mongo 2.18.3 → 2.19.0

data/spec/integration/client_side_encryption/auto_encryption_spec.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 require 'spec_helper'
 require 'bson'
@@ -29,7 +29,8 @@ describe 'Auto Encryption' do
           # Spawn mongocryptd on non-default port for sharded cluster tests
           extra_options: extra_options,
         },
-        database: 'auto_encryption'
+        database: 'auto_encryption',
+        max_pool_size: max_pool_size
       ),
     )
   end
@@ -38,6 +39,10 @@ describe 'Auto Encryption' do
 
   let(:bypass_auto_encryption) { false }
 
+  let(:max_pool_size) do
+    Mongo::Server::ConnectionPool::DEFAULT_MAX_SIZE
+  end
+
   let(:encrypted_ssn_binary) do
     BSON::Binary.new(Base64.decode64(encrypted_ssn), :ciphertext)
   end
@@ -79,6 +84,12 @@ describe 'Auto Encryption' do
     end
   end
 
+  shared_context 'limited connection pool' do
+    let(:max_pool_size) do
+      1
+    end
+  end
+
   before(:each) do
     client['users'].drop
     key_vault_collection.drop
@@ -97,6 +108,11 @@ describe 'Auto Encryption' do
       context 'with schema map' do
         include_context 'schema map in client options'
         it_behaves_like 'it performs an encrypted command'
+
+        context 'with limited connection pool' do
+          include_context 'limited connection pool'
+          it_behaves_like 'it performs an encrypted command'
+        end
       end
     end
 
@@ -111,6 +127,11 @@ describe 'Auto Encryption' do
       context 'with schema map' do
         include_context 'schema map in client options'
         it_behaves_like 'it performs an encrypted command'
+
+        context 'with limited connection pool' do
+          include_context 'limited connection pool'
+          it_behaves_like 'it performs an encrypted command'
+        end
       end
     end
 
@@ -125,6 +146,11 @@ describe 'Auto Encryption' do
       context 'with schema map' do
         include_context 'schema map in client options'
         it_behaves_like 'it performs an encrypted command'
+
+        context 'with limited connection pool' do
+          include_context 'limited connection pool'
+          it_behaves_like 'it performs an encrypted command'
+        end
       end
     end
 
@@ -139,6 +165,11 @@ describe 'Auto Encryption' do
       context 'with schema map' do
         include_context 'schema map in client options'
         it_behaves_like 'it performs an encrypted command'
+
+        context 'with limited connection pool' do
+          include_context 'limited connection pool'
+          it_behaves_like 'it performs an encrypted command'
+        end
       end
     end
 
@@ -153,6 +184,11 @@ describe 'Auto Encryption' do
       context 'with schema map' do
         include_context 'schema map in client options'
         it_behaves_like 'it performs an encrypted command'
+
+        context 'with limited connection pool' do
+          include_context 'limited connection pool'
+          it_behaves_like 'it performs an encrypted command'
+        end
       end
     end
   end

data/spec/integration/client_side_encryption/automatic_data_encryption_keys_prose_spec.rb

@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'Client-Side Encryption' do
+  describe 'Automatic Data Encryption Keys' do
+    require_libmongocrypt
+    require_enterprise
+    require_topology :replica_set, :sharded, :load_balanced
+    min_server_version '7.0.0-rc0'
+
+    include_context 'define shared FLE helpers'
+
+    let(:test_database_name) do
+      'automatic_data_encryption_keys'
+    end
+
+    let(:key_vault_client) do
+      ClientRegistry.instance.new_local_client(SpecConfig.instance.addresses)
+    end
+
+    let(:client_encryption) do
+      Mongo::ClientEncryption.new(
+        key_vault_client,
+        kms_tls_options: kms_tls_options,
+        key_vault_namespace: key_vault_namespace,
+        kms_providers: {
+          local: {
+            key: local_master_key
+          },
+          aws: {
+            access_key_id: SpecConfig.instance.fle_aws_key,
+            secret_access_key: SpecConfig.instance.fle_aws_secret,
+          }
+        }
+      )
+    end
+
+    let(:database) do
+      authorized_client.use(test_database_name).database
+    end
+
+    before do
+      authorized_client.use(key_vault_db)[key_vault_coll].drop
+      authorized_client.use(test_database_name).database.drop
+    end
+
+    shared_examples 'creates data keys automatically' do
+      let(:opts) do
+        { encrypted_fields: { fields: [ field ] } }
+      end
+
+      context 'when insert unencrypted value' do
+        let(:field) do
+          {
+            path: 'ssn',
+            bsonType: 'string',
+            keyId: nil
+          }
+        end
+
+        it 'fails document validation' do
+          client_encryption.create_encrypted_collection(
+            database, 'testing1', opts, kms_provider, master_key
+          )
+          expect { database['testing1'].insert_one(ssn: '123-45-6789') }
+            .to raise_error(Mongo::Error::OperationFailure, /Document failed validation/)
+        end
+      end
+
+      it 'fails when missing encrypted field' do
+        expect do
+          client_encryption.create_encrypted_collection(
+            database, 'testing1', {}, kms_provider, master_key
+          )
+        end.to raise_error(ArgumentError, /coll_opts must contain :encrypted_fields/)
+      end
+
+      context 'when invalid keyId provided' do
+        let(:field) do
+          {
+            path: 'ssn',
+            bsonType: 'string',
+            keyId: false
+          }
+        end
+
+        it 'fails' do
+          expect do
+            client_encryption.create_encrypted_collection(
+              database, 'testing1', opts, kms_provider, master_key
+            )
+          end.to raise_error(Mongo::Error::CryptError, /keyId' is the wrong type/)
+        end
+      end
+
+      context 'when configured correctly' do
+        let(:field) do
+          {
+            path: 'ssn',
+            bsonType: 'string',
+            keyId: nil
+          }
+        end
+
+        let(:new_encrypted_fields) do
+          _, new_encrypted_fields = client_encryption.create_encrypted_collection(
+            database, 'testing1', opts, kms_provider, master_key
+          )
+
+          new_encrypted_fields
+        end
+
+        let(:key_id) do
+          new_encrypted_fields[:fields].first[:keyId]
+        end
+
+        let(:encrypted_payload) do
+          client_encryption.encrypt(
+            '123-45-6789',
+            key_id: key_id,
+            algorithm: 'Unindexed'
+          )
+        end
+
+        it 'successfully inserts encrypted value' do
+          expect do
+            database['testing1'].insert_one(ssn: encrypted_payload)
+          end.not_to raise_error
+        end
+      end
+    end
+
+    context 'with aws' do
+      let(:kms_provider) { 'aws' }
+      let(:master_key) do
+        {
+          region: 'us-east-1',
+          key: 'arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0'
+        }
+      end
+
+      it_behaves_like 'creates data keys automatically'
+    end
+
+    context 'with local' do
+      let(:kms_provider) { 'local' }
+      let(:master_key) { { key: local_master_key } }
+
+      it_behaves_like 'creates data keys automatically'
+    end
+  end
+end

data/spec/integration/client_side_encryption/bson_size_limit_spec.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 require 'spec_helper'
 

data/spec/integration/client_side_encryption/bypass_mongocryptd_spawn_spec.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 require 'spec_helper'
 

data/spec/integration/client_side_encryption/client_close_spec.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 require 'spec_helper'
 

data/spec/integration/client_side_encryption/corpus_spec.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 require 'spec_helper'
 

data/spec/integration/client_side_encryption/custom_endpoint_spec.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 require 'spec_helper'
 
@@ -119,11 +119,11 @@ describe 'Client-Side Encryption' do
 
     context 'with region, key, and endpoint at incorrect domain' do
       let(:master_key) do
-        master_key_template.merge({endpoint: "example.com"})
+        master_key_template.merge({endpoint: "doesnotexist.invalid"})
       end
 
       let(:error_regex) do
-        /parse error/
+        /SocketError: getaddrinfo:/
       end
 
       it_behaves_like 'raising a KMS error'

data/spec/integration/client_side_encryption/data_key_spec.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 require 'spec_helper'
 

data/spec/integration/client_side_encryption/decryption_events_prose_spec.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# encoding: utf-8
 
 require 'spec_helper'
 
@@ -9,13 +8,13 @@ describe 'Decryption events' do
   require_libmongocrypt
   include_context 'define shared FLE helpers'
   require_topology :replica_set
-
+  min_server_version '7.0.0-rc0'
 
   let(:setup_client) do
     ClientRegistry.instance.new_local_client(
       SpecConfig.instance.addresses,
       SpecConfig.instance.test_options.merge(
-        database: SpecConfig.instance.test_db,
+        database: SpecConfig.instance.test_db
       )
     )
   end
@@ -65,7 +64,7 @@ describe 'Decryption events' do
         },
         database: SpecConfig.instance.test_db,
         retry_reads: false,
-        max_read_retries: 0,
+        max_read_retries: 0
       )
     )
   end
@@ -76,7 +75,36 @@ describe 'Decryption events' do
 
   let(:subscriber) { Mrss::EventSubscriber.new }
 
-  before(:each) do
+  let(:command_error) do
+    {
+      'configureFailPoint' => 'failCommand',
+      'mode' => { 'times' => 1 },
+      'data' => {
+        'errorCode' => 123,
+        'failCommands' => [ 'aggregate' ]
+      }
+    }
+  end
+
+  let(:network_error) do
+    {
+      'configureFailPoint' => 'failCommand',
+      'mode' => { 'times' => 1 },
+      'data' => {
+        'errorCode' => 123,
+        'closeConnection' => true,
+        'failCommands' => [ 'aggregate' ]
+      }
+    }
+  end
+
+  let(:aggregate_event) do
+    subscriber.succeeded_events.detect do |evt|
+      evt.command_name == 'aggregate'
+    end
+  end
+
+  before do
     setup_client[collection_name].drop
     setup_client[collection_name].create
 
@@ -84,75 +112,48 @@ describe 'Decryption events' do
   end
 
   it 'tests command error' do
-    setup_client.use(:admin).command(
-      {
-        "configureFailPoint" => "failCommand",
-        "mode" => {
-            "times" => 1
-        },
-        "data" => {
-            "errorCode" => 123,
-            "failCommands" => [
-                "aggregate"
-            ]
-        }
-      }
-    )
+    setup_client.use(:admin).command(command_error)
 
     expect do
       collection.aggregate([]).to_a
     end.to raise_error(Mongo::Error::OperationFailure, /Failing command (?:via|due to) 'failCommand' failpoint/)
-    expect(subscriber.failed_events.length).to eql(1)
+    expect(subscriber.failed_events.length).to be 1
   end
 
   it 'tests network error' do
-    setup_client.use(:admin).command(
-      {
-        "configureFailPoint" => "failCommand",
-        "mode" => {
-            "times" => 1
-        },
-        "data" => {
-            "errorCode" => 123,
-            "closeConnection": true,
-            "failCommands" => [
-                "aggregate"
-            ]
-        }
-      }
-    )
+    setup_client.use(:admin).command(network_error)
 
     expect do
       collection.aggregate([]).to_a
     end.to raise_error(Mongo::Error::SocketError)
-    expect(subscriber.failed_events.length).to eql(1)
+    expect(subscriber.failed_events.length).to be 1
   end
 
-  it 'tests decrypt error' do
-    collection.insert_one(encrypted: malformed_ciphertext)
-    expect do
-      collection.aggregate([]).to_a
-    end.to raise_error(Mongo::Error::CryptError)
-    aggregate_event = subscriber.succeeded_events.detect do |evt|
-      evt.command_name == 'aggregate'
+  context 'when decrypt error' do
+    before do
+      collection.insert_one(encrypted: malformed_ciphertext)
+    end
+
+    it 'fails' do
+      expect { collection.aggregate([]).to_a }.to raise_error(Mongo::Error::CryptError)
+      expect(aggregate_event).not_to be_nil
+      expect(
+        aggregate_event.reply.dig('cursor', 'firstBatch')&.first&.dig('encrypted')
+      ).to be_a(BSON::Binary)
     end
-    expect(aggregate_event).not_to be_nil
-    expect(
-      aggregate_event.reply.dig('cursor', 'firstBatch')&.first&.dig('encrypted')
-    ).to be_a_kind_of(BSON::Binary)
   end
 
-  it 'tests decrypt success' do
-    collection.insert_one(encrypted: ciphertext)
-    expect do
-      collection.aggregate([]).to_a
-    end.not_to raise_error
-    aggregate_event = subscriber.succeeded_events.detect do |evt|
-      evt.command_name == 'aggregate'
+  context 'when decrypt success' do
+    before do
+      collection.insert_one(encrypted: ciphertext)
+    end
+
+    it 'succeeds' do
+      expect { collection.aggregate([]).to_a }.not_to raise_error
+      expect(aggregate_event).not_to be_nil
+      expect(
+        aggregate_event.reply.dig('cursor', 'firstBatch')&.first&.dig('encrypted')
+      ).to be_a(BSON::Binary)
     end
-    expect(aggregate_event).not_to be_nil
-    expect(
-      aggregate_event.reply.dig('cursor', 'firstBatch')&.first&.dig('encrypted')
-    ).to be_a_kind_of(BSON::Binary)
   end
 end

data/spec/integration/client_side_encryption/explicit_encryption_spec.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 require 'spec_helper'
 

data/spec/integration/client_side_encryption/explicit_queryable_encryption_spec.rb

@@ -1,11 +1,13 @@
 # frozen_string_literal: true
-# encoding: utf-8
 
 require 'spec_helper'
 
+# No need to rewrite existing specs to make the examples shorter, until/unless
+# we revisit these specs and need to make substantial changes.
+# rubocop:disable RSpec/ExampleLength
 describe 'Explicit Queryable Encryption' do
   require_libmongocrypt
-  min_server_version '6.0.0-rc8'
+  min_server_version '7.0.0-rc0'
   require_topology :replica_set, :sharded, :load_balanced
 
   include_context 'define shared FLE helpers'
@@ -19,11 +21,11 @@ describe 'Explicit Queryable Encryption' do
   end
 
   let(:value) do
-    "encrypted indexed value"
+    'encrypted indexed value'
   end
 
   let(:unindexed_value) do
-    "encrypted unindexed value"
+    'encrypted unindexed value'
   end
 
   let(:key_vault_client) do
@@ -57,81 +59,81 @@ describe 'Explicit Queryable Encryption' do
     )
   end
 
-  before(:each) do
+  before do
     authorized_client[encrypted_coll].drop(encrypted_fields: encrypted_fields)
     authorized_client[encrypted_coll].create(encrypted_fields: encrypted_fields)
     authorized_client.use(key_vault_db)[key_vault_coll].drop
-    authorized_client.use(key_vault_db)[key_vault_coll, write_concern: {w: :majority}].insert_one(key1_document)
+    authorized_client.use(key_vault_db)[key_vault_coll, write_concern: { w: :majority }].insert_one(key1_document)
   end
 
-  after(:each) do
+  after do
     authorized_client[encrypted_coll].drop(encrypted_fields: encrypted_fields)
     authorized_client.use(key_vault_db)[key_vault_coll].drop
   end
 
   it 'can insert encrypted indexed and find' do
     insert_payload = client_encryption.encrypt(
-      value, key_id: key1_id, algorithm: "Indexed", contention_factor: 0
+      value, key_id: key1_id, algorithm: 'Indexed', contention_factor: 0
     )
     encrypted_client[encrypted_coll].insert_one(
-      "encryptedIndexed" => insert_payload
+      'encryptedIndexed' => insert_payload
     )
     find_payload = client_encryption.encrypt(
-      value, key_id: key1_id, algorithm: "Indexed", query_type: "equality", contention_factor: 0
+      value, key_id: key1_id, algorithm: 'Indexed', query_type: 'equality', contention_factor: 0
     )
     find_results = encrypted_client[encrypted_coll]
-      .find("encryptedIndexed" => find_payload)
-      .to_a
+                   .find('encryptedIndexed' => find_payload)
+                   .to_a
     expect(find_results.size).to eq(1)
-    expect(find_results.first["encryptedIndexed"]).to eq(value)
+    expect(find_results.first['encryptedIndexed']).to eq(value)
   end
 
   it 'can insert encrypted indexed and find with non-zero contention' do
     10.times do
       insert_payload = client_encryption.encrypt(
-        value, key_id: key1_id, algorithm: "Indexed", contention_factor: 10
+        value, key_id: key1_id, algorithm: 'Indexed', contention_factor: 10
       )
       encrypted_client[encrypted_coll].insert_one(
-        "encryptedIndexed" => insert_payload
+        'encryptedIndexed' => insert_payload
       )
     end
     find_payload = client_encryption.encrypt(
-      value, key_id: key1_id, algorithm: "Indexed", query_type: "equality", contention_factor: 0
+      value, key_id: key1_id, algorithm: 'Indexed', query_type: 'equality', contention_factor: 0
     )
     find_results = encrypted_client[encrypted_coll]
-      .find("encryptedIndexed" => find_payload)
-      .to_a
+                   .find('encryptedIndexed' => find_payload)
+                   .to_a
     expect(find_results.size).to be < 10
     find_results.each do |doc|
-      expect(doc["encryptedIndexed"]).to eq(value)
+      expect(doc['encryptedIndexed']).to eq(value)
     end
-    find_payload_2 = client_encryption.encrypt(
-      value, key_id: key1_id, algorithm: "Indexed", query_type: "equality", contention_factor: 10
+    find_payload2 = client_encryption.encrypt(
+      value, key_id: key1_id, algorithm: 'Indexed', query_type: 'equality', contention_factor: 10
     )
-    find_results_2 = encrypted_client[encrypted_coll]
-      .find("encryptedIndexed" => find_payload_2)
-      .to_a
-    expect(find_results_2.size).to eq(10)
-    find_results_2.each do |doc|
-      expect(doc["encryptedIndexed"]).to eq(value)
+    find_results2 = encrypted_client[encrypted_coll]
+                    .find('encryptedIndexed' => find_payload2)
+                    .to_a
+    expect(find_results2.size).to eq(10)
+    find_results2.each do |doc|
+      expect(doc['encryptedIndexed']).to eq(value)
     end
   end
 
   it 'can insert encrypted unindexed' do
     insert_payload = client_encryption.encrypt(
-      unindexed_value, key_id: key1_id, algorithm: "Unindexed"
+      unindexed_value, key_id: key1_id, algorithm: 'Unindexed'
     )
     encrypted_client[encrypted_coll].insert_one(
-      "_id" => 1, "encryptedUnindexed" => insert_payload
+      '_id' => 1, 'encryptedUnindexed' => insert_payload
     )
-    find_results = encrypted_client[encrypted_coll].find("_id" => 1).to_a
+    find_results = encrypted_client[encrypted_coll].find('_id' => 1).to_a
     expect(find_results.size).to eq(1)
-    expect(find_results.first["encryptedUnindexed"]).to eq(unindexed_value)
+    expect(find_results.first['encryptedUnindexed']).to eq(unindexed_value)
   end
 
   it 'can roundtrip encrypted indexed' do
     payload = client_encryption.encrypt(
-      value, key_id: key1_id, algorithm: "Indexed", contention_factor: 0
+      value, key_id: key1_id, algorithm: 'Indexed', contention_factor: 0
     )
     decrypted_value = client_encryption.decrypt(payload)
     expect(decrypted_value).to eq(value)
@@ -139,9 +141,10 @@ describe 'Explicit Queryable Encryption' do
 
   it 'can roundtrip encrypted unindexed' do
     payload = client_encryption.encrypt(
-      unindexed_value, key_id: key1_id, algorithm: "Unindexed"
+      unindexed_value, key_id: key1_id, algorithm: 'Unindexed'
     )
     decrypted_value = client_encryption.decrypt(payload)
     expect(decrypted_value).to eq(unindexed_value)
   end
 end
+# rubocop:enable RSpec/ExampleLength

data/spec/integration/client_side_encryption/external_key_vault_spec.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 require 'spec_helper'
 

data/spec/integration/client_side_encryption/kms_tls_options_spec.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 require 'spec_helper'
 
@@ -216,7 +216,7 @@ describe 'Client-Side Encryption' do
                 master_key: master_key_template.merge({endpoint: "127.0.0.1:8002"})
               }
             )
-          end.to raise_error(Mongo::Error::KmsError, /(SocketError|ECONNRESET)/)
+          end.to raise_error(Mongo::Error::KmsError, /(certificate_required|SocketError|ECONNRESET)/)
         end
       end
 
@@ -286,7 +286,7 @@ describe 'Client-Side Encryption' do
                 master_key: master_key
              }
             )
-          end.to raise_error(Mongo::Error::KmsError, /(SocketError|ECONNRESET)/)
+          end.to raise_error(Mongo::Error::KmsError, /(certificate_required|SocketError|ECONNRESET)/)
         end
       end
 

data/spec/integration/client_side_encryption/kms_tls_spec.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 require 'spec_helper'