mongo 2.18.0.beta1 → 2.18.0

data/spec/spec_tests/data/client_side_encryption/unified/getKeys.yml

@@ -0,0 +1,122 @@
+description: getKeys
+
+schemaVersion: "1.8"
+
+runOnRequirements:
+  - csfle: true
+
+createEntities:
+  - client:
+      id: &client0 client0
+      observeEvents:
+        - commandStartedEvent
+  - clientEncryption:
+      id: &clientEncryption0 clientEncryption0
+      clientEncryptionOpts:
+        keyVaultClient: *client0
+        keyVaultNamespace: keyvault.datakeys
+        kmsProviders:
+          local: { key: { $$placeholder: 1 } }
+  - database:
+      id: &database0 database0
+      client: *client0
+      databaseName: &database0Name keyvault
+  - collection:
+      id: &collection0 collection0
+      database: *database0
+      collectionName: &collection0Name datakeys
+
+initialData:
+  - databaseName: *database0Name
+    collectionName: *collection0Name
+    documents: []
+
+tests:
+  - description: getKeys with zero key documents
+    operations:
+      - name: getKeys
+        object: *clientEncryption0
+        expectResult: []
+    expectEvents:
+      - client: *client0
+        events:
+          - commandStartedEvent:
+              databaseName: *database0Name
+              command:
+                find: *collection0Name
+                filter: {}
+                readConcern: { level: majority }
+
+  - description: getKeys with single key documents
+    operations:
+      - name: createDataKey
+        object: *clientEncryption0
+        arguments:
+          kmsProvider: local
+          opts:
+            keyAltNames: ["abc"]
+        expectResult: { $$type: binData }
+      - name: getKeys
+        object: *clientEncryption0
+        expectResult:
+          - _id: { $$type: binData }
+            keyAltNames: ["abc"]
+            keyMaterial: { $$type: binData }
+            creationDate: { $$type: date }
+            updateDate: { $$type: date }
+            status: { $$type: int }
+            masterKey: { $$type: object }
+    expectEvents:
+      - client: *client0
+        events:
+          - commandStartedEvent:
+              commandName: insert
+          - commandStartedEvent:
+              databaseName: *database0Name
+              command:
+                find: *collection0Name
+                filter: {}
+                readConcern: { level: majority }
+
+  - description: getKeys with many key documents
+    operations:
+      - name: createDataKey
+        object: *clientEncryption0
+        arguments:
+          kmsProvider: local
+        expectResult: { $$type: binData }
+      - name: createDataKey
+        object: *clientEncryption0
+        arguments:
+          kmsProvider: local
+        expectResult: { $$type: binData }
+      - name: getKeys
+        object: *clientEncryption0
+        expectResult:
+          # Cannot expect deterministic order of results, so only assert that
+          # exactly two key documents are returned.
+          - _id: { $$type: binData }
+            keyMaterial: { $$type: binData }
+            creationDate: { $$type: date }
+            updateDate: { $$type: date }
+            status: { $$type: int }
+            masterKey: { $$type: object }
+          - _id: { $$type: binData }
+            keyMaterial: { $$type: binData }
+            creationDate: { $$type: date }
+            updateDate: { $$type: date }
+            status: { $$type: int }
+            masterKey: { $$type: object }
+    expectEvents:
+      - client: *client0
+        events:
+          - commandStartedEvent:
+              commandName: insert
+          - commandStartedEvent:
+              commandName: insert
+          - commandStartedEvent:
+              databaseName: *database0Name
+              command:
+                find: *collection0Name
+                filter: {}
+                readConcern: { level: majority }

data/spec/spec_tests/data/client_side_encryption/unified/removeKeyAltName.yml

@@ -0,0 +1,157 @@
+description: removeKeyAltName
+
+schemaVersion: "1.8"
+
+runOnRequirements:
+  - csfle: true
+
+createEntities:
+  - client:
+      id: &client0 client0
+      observeEvents:
+        - commandStartedEvent
+  - clientEncryption:
+      id: &clientEncryption0 clientEncryption0
+      clientEncryptionOpts:
+        keyVaultClient: *client0
+        keyVaultNamespace: keyvault.datakeys
+        kmsProviders:
+          local: { key: { $$placeholder: 1 } }
+  - database:
+      id: &database0 database0
+      client: *client0
+      databaseName: &database0Name keyvault
+  - collection:
+      id: &collection0 collection0
+      database: *database0
+      collectionName: &collection0Name datakeys
+
+initialData:
+  - databaseName: *database0Name
+    collectionName: *collection0Name
+    documents:
+      - &local_key_doc
+        _id: &local_key_id { $binary: { base64: bG9jYWxrZXlsb2NhbGtleQ==, subType: "04" } }
+        keyAltNames: [alternate_name, local_key]
+        keyMaterial: { $binary: { base64: ABKBldDEoDW323yejOnIRk6YQmlD9d3eQthd16scKL75nz2LjNL9fgPDZWrFFOlqlhMCFaSrNJfGrFUjYk5JFDO7soG5Syb50k1niJoKg4ilsj0L4mpimFUtTpOr2nzZOeQtvAksEXc7gsFgq8gV7t/U3lsaXPY7I0t42DfSE8EGlPdxRjFdHnxh+OR8h7U9b8Qs5K5UuhgyeyxaBZ1Hgw==, subType: "00" } }
+        creationDate: { $date: { $numberLong: "1641024000000" } }
+        updateDate: { $date: { $numberLong: "1641024000000" } }
+        status: 1
+        masterKey:
+          provider: local
+
+tests:
+  - description: remove keyAltName from non-existent data key
+    operations:
+      - name: removeKeyAltName
+        object: *clientEncryption0
+        arguments:
+          # First 3 letters of local_key_id replaced with 'A' (value: "#alkeylocalkey").
+          id: &non_existent_id { $binary: { base64: AAAjYWxrZXlsb2NhbGtleQ==, subType: "04" } }
+          keyAltName: does_not_exist
+        expectResult: { $$unsetOrMatches: null }
+    expectEvents:
+      - client: *client0
+        events:
+          - commandStartedEvent:
+              databaseName: *database0Name
+              command:
+                findAndModify: *collection0Name
+                query: { _id: *non_existent_id }
+                update: [{ $set: { keyAltNames: { $cond: [{ $eq: [$keyAltNames, [does_not_exist]] }, $$REMOVE, { $filter: { input: $keyAltNames, cond: { $ne: [$$this, does_not_exist] } } }] } } }]
+                writeConcern: { w: majority }
+    outcome:
+      - collectionName: *collection0Name
+        databaseName: *database0Name
+        documents:
+          - *local_key_doc
+
+  - description: remove non-existent keyAltName from existing data key
+    operations:
+      - name: removeKeyAltName
+        object: *clientEncryption0
+        arguments:
+          id: *local_key_id
+          keyAltName: does_not_exist
+        expectResult: *local_key_doc
+    expectEvents:
+      - client: *client0
+        events:
+          - commandStartedEvent:
+              databaseName: *database0Name
+              command:
+                findAndModify: *collection0Name
+                query: { _id: *local_key_id }
+                update: [{ $set: { keyAltNames: { $cond: [{ $eq: [$keyAltNames, [does_not_exist]] }, $$REMOVE, { $filter: { input: $keyAltNames, cond: { $ne: [$$this, does_not_exist] } } }] } } }]
+                writeConcern: { w: majority }
+    outcome:
+      - collectionName: *collection0Name
+        databaseName: *database0Name
+        documents:
+          - *local_key_doc
+
+  - description: remove an existing keyAltName from an existing data key
+    operations:
+      - name: removeKeyAltName
+        object: *clientEncryption0
+        arguments:
+          id: *local_key_id
+          keyAltName: alternate_name
+        expectResult: *local_key_doc
+      - name: find
+        object: *collection0
+        arguments:
+          filter: {}
+          projection: { _id: 0, keyAltNames: 1 }
+        expectResult:
+          - keyAltNames: [local_key]
+    expectEvents:
+      - client: *client0
+        events:
+          - commandStartedEvent:
+              databaseName: *database0Name
+              command:
+                findAndModify: *collection0Name
+                query: { _id: *local_key_id }
+                update: [{ $set: { keyAltNames: { $cond: [{ $eq: [$keyAltNames, [alternate_name]] }, $$REMOVE, { $filter: { input: $keyAltNames, cond: { $ne: [$$this, alternate_name] } } }] } } }]
+                writeConcern: { w: majority }
+          - commandStartedEvent: { commandName: find }
+
+  - description: remove the last keyAltName from an existing data key
+    operations:
+      - name: removeKeyAltName
+        object: *clientEncryption0
+        arguments:
+          id: *local_key_id
+          keyAltName: alternate_name
+        expectResult: *local_key_doc
+      - name: removeKeyAltName
+        object: *clientEncryption0
+        arguments:
+          id: *local_key_id
+          keyAltName: local_key
+        expectResult:
+          _id: *local_key_id
+          keyAltNames: [local_key]
+          keyMaterial: { $$type: binData }
+          creationDate: { $$type: date }
+          updateDate: { $$type: date }
+          status: 1
+          masterKey:
+            provider: local
+    expectEvents:
+      - client: *client0
+        events:
+          - commandStartedEvent:
+              databaseName: *database0Name
+              command:
+                findAndModify: *collection0Name
+                query: { _id: *local_key_id }
+                update: [{ $set: { keyAltNames: { $cond: [{ $eq: [$keyAltNames, [alternate_name]] }, $$REMOVE, { $filter: { input: $keyAltNames, cond: { $ne: [$$this, alternate_name] } } }] } } }]
+                writeConcern: { w: majority }
+          - commandStartedEvent:
+              databaseName: *database0Name
+              command:
+                findAndModify: *collection0Name
+                query: { _id: *local_key_id }
+                update: [{ $set: { keyAltNames: { $cond: [{ $eq: [$keyAltNames, [local_key]] }, $$REMOVE, { $filter: { input: $keyAltNames, cond: { $ne: [$$this, local_key] } } }] } } }]

data/spec/spec_tests/data/client_side_encryption/unified/rewrapManyDataKey-decrypt_failure.yml

@@ -0,0 +1,69 @@
+description: rewrapManyDataKey-decrypt_failure
+
+schemaVersion: "1.8"
+
+runOnRequirements:
+  - csfle: true
+
+createEntities:
+  - client:
+      id: &client0 client0
+      observeEvents:
+        - commandStartedEvent
+  - clientEncryption:
+      id: &clientEncryption0 clientEncryption0
+      clientEncryptionOpts:
+        keyVaultClient: *client0
+        keyVaultNamespace: keyvault.datakeys
+        kmsProviders:
+          aws: { accessKeyId: { $$placeholder: 1 }, secretAccessKey: { $$placeholder: 1 } }
+          azure: { tenantId: { $$placeholder: 1 }, clientId: { $$placeholder: 1 }, clientSecret: { $$placeholder: 1 } }
+          gcp: { email: { $$placeholder: 1 }, privateKey: { $$placeholder: 1 } }
+          kmip: { endpoint: { $$placeholder: 1 } }
+          local: { key: { $$placeholder: 1 } }
+  - database:
+      id: &database0 database0
+      client: *client0
+      databaseName: &database0Name keyvault
+  - collection:
+      id: &collection0 collection0
+      database: *database0
+      collectionName: &collection0Name datakeys
+
+initialData:
+  - databaseName: *database0Name
+    collectionName: *collection0Name
+    documents:
+      - _id: { $binary: { base64: YXdzYXdzYXdzYXdzYXdzYQ==, subType: "04" } }
+        keyAltNames: ["aws_key"]
+        keyMaterial: { $binary: { base64: AQICAHhQNmWG2CzOm1dq3kWLM+iDUZhEqnhJwH9wZVpuZ94A8gFXJqbF0Fy872MD7xl56D/2AAAAwjCBvwYJKoZIhvcNAQcGoIGxMIGuAgEAMIGoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDO7HPisPUlGzaio9vgIBEIB7/Qow46PMh/8JbEUbdXgTGhLfXPE+KIVW7T8s6YEMlGiRvMu7TV0QCIUJlSHPKZxzlJ2iwuz5yXeOag+EdY+eIQ0RKrsJ3b8UTisZYzGjfzZnxUKLzLoeXremtRCm3x47wCuHKd1dhh6FBbYt5TL2tDaj+vL2GBrKat2L, subType: "00" } }
+        creationDate: { $date: { $numberLong: "1641024000000" } }
+        updateDate: { $date: { $numberLong: "1641024000000" } }
+        status: 1
+        masterKey:
+          provider: aws
+          # "us-east-1" changed to "us-east-2" in both key and region.
+          key: arn:aws:kms:us-east-2:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0
+          region: us-east-2
+
+tests:
+  - description: "rewrap data key that fails during decryption due to invalid masterKey"
+    operations:
+      - name: rewrapManyDataKey
+        object: *clientEncryption0
+        arguments:
+          filter: {}
+          opts:
+            provider: local
+        expectError:
+          isClientError: true
+    expectEvents:
+      - client: *client0
+        events:
+          - commandStartedEvent:
+              commandName: find
+              databaseName: *database0Name
+              command:
+                find: *collection0Name
+                filter: {}
+                readConcern: { level: majority }

data/spec/spec_tests/data/client_side_encryption/unified/rewrapManyDataKey-encrypt_failure.yml

@@ -0,0 +1,122 @@
+description: rewrapManyDataKey-encrypt_failure
+
+schemaVersion: "1.8"
+
+runOnRequirements:
+  - csfle: true
+
+createEntities:
+  - client:
+      id: &client0 client0
+      observeEvents:
+        - commandStartedEvent
+  - clientEncryption:
+      id: &clientEncryption0 clientEncryption0
+      clientEncryptionOpts:
+        keyVaultClient: *client0
+        keyVaultNamespace: keyvault.datakeys
+        kmsProviders:
+          aws: { accessKeyId: { $$placeholder: 1 }, secretAccessKey: { $$placeholder: 1 } }
+          azure: { tenantId: { $$placeholder: 1 }, clientId: { $$placeholder: 1 }, clientSecret: { $$placeholder: 1 } }
+          gcp: { email: { $$placeholder: 1 }, privateKey: { $$placeholder: 1 } }
+          kmip: { endpoint: { $$placeholder: 1 } }
+          local: { key: { $$placeholder: 1 } }
+  - database:
+      id: &database0 database0
+      client: *client0
+      databaseName: &database0Name keyvault
+  - collection:
+      id: &collection0 collection0
+      database: *database0
+      collectionName: &collection0Name datakeys
+
+initialData:
+  - databaseName: *database0Name
+    collectionName: *collection0Name
+    documents:
+      - _id: { $binary: { base64: bG9jYWxrZXlsb2NhbGtleQ==, subType: "04" } }
+        keyAltNames: ["local_key"]
+        keyMaterial: { $binary: { base64: ABKBldDEoDW323yejOnIRk6YQmlD9d3eQthd16scKL75nz2LjNL9fgPDZWrFFOlqlhMCFaSrNJfGrFUjYk5JFDO7soG5Syb50k1niJoKg4ilsj0L4mpimFUtTpOr2nzZOeQtvAksEXc7gsFgq8gV7t/U3lsaXPY7I0t42DfSE8EGlPdxRjFdHnxh+OR8h7U9b8Qs5K5UuhgyeyxaBZ1Hgw==, subType: "00" } }
+        creationDate: { $date: { $numberLong: "1641024000000" } }
+        updateDate: { $date: { $numberLong: "1641024000000" } }
+        status: 1
+        masterKey:
+          provider: local
+
+tests:
+  - description: "rewrap with invalid masterKey for AWS KMS provider"
+    operations:
+      - name: rewrapManyDataKey
+        object: *clientEncryption0
+        arguments:
+          filter: {}
+          opts:
+            provider: aws
+            masterKey:
+              # "us-east-1" changed to "us-east-2" in both key and region.
+              key: arn:aws:kms:us-east-2:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0
+              region: us-east-2
+        expectError:
+          isClientError: true
+    expectEvents:
+      - client: *client0
+        events:
+          - commandStartedEvent:
+              commandName: find
+              databaseName: *database0Name
+              command:
+                find: *collection0Name
+                filter: {}
+                readConcern: { level: majority }
+
+  - description: "rewrap with invalid masterKey for Azure KMS provider"
+    operations:
+      - name: rewrapManyDataKey
+        object: *clientEncryption0
+        arguments:
+          filter: {}
+          opts:
+            provider: azure
+            masterKey:
+              # "key" changed to "invalid" in both keyVaultEndpoint and keyName.
+              keyVaultEndpoint: invalid-vault-csfle.vault.azure.net
+              keyName: invalid-name-csfle
+        expectError:
+          isClientError: true
+    expectEvents:
+      - client: *client0
+        events:
+          - commandStartedEvent:
+              commandName: find
+              databaseName: *database0Name
+              command:
+                find: *collection0Name
+                filter: {}
+                readConcern: { level: majority }
+
+  - description: "rewrap with invalid masterKey for GCP KMS provider"
+    operations:
+      - name: rewrapManyDataKey
+        object: *clientEncryption0
+        arguments:
+          filter: {}
+          opts:
+            provider: gcp
+            masterKey:
+              # "key" changed to "invalid" in both keyRing and keyName.
+              projectId: devprod-drivers
+              location: global
+              keyRing: invalid-ring-csfle
+              keyName: invalid-name-csfle
+        expectError:
+          isClientError: true
+    expectEvents:
+      - client: *client0
+        events:
+          - commandStartedEvent:
+              commandName: find
+              databaseName: *database0Name
+              command:
+                find: *collection0Name
+                filter: {}
+                readConcern: { level: majority }