mongoid 9.0.10 → 9.0.12

data/spec/integration/app_spec.rb

@@ -37,37 +37,34 @@ describe 'Mongoid application tests' do
     FileUtils.mkdir_p(TMP_BASE)
   end
 
-  context 'demo application' do
+  context 'generated application' do
     context 'sinatra' do
       it 'runs' do
-        skip 'https://jira.mongodb.org/browse/MONGOID-5826'
-
-        clone_application(
-          'https://github.com/mongoid/mongoid-demo',
-          subdir: 'sinatra-minimal',
-        ) do
-
+        create_sinatra_app('mongoid-sinatra-test') do
           # JRuby needs a long timeout
           start_app(%w(bundle exec ruby app.rb), 4567, 40) do |port|
             uri = URI.parse('http://localhost:4567/posts')
             resp = JSON.parse(uri.open.read)
 
             resp.should == []
-
           end
         end
       end
     end
 
     context 'rails-api' do
-      it 'runs' do
-        skip 'https://jira.mongodb.org/browse/MONGOID-5826'
-
-        clone_application(
-          'https://github.com/mongoid/mongoid-demo',
-          subdir: 'rails-api',
-        ) do
+      before(:all) do
+        # Rails 6.0/6.1 have Logger issues on Ruby 3.1+
+        # Rails < 7.1 have concurrent-ruby issues on Ruby 4.0+
+        if RUBY_VERSION >= '4.0' && SpecConfig.instance.rails_version < '7.1'
+          skip 'Rails < 7.1 is not compatible with Ruby 4.0+. Set RAILS=7.1 or higher.'
+        elsif RUBY_VERSION >= '3.1' && SpecConfig.instance.rails_version < '6.1'
+          skip 'Rails < 6.1 is not compatible with Ruby 3.1+. Set RAILS=6.1 or higher.'
+        end
+      end
 
+      it 'runs' do
+        create_rails_api_app('mongoid-rails-api-test') do
           # JRuby needs a long timeout
           start_app(%w(bundle exec rails s), 3000, 50) do |port|
             uri = URI.parse('http://localhost:3000/posts')
@@ -114,7 +111,7 @@ describe 'Mongoid application tests' do
 
     Dir.chdir(TMP_BASE) do
       FileUtils.rm_rf(name)
-      check_call(insert_rails_gem_version(%W(rails new #{name} --skip-spring --skip-active-record)), env: clean_env)
+      check_call(insert_rails_gem_version(%W(rails new #{name} --skip-spring --skip-active-record)), env: rails_env)
 
       Dir.chdir(name) do
         adjust_rails_defaults
@@ -126,10 +123,149 @@ describe 'Mongoid application tests' do
     end
   end
 
+  def create_sinatra_app(name)
+    Dir.chdir(TMP_BASE) do
+      FileUtils.rm_rf(name)
+      FileUtils.mkdir_p(name)
+
+      Dir.chdir(name) do
+        # Create minimal Sinatra app with Post model
+        File.open('app.rb', 'w') do |f|
+          f.write(<<~RUBY)
+            require 'sinatra'
+            require 'mongoid'
+            require 'json'
+
+            Mongoid.load!('config/mongoid.yml')
+
+            class Post
+              include Mongoid::Document
+              field :title, type: String
+            end
+
+            get '/posts' do
+              content_type :json
+              Post.all.to_json
+            end
+          RUBY
+        end
+
+        # Create Gemfile
+        File.open('Gemfile', 'w') do |f|
+          f.write(<<~RUBY)
+            source 'https://rubygems.org'
+            gem 'sinatra'
+            gem 'rackup'
+            gem 'mongoid', path: '#{File.expand_path(BASE)}'
+            gem 'puma'
+          RUBY
+        end
+
+        FileUtils.mkdir_p('config')
+        write_mongoid_yml
+        check_call(%w(bundle install), env: clean_env)
+
+        yield
+      end
+    end
+  end
+
+  def create_rails_api_app(name)
+    install_rails
+
+    Dir.chdir(TMP_BASE) do
+      FileUtils.rm_rf(name)
+      check_call(insert_rails_gem_version(%W(rails new #{name} --api --skip-spring --skip-active-record)), env: rails_env)
+
+      Dir.chdir(name) do
+        adjust_rails_defaults
+        adjust_app_gemfile
+
+        # Create Post model
+        File.open('app/models/post.rb', 'w') do |f|
+          f.write(<<~RUBY)
+            class Post
+              include Mongoid::Document
+              field :title, type: String
+            end
+          RUBY
+        end
+
+        # Create PostsController
+        File.open('app/controllers/posts_controller.rb', 'w') do |f|
+          f.write(<<~RUBY)
+            class PostsController < ApplicationController
+              def index
+                render json: Post.all
+              end
+            end
+          RUBY
+        end
+
+        # Add route
+        routes_content = File.read('config/routes.rb')
+        routes_content.sub!(/Rails\.application\.routes\.draw do\n/,
+                           "Rails.application.routes.draw do\n  resources :posts, only: [:index]\n")
+        File.open('config/routes.rb', 'w') { |f| f.write(routes_content) }
+
+        write_mongoid_yml
+        check_call(%w(bundle install), env: clean_env)
+
+        yield
+      end
+    end
+  end
+
+  def create_rails_rake_test_app(name)
+    install_rails
+
+    Dir.chdir(TMP_BASE) do
+      FileUtils.rm_rf(name)
+      check_call(insert_rails_gem_version(%W(rails new #{name} --api --skip-spring --skip-active-record)), env: rails_env)
+
+      Dir.chdir(name) do
+        adjust_rails_defaults
+        adjust_app_gemfile
+
+        # Create Post model with index
+        File.open('app/models/post.rb', 'w') do |f|
+          f.write(<<~RUBY)
+            class Post
+              include Mongoid::Document
+              include Mongoid::Timestamps
+              field :subject, type: String
+              field :message, type: String
+
+              index subject: 1
+            end
+          RUBY
+        end
+
+        # Create Comment model
+        File.open('app/models/comment.rb', 'w') do |f|
+          f.write(<<~RUBY)
+            class Comment
+              include Mongoid::Document
+              include Mongoid::Timestamps
+              belongs_to :post
+            end
+          RUBY
+        end
+
+        write_mongoid_yml
+        check_call(%w(bundle install), env: clean_env)
+      end
+    end
+  end
+
   context 'new application - rails' do
     before(:all) do
-      if SpecConfig.instance.rails_version < '7.1'
-        skip '`rails new` with rails < 7.1 fails because modern concurrent-ruby removed logger dependency'
+      # Rails 6.0/6.1 have Logger issues on Ruby 3.1+
+      # Rails < 7.1 have concurrent-ruby issues on Ruby 4.0+
+      if RUBY_VERSION >= '4.0' && SpecConfig.instance.rails_version < '7.1'
+        skip 'Rails < 7.1 is not compatible with Ruby 4.0+. Set RAILS=7.1 or higher.'
+      elsif RUBY_VERSION >= '3.1' && SpecConfig.instance.rails_version < '6.1'
+        skip 'Rails < 6.1 is not compatible with Ruby 3.1+. Set RAILS=6.1 or higher.'
       end
     end
 
@@ -186,17 +322,31 @@ describe 'Mongoid application tests' do
     if (rails_version = SpecConfig.instance.rails_version) == 'master'
     else
       check_call(%w(gem list))
+
+      # Rails 6.0 and 6.1 need logger gem on Ruby 2.7+ due to stdlib changes
+      if rails_version.to_f < 7.0 && RUBY_VERSION >= '2.7'
+        check_call(%w(gem install logger --no-document))
+      end
+
       check_call(%w(gem install rails --no-document --force -v) + ["~> #{rails_version}.0"])
     end
   end
 
-  context 'local test applications' do
+  context 'generated test applications' do
+    before(:all) do
+      # Rails 6.0/6.1 have Logger issues on Ruby 3.1+
+      # Rails < 7.1 have concurrent-ruby issues on Ruby 4.0+
+      if RUBY_VERSION >= '4.0' && SpecConfig.instance.rails_version < '7.1'
+        skip 'Rails < 7.1 is not compatible with Ruby 4.0+. Set RAILS=7.1 or higher.'
+      elsif RUBY_VERSION >= '3.1' && SpecConfig.instance.rails_version < '6.1'
+        skip 'Rails < 6.1 is not compatible with Ruby 3.1+. Set RAILS=6.1 or higher.'
+      end
+    end
+
     let(:client) { Mongoid.default_client }
 
     describe 'create_indexes rake task' do
 
-      APP_PATH = File.join(File.dirname(__FILE__), '../../test-apps/rails-api')
-
       %w(development production).each do |rails_env|
         context "in #{rails_env}" do
 
@@ -207,20 +357,11 @@ describe 'Mongoid application tests' do
                 clean_env.merge(RAILS_ENV: rails_env, AUTOLOADER: autoloader)
               end
 
+              let(:app_name) { "mongoid-rake-test-#{rails_env}-#{autoloader}" }
+              let(:app_path) { File.join(TMP_BASE, app_name) }
+
               before do
-                Dir.chdir(APP_PATH) do
-                  remove_bundler_req
-
-                  if BSON::Environment.jruby?
-                    # Remove existing Gemfile.lock - see
-                    # https://github.com/rubygems/rubygems/issues/3231
-                    require 'fileutils'
-                    FileUtils.rm_f('Gemfile.lock')
-                  end
-
-                  check_call(%w(bundle install), env: env)
-                  write_mongoid_yml
-                end
+                create_rails_rake_test_app(app_name)
 
                 client['posts'].drop
                 client['posts'].create
@@ -233,7 +374,7 @@ describe 'Mongoid application tests' do
                 index.should be nil
 
                 check_call(%w(bundle exec rake db:mongoid:create_indexes -t),
-                  cwd: APP_PATH, env: env)
+                  cwd: app_path, env: env)
 
                 index = client['posts'].indexes.detect do |index|
                   index['key'] == {'subject' => 1}
@@ -317,6 +458,19 @@ describe 'Mongoid application tests' do
       line =~ /mongoid/
     end
     gemfile_lines << "gem 'mongoid', path: '#{File.expand_path(BASE)}'\n"
+
+    # json 3.0 removed the quirks_mode and max_nesting keywords that
+    # ActiveSupport::JSON (every 7.x) still passes to JSON.generate and
+    # JSON.parse, so a freshly resolved bundle picks a 3.x json and the app
+    # fails to encode any response with ArgumentError: unknown keyword:
+    # quirks_mode. Cap json at 2.x, which still accepts those keywords.
+    gemfile_lines << "gem 'json', '< 3'\n"
+
+    # Rails 6.0 and 6.1 need logger gem on Ruby 2.7+ due to stdlib changes
+    if rails_version && rails_version.to_f < 7.0 && RUBY_VERSION >= '2.7'
+      gemfile_lines << "gem 'logger'\n"
+    end
+
     if rails_version
       gemfile_lines.delete_if do |line|
         line =~ /gem ['"]rails['"]/
@@ -376,6 +530,17 @@ describe 'Mongoid application tests' do
     @clean_env ||= Hash[ENV.keys.grep(/BUNDLE|RUBYOPT/).map { |k| [k, nil ] }]
   end
 
+  def rails_env
+    # For Rails 6.0/6.1 on Ruby 2.7+, we need to require logger
+    # to fix "uninitialized constant ActiveSupport::LoggerThreadSafeLevel::Logger"
+    env = clean_env.dup
+    rails_version = SpecConfig.instance.rails_version
+    if rails_version && rails_version.to_f < 7.0 && RUBY_VERSION >= '2.7'
+      env['RUBYOPT'] = '-rlogger'
+    end
+    env
+  end
+
   def wait_for_port(port, timeout, process)
     deadline = Mongoid::Utils.monotonic_time + timeout
     loop do

data/spec/integration/associations/has_and_belongs_to_many_spec.rb

@@ -87,8 +87,23 @@ describe 'has_and_belongs_to_many associations' do
       })
     end
 
-    it 'does not raise on save' do
-      expect { image_block.save! }.not_to raise_error
+    # The nested attributes are processed before the attachment_ids
+    # assignment is applied, so at that point the id is not yet in the
+    # association and resolving it requires a collection-wide lookup.
+    context 'when allow_reparenting_via_nested_attributes is false' do
+      config_override :allow_reparenting_via_nested_attributes, false
+
+      it 'raises a document not found error' do
+        expect { image_block.save! }.to raise_error(Mongoid::Errors::DocumentNotFound)
+      end
+    end
+
+    context 'when allow_reparenting_via_nested_attributes is true' do
+      config_override :allow_reparenting_via_nested_attributes, true
+
+      it 'does not raise on save' do
+        expect { image_block.save! }.not_to raise_error
+      end
     end
   end
 

data/spec/integration/dots_and_dollars_spec.rb

@@ -268,10 +268,20 @@ describe "Dots and Dollars" do
         DADMUser.where("$_amount": 0).first
       end
 
-      it "raise an error" do
+      it 'raises an error' do
         expect do
           queried
-        end.to raise_error(Mongo::Error::OperationFailure)
+        end.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+
+      context 'when allow_unsafe_query_operators is true' do
+        config_override :allow_unsafe_query_operators, true
+
+        it 'raises an error from the server' do
+          expect do
+            queried
+          end.to raise_error(Mongo::Error::OperationFailure)
+        end
       end
     end
   end

data/spec/integration/encryption_spec.rb

@@ -34,19 +34,24 @@ describe 'Encryption' do
   around do |example|
     Mongoid.default_client[Crypt::Patient.collection_name].drop
     Mongoid.default_client[Crypt::Car.collection_name].drop
+    Mongoid.default_client[Crypt::Folder.collection_name].drop
     existing_key_id = Crypt::Patient.encrypt_metadata[:key_id]
     Crypt::Patient.set_key_id(data_key_id)
     Crypt::Car.set_key_id(data_key_id)
+    Crypt::Note.set_key_id(data_key_id)
     Mongoid::Config.send(:clients=, config)
     Mongoid::Clients.with_name(:key_vault)[key_vault_collection].drop
     Crypt::Patient.store_in(client: :encrypted)
     Crypt::Car.store_in(client: :encrypted, database: Crypt::Car.storage_options[:database])
+    Crypt::Folder.store_in(client: :encrypted)
 
     example.run
 
     Crypt::Patient.reset_storage_options!
+    Crypt::Folder.reset_storage_options!
     Crypt::Patient.set_key_id(existing_key_id)
     Crypt::Car.set_key_id(existing_key_id)
+    Crypt::Note.set_key_id(existing_key_id)
   end
 
   it 'encrypts and decrypts fields' do
@@ -86,6 +91,17 @@ describe 'Encryption' do
     end
   end
 
+  # Nothing about the parent document says it needs a schema: it has no
+  # encrypted field of its own and no encrypt_with. Its collection still needs
+  # one, or the embedded field goes out in the clear.
+  it 'stores an embedded field encrypted when the parent has no encrypted field' do
+    folder = Crypt::Folder.create!(note: Crypt::Note.new(text: 'SECRET'))
+    unencrypted_client[Crypt::Folder.collection.name].find(_id: folder.id).first.tap do |doc|
+      expect(doc['note']['text']).to be_a(BSON::Binary)
+      expect(doc['note']['text'].type).to eq(:ciphertext)
+    end
+  end
+
   it 'stores data encrypted in the non-default database' do
     car = Crypt::Car.create!(vin: 'VA1234')
     unencrypted_client
@@ -96,5 +112,138 @@ describe 'Encryption' do
     end
   end
 
+  # The encryption schema map is keyed by namespace and built once, when the
+  # client is constructed. Whenever the namespace an encrypted model actually
+  # writes to is not in that map, the driver encrypts nothing and reports no
+  # error, so the field lands in the clear. Mongoid fails closed instead.
+  describe 'when the target namespace is not in the encryption schema map' do
+    let(:scratch_databases) do
+      %w[vehicles_dynamic vehicles_tenant_b vehicles_tenant_c tenant_a]
+    end
+
+    around do |example|
+      original_options = {
+        Crypt::DynamicCar => Crypt::DynamicCar.storage_options,
+        Crypt::TenantCar => Crypt::TenantCar.storage_options
+      }
+      existing_key_ids = original_options.keys.to_h { |model| [ model, model.encrypt_metadata[:key_id] ] }
+      original_options.each_key do |model|
+        model.set_key_id(data_key_id)
+        model.store_in(client: :encrypted)
+      end
+      clean_scratch_data
+      # The schema map is generated when the client is built, so the client has
+      # to be built after the storage options above are in place.
+      Mongoid::Clients.clear
+
+      example.run
+
+      clean_scratch_data
+      original_options.each { |model, options| model.storage_options = options }
+      existing_key_ids.each { |model, key_id| model.set_key_id(key_id) }
+      Mongoid::Clients.clear
+    end
+
+    def clean_scratch_data
+      scratch_databases.each { |database| unencrypted_client.use(database).database.drop }
+      # Crypt::Car writes into the shared 'vehicles' database, which other
+      # examples rely on, so remove only the documents these examples create.
+      unencrypted_client
+        .use(Crypt::Car.storage_options[:database])[Crypt::Car.collection_name.to_s]
+        .delete_many(vin: { '$in' => %w[CLIENT-1 CLIENT-2] })
+    end
+
+    # Reads with a client that has no automatic encryption, to see what really
+    # landed on disk.
+    def documents_with_plaintext_vin(database, collection, vin)
+      unencrypted_client.use(database)[collection].find(vin: vin).to_a
+    end
+
+    context 'when the database name is a callable' do
+      it 'does not store the field in plaintext', :aggregate_failures do
+        expect { Crypt::DynamicCar.create!(vin: 'DYNAMIC-1') }
+          .to raise_error(Mongoid::Errors::NoEncryptionSchema)
+
+        expect(
+          documents_with_plaintext_vin('vehicles_dynamic', Crypt::DynamicCar.collection_name.to_s, 'DYNAMIC-1')
+        ).to be_empty
+      end
+    end
+
+    context 'when the database name is a callable resolved per tenant' do
+      around do |example|
+        Thread.current[:tenant_database] = 'tenant_a'
+        example.run
+        Thread.current[:tenant_database] = nil
+      end
+
+      it 'does not store the field in plaintext', :aggregate_failures do
+        expect { Crypt::TenantCar.create!(vin: 'TENANT-1') }
+          .to raise_error(Mongoid::Errors::NoEncryptionSchema)
+
+        expect(
+          documents_with_plaintext_vin('tenant_a', Crypt::TenantCar.collection_name.to_s, 'TENANT-1')
+        ).to be_empty
+      end
+    end
+
+    context 'when the database is overridden for the block' do
+      it 'does not store the field in plaintext', :aggregate_failures do
+        expect { Crypt::Car.with(database: 'vehicles_tenant_b') { |car| car.create!(vin: 'BLOCK-1') } }
+          .to raise_error(Mongoid::Errors::NoEncryptionSchema)
+
+        expect(
+          documents_with_plaintext_vin('vehicles_tenant_b', Crypt::Car.collection_name.to_s, 'BLOCK-1')
+        ).to be_empty
+      end
+    end
+
+    context 'when the database is overridden globally' do
+      persistence_context_override :database, 'vehicles_tenant_c'
 
+      it 'does not store the field in plaintext', :aggregate_failures do
+        expect { Crypt::Car.create!(vin: 'GLOBAL-1') }
+          .to raise_error(Mongoid::Errors::NoEncryptionSchema)
+
+        expect(
+          documents_with_plaintext_vin('vehicles_tenant_c', Crypt::Car.collection_name.to_s, 'GLOBAL-1')
+        ).to be_empty
+      end
+    end
+
+    context 'when the model is routed to a client without automatic encryption' do
+      it 'does not store the field in plaintext', :aggregate_failures do
+        expect { Crypt::Car.with(client: :default) { |car| car.create!(vin: 'CLIENT-1') } }
+          .to raise_error(Mongoid::Errors::NoEncryptionSchema)
+
+        expect(
+          documents_with_plaintext_vin('vehicles', Crypt::Car.collection_name.to_s, 'CLIENT-1')
+        ).to be_empty
+      end
+    end
+
+    context 'when the parent has no encrypted field of its own' do
+      it 'does not store the embedded field in plaintext', :aggregate_failures do
+        expect { Crypt::Folder.with(client: :default) { |folder| folder.create!(note: Crypt::Note.new(text: 'EMBEDDED-1')) } }
+          .to raise_error(Mongoid::Errors::NoEncryptionSchema)
+
+        expect(
+          unencrypted_client[Crypt::Folder.collection_name.to_s].find('note.text' => 'EMBEDDED-1').to_a
+        ).to be_empty
+      end
+    end
+
+    context 'when the client is overridden globally to one without automatic encryption' do
+      persistence_context_override :client, :default
+
+      it 'does not store the field in plaintext', :aggregate_failures do
+        expect { Crypt::Car.create!(vin: 'CLIENT-2') }
+          .to raise_error(Mongoid::Errors::NoEncryptionSchema)
+
+        expect(
+          documents_with_plaintext_vin('vehicles', Crypt::Car.collection_name.to_s, 'CLIENT-2')
+        ).to be_empty
+      end
+    end
+  end
 end

data/spec/integration/matcher_operator_data/regex.yml

@@ -135,6 +135,27 @@
       $regex: bar
   matches: false
 
+# Object#=~ is gone as of Ruby 3.2, so an element that cannot be matched
+# against has to be skipped rather than passed to =~.
+- name: array field value - element that cannot be matched against
+  document:
+    title:
+      - 42
+      - foo
+  query:
+    title:
+      $regex: foo
+  matches: true
+
+- name: array field value - no element can be matched against
+  document:
+    title:
+      - 42
+  query:
+    title:
+      $regex: foo
+  matches: false
+
 - name: true field value
   document:
     title: true