mongoid 8.1.4 → 9.0.0

data/lib/mongoid/config/encryption.rb

@@ -0,0 +1,213 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+require 'mongoid/extensions/boolean'
+require 'mongoid/stringified_symbol'
+
+module Mongoid
+  module Config
+    # This module contains the logic for configuring Client Side
+    # Field Level automatic encryption.
+    #
+    # @api private
+    module Encryption
+      extend self
+
+      # Generate the encryption schema map for the provided models.
+      #
+      # @param [ String ] default_database The default database name.
+      # @param [ Array<Mongoid::Document> ] models The models to generate the schema map for.
+      #   Defaults to all models in the application.
+      #
+      # @return [ Hash ] The encryption schema map.
+      def encryption_schema_map(default_database, models = ::Mongoid.models)
+        visited = Set.new
+        models.each_with_object({}) do |model, map|
+          next if visited.include?(model)
+          visited << model
+          next if model.embedded?
+          next unless model.encrypted?
+
+          database = model.storage_options.fetch(:database) { default_database }
+          key = "#{database}.#{model.collection_name}"
+          props = metadata_for(model).merge(properties_for(model, visited))
+          map[key] = props unless props.empty?
+        end
+      end
+
+      private
+
+      # The algorithm to use for the deterministic encryption.
+      DETERMINISTIC_ALGORITHM = 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
+
+      # The algorithm to use for the non-deterministic encryption.
+      RANDOM_ALGORITHM = 'AEAD_AES_256_CBC_HMAC_SHA_512-Random'
+
+      # The mapping of Mongoid field types to BSON type identifiers.
+      TYPE_MAPPINGS = {
+        Hash => 'object',
+        Integer => 'int',
+        BSON::Int32 => 'int',
+        BSON::Int64 => 'long',
+        BSON::ObjectId => 'objectId',
+        Time => 'date',
+        Date => 'date',
+        DateTime => 'date',
+        Float => 'double',
+        String => 'string',
+        BSON::Binary => 'binData',
+        Array => 'array',
+        Mongoid::Boolean => 'bool',
+        BigDecimal => 'decimal',
+        Range => 'object',
+        Regexp => 'regex',
+        Set => 'array',
+        Mongoid::StringifiedSymbol => 'string',
+        ActiveSupport::TimeWithZone => 'date'
+      }.freeze
+
+      # Generate the encryptMetadata object for the provided model.
+      #
+      # @param [ Mongoid::Document ] model The model to generate the metadata for.
+      #
+      # @return [ Hash ] The encryptMetadata object.
+      def metadata_for(model)
+        metadata = {}.tap do |metadata|
+          if (key_id = key_id_for(model.encrypt_metadata[:key_id], model.encrypt_metadata[:key_name_field]))
+            metadata['keyId'] = key_id
+          end
+          if model.encrypt_metadata.key?(:deterministic)
+            metadata['algorithm'] = if model.encrypt_metadata[:deterministic]
+                                      DETERMINISTIC_ALGORITHM
+                                    else
+                                      RANDOM_ALGORITHM
+                                    end
+          end
+        end
+        if metadata.empty?
+          {}
+        else
+          {
+            'bsonType' => 'object',
+            'encryptMetadata' => metadata
+          }
+        end
+      end
+
+      # Generate encryption properties for the provided model.
+      #
+      # This method generates the properties for the fields and relations that
+      # are marked as encrypted.
+      #
+      # @param [ Mongoid::Document ] model The model to generate the properties for.
+      # @param [ Set<Mongoid::Document> ] visited The set of models that have already been visited.
+      #
+      # @return [ Hash ] The encryption properties.
+      def properties_for(model, visited)
+        result = properties_for_fields(model).merge(properties_for_relations(model, visited))
+        if result.empty?
+          {}
+        else
+          { 'properties' => result }
+        end
+      end
+
+      # Generate encryption properties for the fields of the provided model.
+      #
+      # @param [ Mongoid::Document ] model The model to generate the properties for.
+      #
+      # @return [ Hash ] The encryption properties.
+      def properties_for_fields(model)
+        model.fields.each_with_object({}) do |(name, field), props|
+          next unless field.is_a?(Mongoid::Fields::Encrypted)
+
+          props[name] = {
+            'encrypt' => {
+              'bsonType' => bson_type_for(field)
+            }
+          }
+          if (algorithm = algorithm_for(field))
+            props[name]['encrypt']['algorithm'] = algorithm
+          end
+          if (key_id = key_id_for(field.key_id, field.key_name_field))
+            props[name]['encrypt']['keyId'] = key_id
+          end
+        end
+      end
+
+      # Generate encryption properties for the relations of the provided model.
+      #
+      # This method generates the properties for the embedded relations that
+      # are configured to be encrypted.
+      #
+      # @param [ Mongoid::Document ] model The model to generate the properties for.
+      # @param [ Set<Mongoid::Document> ] visited The set of models that have already been visited.
+      #
+      # @return [ Hash ] The encryption properties.
+      def properties_for_relations(model, visited)
+        model.relations.each_with_object({}) do |(name, relation), props|
+          next if visited.include?(relation.relation_class)
+          next unless relation.is_a?(Association::Embedded::EmbedsOne)
+          next unless relation.relation_class.encrypted?
+
+          visited << relation.relation_class
+          metadata_for(
+            relation.relation_class
+          ).merge(
+            properties_for(relation.relation_class, visited)
+          ).tap do |properties|
+            props[name] = { 'bsonType' => 'object' }.merge(properties) unless properties.empty?
+          end
+        end
+      end
+
+      # Get the BSON type identifier for the provided field according to the
+      # https://www.mongodb.com/docs/manual/reference/bson-types/#std-label-bson-types
+      #
+      # @param [ Mongoid::Field ] field The field to get the BSON type identifier for.
+      #
+      # @return [ String ] The BSON type identifier.
+      def bson_type_for(field)
+        TYPE_MAPPINGS[field.type]
+      end
+
+      # Get the encryption algorithm to use for the provided field.
+      #
+      # @param [ Mongoid::Field ] field The field to get the algorithm for.
+      #
+      # @return [ String ] The algorithm.
+      def algorithm_for(field)
+        case field.deterministic?
+        when true
+          DETERMINISTIC_ALGORITHM
+        when false
+          RANDOM_ALGORITHM
+        else
+          nil
+        end
+      end
+
+      # Get the keyId encryption schema field for the base64 encrypted
+      # key id.
+      #
+      # @param [ String | nil ] key_id_base64 The base64 encoded key id.
+      # @param [ String | nil ] key_name_field The name of the key name field.
+      #
+      # @return [ Array<BSON::Binary> | String | nil ] The keyId encryption schema field,
+      #   JSON pointer to the field that contains keyAltName,
+      #   or nil if both key_id_base64 and key_name_field are nil.
+      def key_id_for(key_id_base64, key_name_field)
+        return nil if key_id_base64.nil? && key_name_field.nil?
+        if !key_id_base64.nil? && !key_name_field.nil?
+          raise ArgumentError, 'Specifying both key_id and key_name_field is not allowed'
+        end
+
+        if key_id_base64.nil?
+          "/#{key_name_field}"
+        else
+          [ BSON::Binary.new(Base64.decode64(key_id_base64), :uuid) ]
+        end
+      end
+    end
+  end
+end

data/lib/mongoid/config/environment.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 module Mongoid
   module Config
@@ -65,11 +66,7 @@ module Mongoid
         ]
 
         result = ERB.new(contents).result
-        data = if RUBY_VERSION < '2.6'
-          YAML.safe_load(result, permitted_classes, [], true)
-        else
-          YAML.safe_load(result, permitted_classes: permitted_classes, aliases: true)
-        end
+        data = YAML.safe_load(result, permitted_classes: permitted_classes, aliases: true)
 
         unless data.is_a?(Hash)
           raise Mongoid::Errors::InvalidConfigFile.new(path)

data/lib/mongoid/config/introspection.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+module Mongoid
+  module Config
+
+    # This module provides a way to inspect not only the defined configuration
+    # settings and their defaults (which are available via
+    # `Mongoid::Config.settings`), but also the documentation about them. It
+    # does this by scraping the `mongoid/config.rb` file with a regular
+    # expression to match comments with options.
+    #
+    # @api private
+    module Introspection
+      extend self
+
+      # A helper class to represent an individual option, its name, its
+      # default value, and the comment that documents it.
+      class Option
+        # The name of this option.
+        #
+        # @return [ String ] The name of the option
+        attr_reader :name
+
+        # The default value of this option.
+        #
+        # @return [ Object ] The default value of the option, typically a
+        #   String, Symbol, nil, true, or false.
+        attr_reader :default
+
+        # The comment that describes this option, as scraped from
+        # mongoid/config.rb.
+        #
+        # @return [ String ] The (possibly multi-line) comment. Each line is
+        #   prefixed with the Ruby comment character ("#").
+        attr_reader :comment
+
+        # Instantiate an option from an array of Regex captures.
+        #
+        # @param [ Array<String> ] captures The array with the Regex captures
+        #   to use to instantiate the option. The element at index 1 must be
+        #   the comment, at index 2 must be the name, and at index 3 must be
+        #   the default value.
+        #
+        # @return [ Option ] The newly instantiated Option object.
+        def self.from_captures(captures)
+          new(captures[2], captures[3], captures[1])
+        end
+
+        # Create a new Option instance with the given name, default value,
+        # and comment.
+        #
+        # @param [ String ] name The option's name.
+        # @param [ String ] default The option's default value, as a String
+        #   representing the actual Ruby value.
+        # @param [ String ] comment The multi-line comment describing the
+        #   option.
+        def initialize(name, default, comment)
+          @name, @default, @comment = name, default, unindent(comment)
+        end
+
+        # Indent the comment by the requested amount, optionally indenting the
+        # first line, as well.
+        #
+        # param [ Integer ] indent The number of spaces to indent each line
+        #   (Default: 2)
+        # param [ true | false ] indent_first_line Whether or not to indent
+        #   the first line of the comment (Default: false)
+        #
+        # @return [ String ] the reformatted comment
+        def indented_comment(indent: 2, indent_first_line: false)
+          comment.gsub(/^/, " " * indent).tap do |result|
+            result.strip! unless indent_first_line
+          end
+        end
+
+        # Reports whether or not the text "(Deprecated)" is present in the
+        # option's comment.
+        #
+        # @return [ true | false ] whether the option is deprecated or not.
+        def deprecated?
+          comment.include?("(Deprecated)")
+        end
+
+        # Compare self with the given option.
+        #
+        # @return [ true | false ] If name, default, and comment are all the
+        #   same, return true. Otherwise, false.
+        def ==(option)
+          name == option.name &&
+            default == option.default &&
+            comment == option.comment
+        end
+
+        private
+
+        # Removes any existing whitespace from the beginning of each line in
+        # the text.
+        #
+        # @param [ String ] text The text to unindent.
+        #
+        # @return [ String ] the unindented text.
+        def unindent(text)
+          text.strip.gsub(/^\s+/, "")
+        end
+      end
+
+      # A regular expression that looks for option declarations of the format:
+      #
+      #   # one or more lines of comments,
+      #   # followed immediately by an option
+      #   # declaration with a default value:
+      #   option :option_name, default: "something"
+      #
+      # The regex produces three captures:
+      #
+      #   1: the (potentially multiline) comment
+      #   2: the option's name
+      #   3: the option's default value
+      OPTION_PATTERN = %r{
+        (
+          ((?:^\s*\#.*\n)+)  # match one or more lines of comments
+          ^\s+option\s+      # followed immediately by a line declaring an option
+          :(\w+),\s+         # match the option's name, followed by a comma
+          default:\s+(.*?)   # match the default value for the option
+          (?:,.*?)?          # skip any other configuration
+        \n)                  # end with a newline
+      }x
+
+      # The full path to the source file of the Mongoid::Config module.
+      CONFIG_RB_PATH = File.absolute_path(File.join(
+        File.dirname(__FILE__), "../config.rb"))
+
+      # Extracts the available configuration options from the Mongoid::Config
+      # source file, and returns them as an array of hashes.
+      #
+      # @param [ true | false ] include_deprecated Whether deprecated options
+      #   should be included in the list. (Default: false)
+      #
+      # @return [ Array<Introspection::Option>> ] the array of option objects
+      #   representing each defined option, in alphabetical order by name.
+      def options(include_deprecated: false)
+        src = File.read(CONFIG_RB_PATH)
+        src.scan(OPTION_PATTERN)
+          .map { |opt| Option.from_captures(opt) }
+          .reject { |opt| !include_deprecated && opt.deprecated? }
+          .sort_by { |opt| opt.name }
+      end
+    end
+
+  end
+end

data/lib/mongoid/config/options.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 module Mongoid
   module Config
@@ -56,7 +57,11 @@ module Mongoid
       #
       # @return [ Hash ] The defaults.
       def reset
-        settings.replace(defaults)
+        # do this via the setter for each option, so that any defined on_change
+        # handlers can be invoked.
+        defaults.each do |setting, default|
+          send(:"#{setting}=", default)
+        end
       end
 
       # Get the settings or initialize a new empty hash.
@@ -78,8 +83,8 @@ module Mongoid
       def log_level
         if level = settings[:log_level]
           unless level.is_a?(Integer)
-            level = level.upcase.to_s
-            level = "Logger::#{level}".constantize
+            # JRuby String#constantize does not work here.
+            level = Logger.const_get(level.upcase.to_s)
           end
           level
         end

data/lib/mongoid/config/validators/async_query_executor.rb

@@ -1,16 +1,26 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 module Mongoid
   module Config
     module Validators
 
-      # Validator for async query executor configuration.
+      # Validates the async query executor options in the Mongoid
+      # configuration. Used during application bootstrapping.
       #
       # @api private
       module AsyncQueryExecutor
         extend self
 
-
+        # Validate the Mongoid configuration options related to
+        # the async query executor.
+        #
+        # @param [ Hash ] options The configuration options.
+        #
+        # @raises [ Mongoid::Errors::InvalidGlobalExecutorConcurrency ]
+        #   Raised if the options are invalid.
+        #
+        # @api private
         def validate(options)
           if options.key?(:async_query_executor)
             if options[:async_query_executor].to_sym == :immediate && !options[:global_executor_concurrency].nil?

data/lib/mongoid/config/validators/client.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 module Mongoid
   module Config

data/lib/mongoid/config/validators/option.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 module Mongoid
   module Config

data/lib/mongoid/config/validators.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 require "mongoid/config/validators/async_query_executor"
 require "mongoid/config/validators/option"