mongo 2.23.0 → 2.24.0

data/lib/mongo/crypt/hooks.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2020 MongoDB Inc.
 #
@@ -20,14 +19,12 @@ require 'digest'
 
 module Mongo
   module Crypt
-
     # A helper module that implements cryptography methods required
     # for native Ruby crypto hooks. These methods are passed into FFI
     # as C callbacks and called from the libmongocrypt library.
     #
     # @api private
     module Hooks
-
       # An AES encrypt or decrypt method.
       #
       # @param [ String ] key The 32-byte AES encryption key
@@ -48,7 +45,7 @@ module Mongo
         cipher.iv = iv
         cipher.padding = 0
 
-        encrypted = cipher.update(input)
+        cipher.update(input)
       end
       module_function :aes
 
@@ -98,17 +95,17 @@ module Mongo
       # @return [ String ] The signature.
       def rsaes_pkcs_signature(key, input)
         private_key = if BSON::Environment.jruby?
-          # JRuby cannot read DER format, we need to convert key into PEM first.
-          key_pem = [
-            "-----BEGIN PRIVATE KEY-----",
-            Base64.strict_encode64(Base64.decode64(key)).scan(/.{1,64}/),
-            "-----END PRIVATE KEY-----",
-          ].join("\n")
-          OpenSSL::PKey::RSA.new(key_pem)
-        else
-          OpenSSL::PKey.read(Base64.decode64(key))
-        end
-        private_key.sign(OpenSSL::Digest::SHA256.new, input)
+                        # JRuby cannot read DER format, we need to convert key into PEM first.
+                        key_pem = [
+                          '-----BEGIN PRIVATE KEY-----',
+                          Base64.strict_encode64(Base64.decode64(key)).scan(/.{1,64}/),
+                          '-----END PRIVATE KEY-----',
+                        ].join("\n")
+                        OpenSSL::PKey::RSA.new(key_pem)
+                      else
+                        OpenSSL::PKey.read(Base64.decode64(key))
+                      end
+        private_key.sign(OpenSSL::Digest.new('SHA256'), input)
       end
       module_function :rsaes_pkcs_signature
     end

data/lib/mongo/crypt/kms/aws/credentials.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #
@@ -19,7 +18,6 @@ module Mongo
   module Crypt
     module KMS
       module AWS
-
         # AWS KMS Credentials object contains credentials for using AWS KMS provider.
         #
         # @api private
@@ -39,8 +37,8 @@ module Mongo
           # @api private
           def_delegator :@opts, :empty?
 
-          FORMAT_HINT = "AWS KMS provider options must be in the format: " +
-            "{ access_key_id: 'YOUR-ACCESS-KEY-ID', secret_access_key: 'SECRET-ACCESS-KEY' }"
+          FORMAT_HINT = 'AWS KMS provider options must be in the format: ' +
+                        "{ access_key_id: 'YOUR-ACCESS-KEY-ID', secret_access_key: 'SECRET-ACCESS-KEY' }"
 
           # Creates an AWS KMS credentials object form a parameters hash.
           #
@@ -54,11 +52,11 @@ module Mongo
           #   formatted.
           def initialize(opts)
             @opts = opts
-            unless empty?
-              @access_key_id = validate_param(:access_key_id, opts, FORMAT_HINT)
-              @secret_access_key = validate_param(:secret_access_key, opts, FORMAT_HINT)
-              @session_token = validate_param(:session_token, opts, FORMAT_HINT, required: false)
-            end
+            return if empty?
+
+            @access_key_id = validate_param(:access_key_id, opts, FORMAT_HINT)
+            @secret_access_key = validate_param(:secret_access_key, opts, FORMAT_HINT)
+            @session_token = validate_param(:session_token, opts, FORMAT_HINT, required: false)
           end
 
           # Convert credentials object to a BSON document in libmongocrypt format.
@@ -66,13 +64,12 @@ module Mongo
           # @return [ BSON::Document ] AWS KMS credentials in libmongocrypt format.
           def to_document
             return BSON::Document.new if empty?
+
             BSON::Document.new({
-              accessKeyId: access_key_id,
-              secretAccessKey: secret_access_key,
-            }).tap do |bson|
-              unless session_token.nil?
-                bson.update({ sessionToken: session_token })
-              end
+                                 accessKeyId: access_key_id,
+                                 secretAccessKey: secret_access_key,
+                               }).tap do |bson|
+              bson.update({ sessionToken: session_token }) unless session_token.nil?
             end
           end
         end
@@ -80,4 +77,3 @@ module Mongo
     end
   end
 end
-

data/lib/mongo/crypt/kms/aws/master_document.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #
@@ -34,7 +33,7 @@ module Mongo
           # @return [ String | nil ] AWS KMS endpoint.
           attr_reader :endpoint
 
-          FORMAT_HINT = "AWS key document  must be in the format: " +
+          FORMAT_HINT = 'AWS key document  must be in the format: ' +
                         "{ region: 'REGION', key: 'KEY' }"
 
           # Creates a master key document object form a parameters hash.
@@ -62,13 +61,11 @@ module Mongo
           # @return [ BSON::Document ] AWS KMS master key document in libmongocrypt format.
           def to_document
             BSON::Document.new({
-              provider: 'aws',
-              region: region,
-              key: key,
-            }).tap do |bson|
-              unless endpoint.nil?
-                bson.update({ endpoint: endpoint })
-              end
+                                 provider: 'aws',
+                                 region: region,
+                                 key: key,
+                               }).tap do |bson|
+              bson.update({ endpoint: endpoint }) unless endpoint.nil?
             end
           end
         end

data/lib/mongo/crypt/kms/aws.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #
@@ -17,4 +16,3 @@
 
 require 'mongo/crypt/kms/aws/credentials'
 require 'mongo/crypt/kms/aws/master_document'
-

data/lib/mongo/crypt/kms/azure/credentials_retriever.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #
@@ -73,7 +72,7 @@ module Mongo
             req['Metadata'] = 'true'
             req['Accept'] = 'application/json'
             extra_headers.each { |k, v| req[k] = v }
-            [uri, req]
+            [ uri, req ]
           end
           private_class_method :prepare_request
 
@@ -116,11 +115,7 @@ module Mongo
           def self.do_request(uri, req, timeout_holder)
             timeout_holder&.check_timeout!
             timeout = timeout_holder&.remaining_timeout_sec || 10
-            exception_class = if timeout_holder&.csot?
-                                Error::TimeoutError
-                              else
-                                nil
-                              end
+            exception_class = (Error::TimeoutError if timeout_holder&.csot?)
             ::Timeout.timeout(timeout, exception_class) do
               Net::HTTP.start(uri.hostname, uri.port, use_ssl: false) do |http|
                 http.request(req)

data/lib/mongo/crypt/kms/azure/master_document.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #
@@ -34,18 +33,18 @@ module Mongo
           # @return [ String | nil ] Azure KMS key version.
           attr_reader :key_version
 
-          FORMAT_HINT = "Azure key document  must be in the format: " +
+          FORMAT_HINT = 'Azure key document  must be in the format: ' +
                         "{ key_vault_endpoint: 'KEY_VAULT_ENDPOINT', key_name: 'KEY_NAME' }"
 
-        # Creates a master key document object form a parameters hash.
-        #
-        # @param [ Hash ] opts A hash that contains master key options for
-        #   the Azure KMS provider.
-        # @option opts [ String ] :key_vault_endpoint Azure key vault endpoint.
-        # @option opts [ String ] :key_name Azure KMS key name.
-        # @option opts [ String | nil ] :key_version Azure KMS key version, optional.
-        #
-        # @raise [ ArgumentError ] If required options are missing or incorrectly.
+          # Creates a master key document object form a parameters hash.
+          #
+          # @param [ Hash ] opts A hash that contains master key options for
+          #   the Azure KMS provider.
+          # @option opts [ String ] :key_vault_endpoint Azure key vault endpoint.
+          # @option opts [ String ] :key_name Azure KMS key name.
+          # @option opts [ String | nil ] :key_version Azure KMS key version, optional.
+          #
+          # @raise [ ArgumentError ] If required options are missing or incorrectly.
           def initialize(opts)
             unless opts.is_a?(Hash)
               raise ArgumentError.new(
@@ -62,13 +61,11 @@ module Mongo
           # @return [ BSON::Document ] Azure KMS credentials in libmongocrypt format.
           def to_document
             BSON::Document.new({
-              provider: 'azure',
-              keyVaultEndpoint: key_vault_endpoint,
-              keyName: key_name,
-            }).tap do |bson|
-              unless key_version.nil?
-                bson.update({ keyVersion: key_version })
-              end
+                                 provider: 'azure',
+                                 keyVaultEndpoint: key_vault_endpoint,
+                                 keyName: key_name,
+                               }).tap do |bson|
+              bson.update({ keyVersion: key_version }) unless key_version.nil?
             end
           end
         end
@@ -76,4 +73,3 @@ module Mongo
     end
   end
 end
-

data/lib/mongo/crypt/kms/azure.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #

data/lib/mongo/crypt/kms/credentials.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #
@@ -18,12 +17,10 @@
 module Mongo
   module Crypt
     module KMS
-
       # KMS Credentials object contains credentials for using KMS providers.
       #
       # @api private
       class Credentials
-
         # @return [ Credentials::AWS | nil ] AWS KMS credentials.
         attr_reader :aws
 
@@ -52,30 +49,19 @@ module Mongo
         # @raise [ ArgumentError ] If required options are missing or incorrectly
         #   formatted.
         def initialize(kms_providers)
-          if kms_providers.nil?
-            raise ArgumentError.new("KMS providers options must not be nil")
-          end
-          if kms_providers.key?(:aws)
-            @aws = AWS::Credentials.new(kms_providers[:aws])
-          end
-          if kms_providers.key?(:azure)
-            @azure = Azure::Credentials.new(kms_providers[:azure])
-          end
-          if kms_providers.key?(:gcp)
-            @gcp = GCP::Credentials.new(kms_providers[:gcp])
-          end
-          if kms_providers.key?(:kmip)
-            @kmip = KMIP::Credentials.new(kms_providers[:kmip])
-          end
-          if kms_providers.key?(:local)
-            @local = Local::Credentials.new(kms_providers[:local])
-          end
-          if @aws.nil? && @azure.nil? && @gcp.nil? && @kmip.nil? && @local.nil?
-            raise ArgumentError.new(
-              "KMS providers options must have one of the following keys: " +
-              ":aws, :azure, :gcp, :kmip, :local"
-            )
-          end
+          raise ArgumentError.new('KMS providers options must not be nil') if kms_providers.nil?
+
+          @aws = AWS::Credentials.new(kms_providers[:aws]) if kms_providers.key?(:aws)
+          @azure = Azure::Credentials.new(kms_providers[:azure]) if kms_providers.key?(:azure)
+          @gcp = GCP::Credentials.new(kms_providers[:gcp]) if kms_providers.key?(:gcp)
+          @kmip = KMIP::Credentials.new(kms_providers[:kmip]) if kms_providers.key?(:kmip)
+          @local = Local::Credentials.new(kms_providers[:local]) if kms_providers.key?(:local)
+          return unless @aws.nil? && @azure.nil? && @gcp.nil? && @kmip.nil? && @local.nil?
+
+          raise ArgumentError.new(
+            'KMS providers options must have one of the following keys: ' +
+            ':aws, :azure, :gcp, :kmip, :local'
+          )
         end
 
         # Convert credentials object to a BSON document in libmongocrypt format.

data/lib/mongo/crypt/kms/gcp/credentials.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #
@@ -42,8 +41,8 @@ module Mongo
           # @api private
           def_delegator :@opts, :empty?
 
-          FORMAT_HINT = "GCP KMS provider options must be in the format: " +
-              "{ email: 'EMAIL', private_key: 'PRIVATE-KEY' }"
+          FORMAT_HINT = 'GCP KMS provider options must be in the format: ' +
+                        "{ email: 'EMAIL', private_key: 'PRIVATE-KEY' }"
 
           # Creates an GCP KMS credentials object form a parameters hash.
           #
@@ -77,10 +76,10 @@ module Mongo
                   pkey = OpenSSL::PKey::RSA.new(private_key_opt)
                   # PEM it is, need to be converted to base64 encoded DER.
                   der = if pkey.respond_to?(:private_to_der)
-                    pkey.private_to_der
-                  else
-                    pkey.to_der
-                  end
+                          pkey.private_to_der
+                        else
+                          pkey.to_der
+                        end
                   Base64.encode64(der)
                 end
               rescue OpenSSL::PKey::RSAError
@@ -91,7 +90,7 @@ module Mongo
                   private_key_opt
                 rescue OpenSSL::PKey::PKeyError
                   raise ArgumentError.new(
-                    "The private_key option must be either either base64 encoded DER format, or PEM format."
+                    'The private_key option must be either either base64 encoded DER format, or PEM format.'
                   )
                 end
               end
@@ -107,16 +106,15 @@ module Mongo
           # @return [ BSON::Document ] Azure KMS credentials in libmongocrypt format.
           def to_document
             return BSON::Document.new if empty?
+
             if access_token
               BSON::Document.new({ accessToken: access_token })
             else
               BSON::Document.new({
-                email: email,
-                privateKey: BSON::Binary.new(private_key, :generic),
-              }).tap do |bson|
-                unless endpoint.nil?
-                  bson.update({ endpoint: endpoint })
-                end
+                                   email: email,
+                                   privateKey: BSON::Binary.new(private_key, :generic),
+                                 }).tap do |bson|
+                bson.update({ endpoint: endpoint }) unless endpoint.nil?
               end
             end
           end

data/lib/mongo/crypt/kms/gcp/credentials_retriever.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #
@@ -19,7 +18,7 @@ module Mongo
   module Crypt
     module KMS
       module GCP
-        # This class retrieves GPC credentials using Google Compute Engine
+        # This class retrieves GCP credentials using Google Compute Engine
         # metadata host. This should be used when the driver is used on the
         # Google Compute Engine instance.
         #
@@ -45,22 +44,22 @@ module Mongo
             resp = fetch_response(uri, req, timeout_holder)
             if resp.code != '200'
               raise KMS::CredentialsNotFound,
-                "GCE metadata host responded with code #{resp.code}"
+                    "GCE metadata host responded with code #{resp.code}"
             end
             parsed_resp = JSON.parse(resp.body)
             parsed_resp.fetch('access_token')
           rescue JSON::ParserError, KeyError => e
             raise KMS::CredentialsNotFound,
-              "GCE metadata response is invalid: '#{resp.body}'; #{e.class}: #{e.message}"
-            rescue ::Timeout::Error, IOError, SystemCallError, SocketError => e
-              raise KMS::CredentialsNotFound,
-                    "Could not receive GCP metadata response; #{e.class}: #{e.message}"
+                  "GCE metadata response is invalid: '#{resp.body}'; #{e.class}: #{e.message}"
+          rescue ::Timeout::Error, IOError, SystemCallError, SocketError => e
+            raise KMS::CredentialsNotFound,
+                  "Could not receive GCP metadata response; #{e.class}: #{e.message}"
           end
 
           def self.fetch_response(uri, req, timeout_holder)
             timeout_holder&.check_timeout!
             if timeout_holder&.timeout?
-              ::Timeout.timeout(timeout_holder.remaining_timeout_sec, Error:TimeoutError) do
+              ::Timeout.timeout(timeout_holder.remaining_timeout_sec, Error: TimeoutError) do
                 do_fetch(uri, req)
               end
             else
@@ -80,4 +79,3 @@ module Mongo
     end
   end
 end
-

data/lib/mongo/crypt/kms/gcp/master_document.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #
@@ -43,9 +42,9 @@ module Mongo
           # @return [ String | nil ] GCP KMS endpoint.
           attr_reader :endpoint
 
-          FORMAT_HINT = "GCP key document  must be in the format: " +
-            "{ project_id: 'PROJECT_ID', location: 'LOCATION', " +
-            "key_ring: 'KEY-RING', key_name: 'KEY-NAME' }"
+          FORMAT_HINT = 'GCP key document  must be in the format: ' +
+                        "{ project_id: 'PROJECT_ID', location: 'LOCATION', " +
+                        "key_ring: 'KEY-RING', key_name: 'KEY-NAME' }"
 
           # Creates a master key document object form a parameters hash.
           #
@@ -77,19 +76,16 @@ module Mongo
           # @return [ BSON::Document ] GCP KMS credentials in libmongocrypt format.
           def to_document
             return BSON::Document.new({}) if @empty
+
             BSON::Document.new({
-              provider: 'gcp',
-              projectId: project_id,
-              location: location,
-              keyRing: key_ring,
-              keyName: key_name
-            }).tap do |bson|
-              unless key_version.nil?
-                bson.update({ keyVersion: key_version })
-              end
-              unless endpoint.nil?
-                bson.update({ endpoint: endpoint })
-              end
+                                 provider: 'gcp',
+                                 projectId: project_id,
+                                 location: location,
+                                 keyRing: key_ring,
+                                 keyName: key_name
+                               }).tap do |bson|
+              bson.update({ keyVersion: key_version }) unless key_version.nil?
+              bson.update({ endpoint: endpoint }) unless endpoint.nil?
             end
           end
         end

data/lib/mongo/crypt/kms/gcp.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #
@@ -18,4 +17,3 @@
 require 'mongo/crypt/kms/gcp/credentials'
 require 'mongo/crypt/kms/gcp/credentials_retriever'
 require 'mongo/crypt/kms/gcp/master_document'
-

data/lib/mongo/crypt/kms/kmip/credentials.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #
@@ -33,7 +32,7 @@ module Mongo
           # @api private
           def_delegator :@opts, :empty?
 
-          FORMAT_HINT = "KMIP KMS provider options must be in the format: " +
+          FORMAT_HINT = 'KMIP KMS provider options must be in the format: ' +
                         "{ endpoint: 'ENDPOINT' }"
 
           # Creates a KMIP KMS credentials object form a parameters hash.
@@ -46,9 +45,9 @@ module Mongo
           #   formatted.
           def initialize(opts)
             @opts = opts
-            unless empty?
-              @endpoint = validate_param(:endpoint, opts, FORMAT_HINT)
-            end
+            return if empty?
+
+            @endpoint = validate_param(:endpoint, opts, FORMAT_HINT)
           end
 
           # Convert credentials object to a BSON document in libmongocrypt format.
@@ -56,13 +55,13 @@ module Mongo
           # @return [ BSON::Document ] Local KMS credentials in libmongocrypt format.
           def to_document
             return BSON::Document.new({}) if empty?
+
             BSON::Document.new({
-              endpoint: endpoint,
-            })
+                                 endpoint: endpoint,
+                               })
           end
         end
       end
     end
   end
 end
-

data/lib/mongo/crypt/kms/kmip/master_document.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #
@@ -32,7 +31,7 @@ module Mongo
           # @return [ String | nil ] KMIP KMS endpoint with optional port.
           attr_reader :endpoint
 
-          FORMAT_HINT = "KMIP KMS key document must be in the format: " +
+          FORMAT_HINT = 'KMIP KMS key document must be in the format: ' +
                         "{ key_id: 'KEY-ID', endpoint: 'ENDPOINT' }"
 
           # Creates a master key document object form a parameters hash.
@@ -60,8 +59,8 @@ module Mongo
           # @return [ BSON::Document ] KMIP KMS credentials in libmongocrypt format.
           def to_document
             BSON::Document.new({
-              provider: 'kmip',
-            }).tap do |bson|
+                                 provider: 'kmip',
+                               }).tap do |bson|
               bson.update({ endpoint: endpoint }) unless endpoint.nil?
               bson.update({ keyId: key_id }) unless key_id.nil?
             end
@@ -71,4 +70,3 @@ module Mongo
     end
   end
 end
-

data/lib/mongo/crypt/kms/kmip.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #

data/lib/mongo/crypt/kms/local/credentials.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #
@@ -32,7 +31,7 @@ module Mongo
           # @api private
           def_delegator :@opts, :empty?
 
-          FORMAT_HINT = "Local KMS provider options must be in the format: " +
+          FORMAT_HINT = 'Local KMS provider options must be in the format: ' +
                         "{ key: 'MASTER-KEY' }"
 
           # Creates a local KMS credentials object form a parameters hash.
@@ -45,21 +44,21 @@ module Mongo
           #   formatted.
           def initialize(opts)
             @opts = opts
-            unless empty?
-              @key = validate_param(:key, opts, FORMAT_HINT)
-            end
+            return if empty?
+
+            @key = validate_param(:key, opts, FORMAT_HINT)
           end
 
           # @return [ BSON::Document ] Local KMS credentials in libmongocrypt format.
           def to_document
             return BSON::Document.new({}) if empty?
+
             BSON::Document.new({
-              key: BSON::Binary.new(@key, :generic),
-            })
+                                 key: BSON::Binary.new(@key, :generic),
+                               })
           end
         end
       end
     end
   end
 end
-

data/lib/mongo/crypt/kms/local/master_document.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #
@@ -23,21 +22,18 @@ module Mongo
         #
         # @api private
         class MasterKeyDocument
-
           # Creates a master key document object form a parameters hash.
           # This empty method is to keep a uniform interface for all KMS providers.
-          def initialize(_opts)
-          end
+          def initialize(_opts); end
 
           # Convert master key document object to a BSON document in libmongocrypt format.
           #
           # @return [ BSON::Document ] Local KMS credentials in libmongocrypt format.
           def to_document
-            BSON::Document.new({ provider: "local" })
+            BSON::Document.new({ provider: 'local' })
           end
         end
       end
     end
   end
 end
-

data/lib/mongo/crypt/kms/local.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-# rubocop:todo all
 
 # Copyright (C) 2019-2021 MongoDB Inc.
 #