mongoid 7.2.1 → 9.0.0

data/lib/mongoid/clients/validators/storage.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 module Mongoid
   module Clients
@@ -10,9 +10,7 @@ module Mongoid
         extend self
 
         # The valid options for storage.
-        #
-        # @since 3.0.0
-        VALID_OPTIONS = [ :collection, :database, :client ].freeze
+        VALID_OPTIONS = [ :collection, :collection_options, :database, :client ].freeze
 
         # Validate the options provided to :store_in.
         #
@@ -20,28 +18,12 @@ module Mongoid
         #   Storage.validate(:collection_name)
         #
         # @param [ Class ] klass The model class.
-        # @param [ Hash, String, Symbol ] options The provided options.
-        #
-        # @since 3.0.0
+        # @param [ Hash | String | Symbol ] options The provided options.
         def validate(klass, options)
           valid_keys?(options) or raise Errors::InvalidStorageOptions.new(klass, options)
-          valid_parent?(klass) or raise Errors::InvalidStorageParent.new(klass)
         end
 
         private
-        # Determine if the current klass is valid to change store_in
-        # options
-        #
-        # @api private
-        #
-        # @param [ Class ] klass
-        #
-        # @return [ true, false ] If the class is valid
-        #
-        # @since 4.0.0
-        def valid_parent?(klass)
-          !klass.superclass.include?(Mongoid::Document)
-        end
 
         # Determine if all keys in the options hash are valid.
         #
@@ -52,9 +34,7 @@ module Mongoid
         #
         # @param [ Hash ] options The options hash.
         #
-        # @return [ true, false ] If all keys are valid.
-        #
-        # @since 3.0.0
+        # @return [ true | false ] If all keys are valid.
         def valid_keys?(options)
           return false unless options.is_a?(::Hash)
           options.keys.all? do |key|

data/lib/mongoid/clients/validators.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 require "mongoid/clients/validators/storage"

data/lib/mongoid/clients.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 require "mongoid/clients/factory"
 require "mongoid/clients/validators"
@@ -8,6 +8,10 @@ require "mongoid/clients/options"
 require "mongoid/clients/sessions"
 
 module Mongoid
+
+  # Mixin module included into Mongoid::Document which adds
+  # database client connection functionality. Also contains
+  # singleton class methods related to managing database clients.
   module Clients
     extend ActiveSupport::Concern
     include StorageOptions
@@ -22,8 +26,6 @@ module Mongoid
       #   Mongoid::Clients.clear
       #
       # @return [ Array ] The empty clients.
-      #
-      # @since 3.0.0
       def clear
         clients.clear
       end
@@ -34,8 +36,6 @@ module Mongoid
       #   Mongoid::Clients.default
       #
       # @return [ Mongo::Client ] The default client.
-      #
-      # @since 3.0.0
       def default
         with_name(:default)
       end
@@ -46,36 +46,59 @@ module Mongoid
       #   Mongoid::Clients.disconnect
       #
       # @return [ true ] True.
-      #
-      # @since 3.1.0
       def disconnect
-        clients.values.each do |client|
-          client.close
-        end
+        clients.each_value(&:close)
+        true
       end
 
-      # Get a client with the provided name.
+      # Reconnect all active clients.
+      #
+      # @example Reconnect all active clients.
+      #   Mongoid::Clients.reconnect
+      #
+      # @return [ true ] True.
+      def reconnect
+        clients.each_value(&:reconnect)
+        true
+      end
+
+      # Get a stored client with the provided name. If no client exists
+      # with the given name, a new one will be created, stored, and
+      # returned.
       #
       # @example Get a client with the name.
       #   Mongoid::Clients.with_name(:replica)
       #
-      # @param [ Symbol ] name The name of the client.
+      # @param [ String | Symbol ] name The name of the client.
       #
       # @return [ Mongo::Client ] The named client.
-      #
-      # @since 3.0.0
       def with_name(name)
         name_as_symbol = name.to_sym
         return clients[name_as_symbol] if clients[name_as_symbol]
         CREATE_LOCK.synchronize do
+          if (key_vault_client = Mongoid.clients.dig(name_as_symbol, :options, :auto_encryption_options, :key_vault_client))
+            clients[key_vault_client.to_sym] ||= Clients::Factory.create(key_vault_client)
+          end
           clients[name_as_symbol] ||= Clients::Factory.create(name)
         end
       end
 
+      # Store a client with the provided name.
+      #
+      # @example Set a client.
+      #   Mongoid::Clients.set(:analytics, my_client)
+      #
+      # @param [ String | Symbol ] name The name of the client to set.
+      # @param [ Mongo::Client ] client The client to set.
+      #
+      # @return [ Mongo::Client ] The set client.
       def set(name, client)
         clients[name.to_sym] = client
       end
 
+      # Returns the stored clients indexed by name.
+      #
+      # @return [ Hash<Symbol, Mongo::Client> ] The index of clients.
       def clients
         @clients ||= {}
       end

data/lib/mongoid/collection_configurable.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+module Mongoid
+
+  # Encapsulates behavior around defining collections.
+  module CollectionConfigurable
+    extend ActiveSupport::Concern
+
+    module ClassMethods
+      # Create the collection for the called upon Mongoid model.
+      #
+      # This method does not re-create existing collections.
+      #
+      # If the document includes `store_in` macro with `collection_options` key,
+      #   these options are used when creating the collection.
+      #
+      # @param [ true | false ] force If true, the method will drop existing
+      #   collections before creating new ones. If false, the method will create
+      #   only new collection (that do not exist in the database).
+      #
+      # @raise [ Errors::CreateCollectionFailure ] If collection creation failed.
+      # @raise [ Errors::DropCollectionFailure ] If an attempt to drop collection failed.
+      def create_collection(force: false)
+        if collection_name.empty?
+          # This is most probably an anonymous class, we ignore them.
+          return
+        end
+        if collection_name.match(/^system\./)
+          # We do not do anything with system collections.
+          return
+        end
+        if force
+          collection.drop
+        end
+        if coll_options = collection.database.list_collections(filter: { name: collection_name.to_s }).first
+          if force
+            raise Errors::DropCollectionFailure.new(collection_name)
+          else
+            logger.debug(
+              "MONGOID: Collection '#{collection_name}' already exists " +
+              "in database '#{database_name}' with options '#{coll_options}'."
+            )
+          end
+        else
+          begin
+            collection.database[collection_name, storage_options.fetch(:collection_options, {})].create
+          rescue Mongo::Error::OperationFailure => e
+            raise Errors::CreateCollectionFailure.new(
+              collection_name,
+              storage_options[:collection_options],
+              e
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/lib/mongoid/composable.rb

@@ -1,7 +1,9 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 require "mongoid/changeable"
+require "mongoid/collection_configurable"
+require "mongoid/encryptable"
 require "mongoid/findable"
 require "mongoid/indexable"
 require "mongoid/inspectable"
@@ -10,6 +12,7 @@ require "mongoid/matcher"
 require "mongoid/matchable"
 require "mongoid/persistable"
 require "mongoid/reloadable"
+require 'mongoid/search_indexable'
 require "mongoid/selectable"
 require "mongoid/scopable"
 require "mongoid/serializable"
@@ -22,8 +25,6 @@ require "mongoid/validatable"
 module Mongoid
 
   # This module provides inclusions of all behavior in a Mongoid document.
-  #
-  # @since 4.0.0
   module Composable
     extend ActiveSupport::Concern
 
@@ -39,6 +40,7 @@ module Mongoid
     include Atomic
     include Changeable
     include Clients
+    include CollectionConfigurable
     include Attributes
     include Evolvable
     include Fields
@@ -49,6 +51,7 @@ module Mongoid
     include Association
     include Reloadable
     include Scopable
+    include SearchIndexable
     include Selectable
     include Serializable
     include Shardable
@@ -60,6 +63,7 @@ module Mongoid
     include Interceptable
     include Copyable
     include Equality
+    include Encryptable
 
     MODULES = [
       Atomic,
@@ -99,8 +103,6 @@ module Mongoid
     # separately.
     #
     # @return [ Array<Symbol> ] A list of reserved method names.
-    #
-    # @since 6.0.0
     RESERVED_METHOD_NAMES = [ :fields,
                               :aliased_fields,
                               :localized_fields,
@@ -123,8 +125,6 @@ module Mongoid
       #   Mongoid::Components.prohibited_methods
       #
       # @return [ Array<Symbol> ]
-      #
-      # @since 2.1.8
       def prohibited_methods
         @prohibited_methods ||= MODULES.flat_map do |mod|
           mod.instance_methods.map(&:to_sym)

data/lib/mongoid/config/defaults.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+module Mongoid
+  module Config
+
+    # Encapsulates logic for loading defaults.
+    module Defaults
+
+      # Load the defaults for the feature flags in the given Mongoid version.
+      # Note that this method will load the *new* functionality introduced in
+      # the given Mongoid version.
+      #
+      # @param [ String | Float ] version The version number as X.y.
+      #
+      # raises [ ArgumentError ] if an invalid version is given.
+      def load_defaults(version)
+        case version.to_s
+        when /^[0-7]\./
+          raise ArgumentError, "Version no longer supported: #{version}"
+        when "8.0"
+          self.legacy_readonly = true
+
+          load_defaults "8.1"
+        when "8.1"
+          self.immutable_ids = false
+          self.legacy_persistence_context_behavior = true
+          self.around_callbacks_for_embeds = true
+          self.prevent_multiple_calls_of_embedded_callbacks = false
+
+          load_defaults "9.0"
+        when "9.0"
+          # All flag defaults currently reflect 9.0 behavior.
+        else
+          raise ArgumentError, "Unknown version: #{version}"
+        end
+      end
+    end
+  end
+end

data/lib/mongoid/config/encryption.rb

@@ -0,0 +1,213 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+require 'mongoid/extensions/boolean'
+require 'mongoid/stringified_symbol'
+
+module Mongoid
+  module Config
+    # This module contains the logic for configuring Client Side
+    # Field Level automatic encryption.
+    #
+    # @api private
+    module Encryption
+      extend self
+
+      # Generate the encryption schema map for the provided models.
+      #
+      # @param [ String ] default_database The default database name.
+      # @param [ Array<Mongoid::Document> ] models The models to generate the schema map for.
+      #   Defaults to all models in the application.
+      #
+      # @return [ Hash ] The encryption schema map.
+      def encryption_schema_map(default_database, models = ::Mongoid.models)
+        visited = Set.new
+        models.each_with_object({}) do |model, map|
+          next if visited.include?(model)
+          visited << model
+          next if model.embedded?
+          next unless model.encrypted?
+
+          database = model.storage_options.fetch(:database) { default_database }
+          key = "#{database}.#{model.collection_name}"
+          props = metadata_for(model).merge(properties_for(model, visited))
+          map[key] = props unless props.empty?
+        end
+      end
+
+      private
+
+      # The algorithm to use for the deterministic encryption.
+      DETERMINISTIC_ALGORITHM = 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
+
+      # The algorithm to use for the non-deterministic encryption.
+      RANDOM_ALGORITHM = 'AEAD_AES_256_CBC_HMAC_SHA_512-Random'
+
+      # The mapping of Mongoid field types to BSON type identifiers.
+      TYPE_MAPPINGS = {
+        Hash => 'object',
+        Integer => 'int',
+        BSON::Int32 => 'int',
+        BSON::Int64 => 'long',
+        BSON::ObjectId => 'objectId',
+        Time => 'date',
+        Date => 'date',
+        DateTime => 'date',
+        Float => 'double',
+        String => 'string',
+        BSON::Binary => 'binData',
+        Array => 'array',
+        Mongoid::Boolean => 'bool',
+        BigDecimal => 'decimal',
+        Range => 'object',
+        Regexp => 'regex',
+        Set => 'array',
+        Mongoid::StringifiedSymbol => 'string',
+        ActiveSupport::TimeWithZone => 'date'
+      }.freeze
+
+      # Generate the encryptMetadata object for the provided model.
+      #
+      # @param [ Mongoid::Document ] model The model to generate the metadata for.
+      #
+      # @return [ Hash ] The encryptMetadata object.
+      def metadata_for(model)
+        metadata = {}.tap do |metadata|
+          if (key_id = key_id_for(model.encrypt_metadata[:key_id], model.encrypt_metadata[:key_name_field]))
+            metadata['keyId'] = key_id
+          end
+          if model.encrypt_metadata.key?(:deterministic)
+            metadata['algorithm'] = if model.encrypt_metadata[:deterministic]
+                                      DETERMINISTIC_ALGORITHM
+                                    else
+                                      RANDOM_ALGORITHM
+                                    end
+          end
+        end
+        if metadata.empty?
+          {}
+        else
+          {
+            'bsonType' => 'object',
+            'encryptMetadata' => metadata
+          }
+        end
+      end
+
+      # Generate encryption properties for the provided model.
+      #
+      # This method generates the properties for the fields and relations that
+      # are marked as encrypted.
+      #
+      # @param [ Mongoid::Document ] model The model to generate the properties for.
+      # @param [ Set<Mongoid::Document> ] visited The set of models that have already been visited.
+      #
+      # @return [ Hash ] The encryption properties.
+      def properties_for(model, visited)
+        result = properties_for_fields(model).merge(properties_for_relations(model, visited))
+        if result.empty?
+          {}
+        else
+          { 'properties' => result }
+        end
+      end
+
+      # Generate encryption properties for the fields of the provided model.
+      #
+      # @param [ Mongoid::Document ] model The model to generate the properties for.
+      #
+      # @return [ Hash ] The encryption properties.
+      def properties_for_fields(model)
+        model.fields.each_with_object({}) do |(name, field), props|
+          next unless field.is_a?(Mongoid::Fields::Encrypted)
+
+          props[name] = {
+            'encrypt' => {
+              'bsonType' => bson_type_for(field)
+            }
+          }
+          if (algorithm = algorithm_for(field))
+            props[name]['encrypt']['algorithm'] = algorithm
+          end
+          if (key_id = key_id_for(field.key_id, field.key_name_field))
+            props[name]['encrypt']['keyId'] = key_id
+          end
+        end
+      end
+
+      # Generate encryption properties for the relations of the provided model.
+      #
+      # This method generates the properties for the embedded relations that
+      # are configured to be encrypted.
+      #
+      # @param [ Mongoid::Document ] model The model to generate the properties for.
+      # @param [ Set<Mongoid::Document> ] visited The set of models that have already been visited.
+      #
+      # @return [ Hash ] The encryption properties.
+      def properties_for_relations(model, visited)
+        model.relations.each_with_object({}) do |(name, relation), props|
+          next if visited.include?(relation.relation_class)
+          next unless relation.is_a?(Association::Embedded::EmbedsOne)
+          next unless relation.relation_class.encrypted?
+
+          visited << relation.relation_class
+          metadata_for(
+            relation.relation_class
+          ).merge(
+            properties_for(relation.relation_class, visited)
+          ).tap do |properties|
+            props[name] = { 'bsonType' => 'object' }.merge(properties) unless properties.empty?
+          end
+        end
+      end
+
+      # Get the BSON type identifier for the provided field according to the
+      # https://www.mongodb.com/docs/manual/reference/bson-types/#std-label-bson-types
+      #
+      # @param [ Mongoid::Field ] field The field to get the BSON type identifier for.
+      #
+      # @return [ String ] The BSON type identifier.
+      def bson_type_for(field)
+        TYPE_MAPPINGS[field.type]
+      end
+
+      # Get the encryption algorithm to use for the provided field.
+      #
+      # @param [ Mongoid::Field ] field The field to get the algorithm for.
+      #
+      # @return [ String ] The algorithm.
+      def algorithm_for(field)
+        case field.deterministic?
+        when true
+          DETERMINISTIC_ALGORITHM
+        when false
+          RANDOM_ALGORITHM
+        else
+          nil
+        end
+      end
+
+      # Get the keyId encryption schema field for the base64 encrypted
+      # key id.
+      #
+      # @param [ String | nil ] key_id_base64 The base64 encoded key id.
+      # @param [ String | nil ] key_name_field The name of the key name field.
+      #
+      # @return [ Array<BSON::Binary> | String | nil ] The keyId encryption schema field,
+      #   JSON pointer to the field that contains keyAltName,
+      #   or nil if both key_id_base64 and key_name_field are nil.
+      def key_id_for(key_id_base64, key_name_field)
+        return nil if key_id_base64.nil? && key_name_field.nil?
+        if !key_id_base64.nil? && !key_name_field.nil?
+          raise ArgumentError, 'Specifying both key_id and key_name_field is not allowed'
+        end
+
+        if key_id_base64.nil?
+          "/#{key_name_field}"
+        else
+          [ BSON::Binary.new(Base64.decode64(key_id_base64), :uuid) ]
+        end
+      end
+    end
+  end
+end

data/lib/mongoid/config/environment.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 module Mongoid
   module Config
@@ -23,8 +23,6 @@ module Mongoid
       #   determined because none of the sources was set.
       #
       # @return [ String ] The name of the current environment.
-      #
-      # @since 2.3.0
       # @api public
       def env_name
         if defined?(::Rails)
@@ -48,11 +46,33 @@ module Mongoid
       #
       # @return [ Hash ] The settings.
       #
-      # @since 2.3.0
       # @api private
       def load_yaml(path, environment = nil)
         env = environment ? environment.to_s : env_name
-        YAML.load(ERB.new(File.new(path).read).result)[env]
+
+        contents = File.read(path)
+        if contents.empty?
+          raise Mongoid::Errors::EmptyConfigFile.new(path)
+        end
+
+        # These are the classes that can be used in a Mongoid
+        # configuration file in addition to standard YAML types.
+        permitted_classes = [
+          # Symbols occur as values for read preference, for example.
+          Symbol,
+          # BSON::Binary occur as keyId values for FLE (more precisely,
+          # the keyIds are UUIDs).
+          BSON::Binary,
+        ]
+
+        result = ERB.new(contents).result
+        data = YAML.safe_load(result, permitted_classes: permitted_classes, aliases: true)
+
+        unless data.is_a?(Hash)
+          raise Mongoid::Errors::InvalidConfigFile.new(path)
+        end
+
+        data[env]
       end
     end
   end