, logger: logger) }
+  let(:credentials) { Mongo::Crypt::KMS::Credentials.new(kms_providers) }
+  let(:mongocrypt) { Mongo::Crypt::Handle.new(credentials, logger: logger) }
   let(:context) { described_class.new(mongocrypt, io, value) }
   let(:logger) { nil }
   let(:io) { double("Mongo::ClientEncryption::IO") }
@@ -43,6 +44,36 @@ describe Mongo::Crypt::ExplicitDecryptionContext do
       end
     end
 
+    context 'when mongocrypt is initialized with Azure KMS provider options' do
+      include_context 'with Azure kms_providers'
+
+      it 'initializes context' do
+        expect do
+          context
+        end.not_to raise_error
+      end
+    end
+
+    context 'when mongocrypt is initialized with GCP KMS provider options' do
+      include_context 'with GCP kms_providers'
+
+      it 'initializes context' do
+        expect do
+          context
+        end.not_to raise_error
+      end
+    end
+
+    context 'when mongocrypt is initialized with KMIP KMS provider options' do
+      include_context 'with KMIP kms_providers'
+
+      it 'initializes context' do
+        expect do
+          context
+        end.not_to raise_error
+      end
+    end
+
     context 'with verbose logging' do
       include_context 'with local kms_providers'
 

data/spec/mongo/crypt/explicit_encryption_context_spec.rb

@@ -8,7 +8,8 @@ describe Mongo::Crypt::ExplicitEncryptionContext do
   require_libmongocrypt
   include_context 'define shared FLE helpers'
 
-  let(:mongocrypt) { Mongo::Crypt::Handle.new(kms_providers, logger: logger) }
+  let(:credentials) { Mongo::Crypt::KMS::Credentials.new(kms_providers) }
+  let(:mongocrypt) { Mongo::Crypt::Handle.new(credentials, logger: logger) }
   let(:context) { described_class.new(mongocrypt, io, value, options) }
 
   let(:logger) { nil }
@@ -126,6 +127,78 @@ describe Mongo::Crypt::ExplicitEncryptionContext do
           end.not_to raise_error
         end
       end
+
+      context 'with query_type' do
+        let(:key_alt_name) { nil }
+
+        it 'raises exception' do
+          expect do
+            described_class.new(
+              mongocrypt,
+              io,
+              value,
+              options.merge(query_type: :equality)
+            )
+          end.to raise_error(ArgumentError, /query_type is allowed only for "Indexed" algorithm/)
+        end
+      end
+
+      context 'with contention_factor' do
+        let(:key_alt_name) { nil }
+
+        it 'raises exception' do
+          expect do
+            described_class.new(
+              mongocrypt,
+              io,
+              value,
+              options.merge(contention_factor: 10)
+            )
+          end.to raise_error(ArgumentError, /contention_factor is allowed only for "Indexed" algorithm/)
+        end
+      end
+
+      context 'with Indexed algorithm' do
+        let(:algorithm) do
+          'Indexed'
+        end
+
+        let(:key_alt_name) do
+          nil
+        end
+
+        it 'initializes context' do
+          expect do
+            context
+          end.not_to raise_error
+        end
+
+        context 'with query_type' do
+          it 'initializes context' do
+            expect do
+              described_class.new(
+                mongocrypt,
+                io,
+                value,
+                options.merge(query_type: :equality)
+              )
+            end.not_to raise_error
+          end
+        end
+
+        context 'with contention_factor' do
+          it 'initializes context' do
+            expect do
+              described_class.new(
+                mongocrypt,
+                io,
+                value,
+                options.merge(contention_factor: 10)
+              )
+            end.not_to raise_error
+          end
+        end
+      end
     end
 
     context 'when mongocrypt is initialized with AWS KMS provider options' do
@@ -133,6 +206,21 @@ describe Mongo::Crypt::ExplicitEncryptionContext do
       it_behaves_like 'a functioning ExplicitEncryptionContext'
     end
 
+    context 'when mongocrypt is initialized with Azure KMS provider options' do
+      include_context 'with Azure kms_providers'
+      it_behaves_like 'a functioning ExplicitEncryptionContext'
+    end
+
+    context 'when mongocrypt is initialized with GCP KMS provider options' do
+      include_context 'with GCP kms_providers'
+      it_behaves_like 'a functioning ExplicitEncryptionContext'
+    end
+
+    context 'when mongocrypt is initialized with KMIP KMS provider options' do
+      include_context 'with KMIP kms_providers'
+      it_behaves_like 'a functioning ExplicitEncryptionContext'
+    end
+
     context 'when mongocrypt is initialized with local KMS provider options' do
       include_context 'with local kms_providers'
       it_behaves_like 'a functioning ExplicitEncryptionContext'

data/spec/mongo/crypt/handle_spec.rb

@@ -10,7 +10,9 @@ describe Mongo::Crypt::Handle do
   include_context 'define shared FLE helpers'
 
   describe '#initialize' do
-    let(:handle) { described_class.new(kms_providers, schema_map: schema_map) }
+    let(:credentials) { Mongo::Crypt::KMS::Credentials.new(kms_providers) }
+    let(:kms_tls_options) { {} }
+    let(:handle) { described_class.new(credentials, kms_tls_options, schema_map: schema_map) }
     let(:schema_map) { nil }
 
     shared_examples 'a functioning Mongo::Crypt::Handle' do
@@ -37,199 +39,75 @@ describe Mongo::Crypt::Handle do
       end
     end
 
-    context 'with empty kms_providers' do
-      let(:kms_providers) { {} }
-
-      it 'raises an exception' do
-        expect { handle }.to raise_error(ArgumentError, /must have one of the following keys: :aws, :local/)
-      end
-    end
-
-    context 'with invalid aws kms_providers' do
-      let(:kms_providers) { { aws: {} } }
-
-      it 'raises an exception' do
-        expect { handle }.to raise_error(ArgumentError, /kms_providers with :aws key must be in the format: { aws: { access_key_id: 'YOUR-ACCESS-KEY-ID', secret_access_key: 'SECRET-ACCESS-KEY' } }/)
-      end
-    end
-
-    context 'with invalid kms_providers key' do
-      let(:kms_providers) { { random_kms_provider: {} } }
-
-      it 'raises an exception' do
-        expect { handle }.to raise_error(ArgumentError, /must have one of the following keys: :aws, :local/)
-      end
-    end
-
-    context 'with empty local kms_providers' do
-      let(:kms_providers) { { local: {} } }
-
-      it 'raises an exception' do
-        expect { handle }.to raise_error(ArgumentError, /kms_providers with :local key must be in the format: { local: { key: 'MASTER-KEY' } }/)
-      end
-    end
-
-    context 'with invalid local kms_providers' do
-      let(:kms_providers) { { local: { invalid_key: 'Some stuff' } } }
-
-      it 'raises an exception' do
-        expect { handle }.to raise_error(ArgumentError, /kms_providers with :local key must be in the format: { local: { key: 'MASTER-KEY' } }/)
-      end
-    end
-
-    context 'with invalid local kms master key' do
-      let(:kms_providers) do
-        {
-          local: {
-            key: 'ruby' * 23 # NOT 96 bytes
+    context 'local' do
+      context 'with invalid local kms master key' do
+        let(:kms_providers) do
+          {
+            local: {
+              key: 'ruby' * 23 # NOT 96 bytes
+            }
           }
-        }
-      end
+        end
 
-      it 'raises an exception' do
-        expect { handle }.to raise_error(Mongo::Error::CryptError, 'local key must be 96 bytes (libmongocrypt error code 1)')
+        it 'raises an exception' do
+          expect { handle }.to raise_error(Mongo::Error::CryptError, 'local key must be 96 bytes (libmongocrypt error code 1)')
+        end
       end
-    end
 
-    context 'with valid local kms_providers' do
-      include_context 'with local kms_providers'
-      it_behaves_like 'a functioning Mongo::Crypt::Handle'
-    end
-
-    context 'with nil AWS kms_provider' do
-      let(:kms_providers) {
-        {
-          aws: nil
-        }
-      }
-
-      it 'raises an exception' do
-        expect do
-          handle
-        end.to raise_error(ArgumentError, /The :aws KMS provider must not be nil/)
+      context 'with valid local kms_providers' do
+        include_context 'with local kms_providers'
+        it_behaves_like 'a functioning Mongo::Crypt::Handle'
       end
-    end
 
-    context 'with empty AWS kms_provider' do
-      let(:kms_providers) {
-        {
-          aws: {}
-        }
-      }
-
-      it 'raises an exception' do
-        expect do
-          handle
-        end.to raise_error(ArgumentError, /The specified aws kms_providers option is invalid/)
-      end
     end
 
-    context 'with nil AWS access_key_id' do
-      let(:kms_providers) {
-        {
-          aws: {
-            access_key_id: nil,
-            secret_access_key: SpecConfig.instance.fle_aws_secret
-          }
-        }
-      }
-
-      it 'raises an exception' do
-        expect do
-          handle
-        end.to raise_error(ArgumentError, /The aws access_key_id option must be a String with at least one character; currently have nil/)
+    context 'AWS' do
+      context 'with valid AWS kms_providers' do
+        include_context 'with AWS kms_providers'
+        it_behaves_like 'a functioning Mongo::Crypt::Handle'
       end
     end
 
-    context 'with non-string AWS access_key_id' do
-      let(:kms_providers) {
-        {
-          aws: {
-            access_key_id: 5,
-            secret_access_key: SpecConfig.instance.fle_aws_secret
-          }
-        }
-      }
-
-      it 'raises an exception' do
-        expect do
-          handle
-        end.to raise_error(ArgumentError, /The aws access_key_id option must be a String with at least one character; currently have 5/)
+    context 'Azure' do
+      context 'with valid azure kms_providers' do
+        include_context 'with Azure kms_providers'
+        it_behaves_like 'a functioning Mongo::Crypt::Handle'
       end
     end
 
-    context 'with empty string AWS access_key_id' do
-      let(:kms_providers) {
-        {
-          aws: {
-            access_key_id: '',
-            secret_access_key: SpecConfig.instance.fle_aws_secret
-          }
-        }
-      }
-
-      it 'raises an exception' do
-        expect do
-          handle
-        end.to raise_error(ArgumentError, /The aws access_key_id option must be a String with at least one character; it is currently an empty string/)
+    context 'GCP' do
+      context 'with valid gcp kms_providers' do
+        include_context 'with GCP kms_providers'
+        it_behaves_like 'a functioning Mongo::Crypt::Handle'
       end
     end
 
+    context 'GCP with PEM private key' do
+      require_mri
 
-    context 'with nil AWS secret_access_key' do
-      let(:kms_providers) {
-        {
-          aws: {
-            access_key_id: SpecConfig.instance.fle_aws_key,
-            secret_access_key: nil
-          }
-        }
-      }
-
-      it 'raises an exception' do
-        expect do
-          handle
-        end.to raise_error(ArgumentError, /The aws secret_access_key option must be a String with at least one character; currently have nil/)
-      end
-    end
+      context 'with valid gcp kms_providers' do
+        include_context 'with GCP kms_providers'
 
-    context 'with non-string AWS secret_access_key' do
-      let(:kms_providers) {
-        {
-          aws: {
-            access_key_id: SpecConfig.instance.fle_aws_key,
-            secret_access_key: 5
+        let(:kms_providers) do
+          {
+            gcp: {
+              email: SpecConfig.instance.fle_gcp_email,
+              private_key: OpenSSL::PKey.read(
+                Base64.decode64(SpecConfig.instance.fle_gcp_private_key)
+              ).export,
+            }
           }
-        }
-      }
+        end
 
-      it 'raises an exception' do
-        expect do
-          handle
-        end.to raise_error(ArgumentError, /The aws secret_access_key option must be a String with at least one character; currently have 5/)
+        it_behaves_like 'a functioning Mongo::Crypt::Handle'
       end
     end
 
-    context 'with empty string AWS secret_access_key' do
-      let(:kms_providers) {
-        {
-          aws: {
-            access_key_id: SpecConfig.instance.fle_aws_key,
-            secret_access_key: ''
-          }
-        }
-      }
-
-      it 'raises an exception' do
-        expect do
-          handle
-        end.to raise_error(ArgumentError, /The aws secret_access_key option must be a String with at least one character; it is currently an empty string/)
+    context 'KMIP' do
+      context 'with valid kmip kms_providers' do
+        include_context 'with KMIP kms_providers'
+        it_behaves_like 'a functioning Mongo::Crypt::Handle'
       end
     end
-
-    context 'with valid AWS kms_providers' do
-      include_context 'with AWS kms_providers'
-      it_behaves_like 'a functioning Mongo::Crypt::Handle'
-    end
   end
 end

data/spec/mongo/crypt/hooks_spec.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+require 'mongo'
+require 'base64'
+require 'lite_spec_helper'
+
+describe Mongo::Crypt::Hooks do
+  context '#rsaes_pkcs_signature' do
+    let(:private_key_data_b64) do
+      'MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC4JOyv5z05cL18ztpknRC7CFY2gYol4DAKerdVUoDJxCTmFMf39dVUEqD0WDiw/qcRtSO1/FRut08PlSPmvbyKetsLoxlpS8lukSzEFpFK7+L+R4miFOl6HvECyg7lbC1H/WGAhIz9yZRlXhRo9qmO/fB6PV9IeYtU+1xYuXicjCDPp36uuxBAnCz7JfvxJ3mdVc0vpSkbSb141nWuKNYR1mgyvvL6KzxO6mYsCo4hRAdhuizD9C4jDHk0V2gDCFBk0h8SLEdzStX8L0jG90/Og4y7J1b/cPo/kbYokkYisxe8cPlsvGBf+rZex7XPxc1yWaP080qeABJb+S88O//LAgMBAAECggEBAKVxP1m3FzHBUe2NZ3fYCc0Qa2zjK7xl1KPFp2u4CU+9sy0oZJUqQHUdm5CMprqWwIHPTftWboFenmCwrSXFOFzujljBO7Z3yc1WD3NJl1ZNepLcsRJ3WWFH5V+NLJ8Bdxlj1DMEZCwr7PC5+vpnCuYWzvT0qOPTl9RNVaW9VVjHouJ9Fg+s2DrShXDegFabl1iZEDdI4xScHoYBob06A5lw0WOCTayzw0Naf37lM8Y4psRAmI46XLiF/Vbuorna4hcChxDePlNLEfMipICcuxTcei1RBSlBa2t1tcnvoTy6cuYDqqImRYjp1KnMKlKQBnQ1NjS2TsRGm+F0FbreVCECgYEA4IDJlm8q/hVyNcPe4OzIcL1rsdYN3bNm2Y2O/YtRPIkQ446ItyxD06d9VuXsQpFp9jNACAPfCMSyHpPApqlxdc8z/xATlgHkcGezEOd1r4E7NdTpGg8y6Rj9b8kVlED6v4grbRhKcU6moyKUQT3+1B6ENZTOKyxuyDEgTwZHtFECgYEA0fqdv9h9s77d6eWmIioP7FSymq93pC4umxf6TVicpjpMErdD2ZfJGulN37dq8FOsOFnSmFYJdICj/PbJm6p1i8O21lsFCltEqVoVabJ7/0alPfdG2U76OeBqI8ZubL4BMnWXAB/VVEYbyWCNpQSDTjHQYs54qa2I0dJB7OgJt1sCgYEArctFQ02/7H5Rscl1yo3DBXO94SeiCFSPdC8f2Kt3MfOxvVdkAtkjkMACSbkoUsgbTVqTYSEOEc2jTgR3iQ13JgpHaFbbsq64V0QP3TAxbLIQUjYGVgQaF1UfLOBv8hrzgj45z/ST/G80lOl595+0nCUbmBcgG1AEWrmdF0/3RmECgYAKvIzKXXB3+19vcT2ga5Qq2l3TiPtOGsppRb2XrNs9qKdxIYvHmXo/9QP1V3SRW0XoD7ez8FpFabp42cmPOxUNk3FK3paQZABLxH5pzCWI9PzIAVfPDrm+sdnbgG7vAnwfL2IMMJSA3aDYGCbF9EgefG+STcpfqq7fQ6f5TBgLFwKBgCd7gn1xYL696SaKVSm7VngpXlczHVEpz3kStWR5gfzriPBxXgMVcWmcbajRser7ARpCEfbxM1UJyv6oAYZWVSNErNzNVb4POqLYcCNySuC6xKhs9FrEQnyKjyk8wI4VnrEMGrQ8e+qYSwYk9Gh6dKGoRMAPYVXQAO0fIsHF/T0a'
+    end
+
+    let(:signature) do
+      Base64.decode64(
+        'VocBRhpMmQ2XCzVehWSqheQLnU889gf3dhU4AnVnQTJjsKx/CM23qKDPkZDd2A/BnQsp99SN7ksIX5Raj0TPwyN5OCN/YrNFNGoOFlTsGhgP/hyE8X3Duiq6sNO0SMvRYNPFFGlJFsp1Fw3Z94eYMg4/Wpw5s4+Jo5Zm/qY7aTJIqDKDQ3CNHLeJgcMUOc9sz01/GzoUYKDVODHSxrYEk5ireFJFz9vP8P7Ha+VDUZuQIQdXer9NBbGFtYmWprY3nn4D3Dw93Sn0V0dIqYeIo91oKyslvMebmUM95S2PyIJdEpPb2DJDxjvX/0LLwSWlSXRWy9gapWoBkb4ynqZBsg=='
+      )
+    end
+
+    let(:input) do
+      'data to sign'
+    end
+
+    it 'signs data with private key' do
+      expect(
+        subject.rsaes_pkcs_signature(private_key_data_b64, input)
+      ).to eq(signature)
+    end
+  end
+end