mongoid 9.0.11 → 9.0.13

data/lib/mongoid/tasks/database.rb

@@ -65,15 +65,18 @@ module Mongoid
       # @param [ true | false ] wait whether to wait for the indexes to be
       #   built.
       def create_search_indexes(models = ::Mongoid.models, wait: true)
-        searchable = models.select { |m| m.search_index_specs.any? }
+        Threaded.with_collection_management do
+          searchable = models.select { |m| m.search_index_specs.any? }
 
-        # queue up the search index creation requests
-        index_names_by_model = searchable.each_with_object({}) do |model, obj|
-          logger.info("MONGOID: Creating search indexes on #{model}...")
-          obj[model] = model.create_search_indexes
-        end
+          # queue up the search index creation requests
+          index_names_by_model = searchable.each_with_object({}) do |model, obj|
+            logger.info("MONGOID: Creating search indexes on #{model}...")
+            obj[model] = model.create_search_indexes
+          end
 
-        wait_for_search_indexes(index_names_by_model) if wait
+          wait_for_search_indexes(index_names_by_model) if wait
+          index_names_by_model
+        end
       end
 
       # Return the list of indexes by model that exist in the database but aren't
@@ -84,6 +87,12 @@ module Mongoid
       #
       # @return [ Array<Hash> ] The list of undefined indexes by model.
       def undefined_indexes(models = ::Mongoid.models)
+        Threaded.with_collection_management do
+          undefined_indexes_for(models)
+        end
+      end
+
+      def undefined_indexes_for(models)
         undefined_by_model = {}
 
         models.each do |model|
@@ -116,15 +125,17 @@ module Mongoid
       #
       # @return [ Hash{Class => Array(Hash)}] The list of indexes that were removed by model.
       def remove_undefined_indexes(models = ::Mongoid.models)
-        undefined_indexes(models).each do |model, indexes|
-          indexes.each do |index|
-            key = index['key'].symbolize_keys
-            collection = model.collection
-            collection.indexes(session: model.send(:_session)).drop_one(key)
-            logger.info(
-              "MONGOID: Removed index '#{index['name']}' on collection " +
-              "'#{collection.name}' in database '#{collection.database.name}'."
-            )
+        Threaded.with_collection_management do
+          undefined_indexes(models).each do |model, indexes|
+            indexes.each do |index|
+              key = index['key'].symbolize_keys
+              collection = model.collection
+              collection.indexes(session: model.send(:_session)).drop_one(key)
+              logger.info(
+                "MONGOID: Removed index '#{index['name']}' on collection " +
+                "'#{collection.name}' in database '#{collection.database.name}'."
+              )
+            end
           end
         end
       end
@@ -170,6 +181,12 @@ module Mongoid
       #
       # @return [ Array<Class> ] The sharded models
       def shard_collections(models = ::Mongoid.models)
+        Threaded.with_collection_management do
+          shard_collections_for(models)
+        end
+      end
+
+      def shard_collections_for(models)
         models.map do |model|
           next if model.shard_config.nil?
 

data/lib/mongoid/threaded.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+# rubocop:todo all
 
 require 'mongoid/threaded/lifecycle'
 
@@ -25,6 +26,9 @@ module Mongoid
       hash[key] = "[mongoid]:#{key}-stack"
     end
 
+    # The name of the stack tracking collection and index management.
+    COLLECTION_MANAGEMENT = :collection_management
+
     # The key for the current thread's sessions.
     SESSIONS_KEY = '[mongoid]:sessions'
 
@@ -35,6 +39,9 @@ module Mongoid
     # executed on documents.
     EXECUTE_CALLBACKS = '[mongoid]:execute-callbacks'
 
+    # The key for the time left in the current in-memory regexp budget.
+    REGEXP_BUDGET_KEY = '[mongoid]:regexp-budget'
+
     extend self
 
     # Queries the thread-local variable with the given name. If a block is
@@ -152,6 +159,36 @@ module Mongoid
       !stack(name).empty?
     end
 
+    # Execute the block as collection or index management.
+    #
+    # Creating, dropping and inspecting collections and indexes sends no
+    # document data, so these operations are exempt from the encryption schema
+    # check that PersistenceContext applies to reads and writes. Without the
+    # exemption, tasks such as db:mongoid:create_collections would need an
+    # encryption-capable client to run.
+    #
+    # @example Create a collection.
+    #   Threaded.with_collection_management { model.create_collection }
+    #
+    # @return [ Object ] The result of the block.
+    def with_collection_management
+      begin_execution(COLLECTION_MANAGEMENT)
+      yield
+    ensure
+      exit_execution(COLLECTION_MANAGEMENT)
+    end
+
+    # Is collection or index management being executed?
+    #
+    # @example Is a collection being managed?
+    #   Threaded.managing_collection?
+    #
+    # @return [ true | false ] Whether collection or index management is in
+    #   progress on the current thread.
+    def managing_collection?
+      executing?(COLLECTION_MANAGEMENT)
+    end
+
     # Exit from a named thread local stack.
     #
     # @example Exit from the stack.

data/lib/mongoid/version.rb

@@ -5,5 +5,5 @@ module Mongoid
   #
   # Note that this file is automatically updated via `rake candidate:create`.
   # Manual changes to this file will be overwritten by that rake task.
-  VERSION = '9.0.11'
+  VERSION = '9.0.13'
 end

data/lib/mongoid/warnings.rb

@@ -37,5 +37,9 @@ module Mongoid
     warning :autosave_saves_unchanged_documents, "Autosave associations are currently configured to save documents even if they haven't changed. " \
                                                  'This legacy behavior is deprecated. Set Mongoid.autosave_saves_unchanged_documents to false to ' \
                                                  'skip saving unchanged documents in autosave associations.'
+    warning :bypass_auto_encryption,
+            'auto_encryption_options includes bypass_auto_encryption: true. The driver ' \
+            'will not encrypt anything for this client: fields declared with encrypt: true ' \
+            'are written to the database unencrypted.'
   end
 end

data/spec/integration/app_spec.rb

@@ -459,6 +459,13 @@ describe 'Mongoid application tests' do
     end
     gemfile_lines << "gem 'mongoid', path: '#{File.expand_path(BASE)}'\n"
 
+    # json 3.0 removed the quirks_mode and max_nesting keywords that
+    # ActiveSupport::JSON (every 7.x) still passes to JSON.generate and
+    # JSON.parse, so a freshly resolved bundle picks a 3.x json and the app
+    # fails to encode any response with ArgumentError: unknown keyword:
+    # quirks_mode. Cap json at 2.x, which still accepts those keywords.
+    gemfile_lines << "gem 'json', '< 3'\n"
+
     # Rails 6.0 and 6.1 need logger gem on Ruby 2.7+ due to stdlib changes
     if rails_version && rails_version.to_f < 7.0 && RUBY_VERSION >= '2.7'
       gemfile_lines << "gem 'logger'\n"

data/spec/integration/associations/has_and_belongs_to_many_spec.rb

@@ -87,8 +87,23 @@ describe 'has_and_belongs_to_many associations' do
       })
     end
 
-    it 'does not raise on save' do
-      expect { image_block.save! }.not_to raise_error
+    # The nested attributes are processed before the attachment_ids
+    # assignment is applied, so at that point the id is not yet in the
+    # association and resolving it requires a collection-wide lookup.
+    context 'when allow_reparenting_via_nested_attributes is false' do
+      config_override :allow_reparenting_via_nested_attributes, false
+
+      it 'raises a document not found error' do
+        expect { image_block.save! }.to raise_error(Mongoid::Errors::DocumentNotFound)
+      end
+    end
+
+    context 'when allow_reparenting_via_nested_attributes is true' do
+      config_override :allow_reparenting_via_nested_attributes, true
+
+      it 'does not raise on save' do
+        expect { image_block.save! }.not_to raise_error
+      end
     end
   end
 

data/spec/integration/atomic/modifiers_spec.rb

@@ -114,4 +114,61 @@ describe Mongoid::Atomic::Modifiers do
     end
   end
 
+  context 'when assigning embeds_many attributes on a new embedded document' do
+    let(:cabinet) do
+      ModifierModels::Cabinet.create!
+    end
+
+    before do
+      cabinet.reload
+    end
+
+    context 'when the nested documents are assigned on the built document' do
+      before do
+        cabinet.build_drawer(matcher: 'all')
+        cabinet.drawer.assign_attributes(items: [ { name: 'a' } ])
+      end
+
+      it 'saves without conflicting $set paths' do
+        expect { cabinet.save! }.not_to raise_error
+
+        cabinet.reload
+        expect(cabinet.drawer.matcher).to eq('all')
+        expect(cabinet.drawer.items.map(&:name)).to eq([ 'a' ])
+      end
+    end
+
+    context 'when the nested documents are assigned via the parent' do
+      before do
+        cabinet.assign_attributes(drawer: { matcher: 'all', items: [ { name: 'a' } ] })
+      end
+
+      it 'saves without conflicting $set paths' do
+        expect { cabinet.save! }.not_to raise_error
+
+        cabinet.reload
+        expect(cabinet.drawer.matcher).to eq('all')
+        expect(cabinet.drawer.items.map(&:name)).to eq([ 'a' ])
+      end
+    end
+
+    context 'when an assigned child has its own embedded collection' do
+      let(:item) { ModifierModels::Item.new(name: 'a') }
+
+      before do
+        item.assign_attributes(widgets: [ { label: 'w' } ])
+        cabinet.build_drawer(matcher: 'all')
+        cabinet.drawer.assign_attributes(items: [ item ])
+      end
+
+      it 'does not write the child collection to the root document' do
+        expect { cabinet.save! }.not_to raise_error
+
+        stored = ModifierModels::Cabinet.collection.find(_id: cabinet.id).first
+        expect(stored.keys).to contain_exactly('_id', 'drawer')
+        expect(stored['drawer']['items'].first['widgets'].first['label']).to eq('w')
+      end
+    end
+  end
+
 end

data/spec/integration/dots_and_dollars_spec.rb

@@ -268,10 +268,20 @@ describe "Dots and Dollars" do
         DADMUser.where("$_amount": 0).first
       end
 
-      it "raise an error" do
+      it 'raises an error' do
         expect do
           queried
-        end.to raise_error(Mongo::Error::OperationFailure)
+        end.to raise_error(Mongoid::Errors::InvalidQuery)
+      end
+
+      context 'when allow_unsafe_query_operators is true' do
+        config_override :allow_unsafe_query_operators, true
+
+        it 'raises an error from the server' do
+          expect do
+            queried
+          end.to raise_error(Mongo::Error::OperationFailure)
+        end
       end
     end
   end

data/spec/integration/encryption_spec.rb

@@ -34,19 +34,24 @@ describe 'Encryption' do
   around do |example|
     Mongoid.default_client[Crypt::Patient.collection_name].drop
     Mongoid.default_client[Crypt::Car.collection_name].drop
+    Mongoid.default_client[Crypt::Folder.collection_name].drop
     existing_key_id = Crypt::Patient.encrypt_metadata[:key_id]
     Crypt::Patient.set_key_id(data_key_id)
     Crypt::Car.set_key_id(data_key_id)
+    Crypt::Note.set_key_id(data_key_id)
     Mongoid::Config.send(:clients=, config)
     Mongoid::Clients.with_name(:key_vault)[key_vault_collection].drop
     Crypt::Patient.store_in(client: :encrypted)
     Crypt::Car.store_in(client: :encrypted, database: Crypt::Car.storage_options[:database])
+    Crypt::Folder.store_in(client: :encrypted)
 
     example.run
 
     Crypt::Patient.reset_storage_options!
+    Crypt::Folder.reset_storage_options!
     Crypt::Patient.set_key_id(existing_key_id)
     Crypt::Car.set_key_id(existing_key_id)
+    Crypt::Note.set_key_id(existing_key_id)
   end
 
   it 'encrypts and decrypts fields' do
@@ -86,6 +91,17 @@ describe 'Encryption' do
     end
   end
 
+  # Nothing about the parent document says it needs a schema: it has no
+  # encrypted field of its own and no encrypt_with. Its collection still needs
+  # one, or the embedded field goes out in the clear.
+  it 'stores an embedded field encrypted when the parent has no encrypted field' do
+    folder = Crypt::Folder.create!(note: Crypt::Note.new(text: 'SECRET'))
+    unencrypted_client[Crypt::Folder.collection.name].find(_id: folder.id).first.tap do |doc|
+      expect(doc['note']['text']).to be_a(BSON::Binary)
+      expect(doc['note']['text'].type).to eq(:ciphertext)
+    end
+  end
+
   it 'stores data encrypted in the non-default database' do
     car = Crypt::Car.create!(vin: 'VA1234')
     unencrypted_client
@@ -96,5 +112,287 @@ describe 'Encryption' do
     end
   end
 
+  # The encryption schema map is keyed by namespace and built once, when the
+  # client is constructed. Whenever the namespace an encrypted model actually
+  # writes to is not in that map, the driver encrypts nothing and reports no
+  # error, so the field lands in the clear. Mongoid fails closed instead.
+  describe 'when the target namespace is not in the encryption schema map' do
+    let(:scratch_databases) do
+      %w[vehicles_dynamic vehicles_tenant_b vehicles_tenant_c tenant_a]
+    end
+
+    around do |example|
+      original_options = {
+        Crypt::DynamicCar => Crypt::DynamicCar.storage_options,
+        Crypt::TenantCar => Crypt::TenantCar.storage_options
+      }
+      existing_key_ids = original_options.keys.to_h { |model| [ model, model.encrypt_metadata[:key_id] ] }
+      original_options.each_key do |model|
+        model.set_key_id(data_key_id)
+        model.store_in(client: :encrypted)
+      end
+      clean_scratch_data
+      # The schema map is generated when the client is built, so the client has
+      # to be built after the storage options above are in place.
+      Mongoid::Clients.clear
+
+      example.run
+
+      clean_scratch_data
+      original_options.each { |model, options| model.storage_options = options }
+      existing_key_ids.each { |model, key_id| model.set_key_id(key_id) }
+      Mongoid::Clients.clear
+    end
+
+    def clean_scratch_data
+      scratch_databases.each { |database| unencrypted_client.use(database).database.drop }
+      # Crypt::Car writes into the shared 'vehicles' database, which other
+      # examples rely on, so remove only the documents these examples create.
+      unencrypted_client
+        .use(Crypt::Car.storage_options[:database])[Crypt::Car.collection_name.to_s]
+        .delete_many(vin: { '$in' => %w[CLIENT-1 CLIENT-2] })
+    end
+
+    # Reads with a client that has no automatic encryption, to see what really
+    # landed on disk.
+    def documents_with_plaintext_vin(database, collection, vin)
+      unencrypted_client.use(database)[collection].find(vin: vin).to_a
+    end
+
+    context 'when the database name is a callable' do
+      it 'does not store the field in plaintext', :aggregate_failures do
+        expect { Crypt::DynamicCar.create!(vin: 'DYNAMIC-1') }
+          .to raise_error(Mongoid::Errors::NoEncryptionSchema)
+
+        expect(
+          documents_with_plaintext_vin('vehicles_dynamic', Crypt::DynamicCar.collection_name.to_s, 'DYNAMIC-1')
+        ).to be_empty
+      end
+    end
+
+    context 'when the database name is a callable resolved per tenant' do
+      around do |example|
+        Thread.current[:tenant_database] = 'tenant_a'
+        example.run
+        Thread.current[:tenant_database] = nil
+      end
+
+      it 'does not store the field in plaintext', :aggregate_failures do
+        expect { Crypt::TenantCar.create!(vin: 'TENANT-1') }
+          .to raise_error(Mongoid::Errors::NoEncryptionSchema)
+
+        expect(
+          documents_with_plaintext_vin('tenant_a', Crypt::TenantCar.collection_name.to_s, 'TENANT-1')
+        ).to be_empty
+      end
+    end
+
+    context 'when the database is overridden for the block' do
+      it 'does not store the field in plaintext', :aggregate_failures do
+        expect { Crypt::Car.with(database: 'vehicles_tenant_b') { |car| car.create!(vin: 'BLOCK-1') } }
+          .to raise_error(Mongoid::Errors::NoEncryptionSchema)
+
+        expect(
+          documents_with_plaintext_vin('vehicles_tenant_b', Crypt::Car.collection_name.to_s, 'BLOCK-1')
+        ).to be_empty
+      end
+    end
+
+    context 'when the database is overridden globally' do
+      persistence_context_override :database, 'vehicles_tenant_c'
+
+      it 'does not store the field in plaintext', :aggregate_failures do
+        expect { Crypt::Car.create!(vin: 'GLOBAL-1') }
+          .to raise_error(Mongoid::Errors::NoEncryptionSchema)
+
+        expect(
+          documents_with_plaintext_vin('vehicles_tenant_c', Crypt::Car.collection_name.to_s, 'GLOBAL-1')
+        ).to be_empty
+      end
+    end
+
+    context 'when the model is routed to a client without automatic encryption' do
+      it 'does not store the field in plaintext', :aggregate_failures do
+        expect { Crypt::Car.with(client: :default) { |car| car.create!(vin: 'CLIENT-1') } }
+          .to raise_error(Mongoid::Errors::NoEncryptionSchema)
+
+        expect(
+          documents_with_plaintext_vin('vehicles', Crypt::Car.collection_name.to_s, 'CLIENT-1')
+        ).to be_empty
+      end
+    end
+
+    context 'when the parent has no encrypted field of its own' do
+      it 'does not store the embedded field in plaintext', :aggregate_failures do
+        expect { Crypt::Folder.with(client: :default) { |folder| folder.create!(note: Crypt::Note.new(text: 'EMBEDDED-1')) } }
+          .to raise_error(Mongoid::Errors::NoEncryptionSchema)
+
+        expect(
+          unencrypted_client[Crypt::Folder.collection_name.to_s].find('note.text' => 'EMBEDDED-1').to_a
+        ).to be_empty
+      end
+    end
+
+    context 'when the client is overridden globally to one without automatic encryption' do
+      persistence_context_override :client, :default
+
+      it 'does not store the field in plaintext', :aggregate_failures do
+        expect { Crypt::Car.create!(vin: 'CLIENT-2') }
+          .to raise_error(Mongoid::Errors::NoEncryptionSchema)
+
+        expect(
+          documents_with_plaintext_vin('vehicles', Crypt::Car.collection_name.to_s, 'CLIENT-2')
+        ).to be_empty
+      end
+    end
+  end
+
+  # The schema map has one entry per namespace, and it has to cover every model
+  # that writes there: models sharing a collection, subclasses, and subclasses
+  # of embedded models. Documents are read back through a client without
+  # automatic encryption, to see what is actually stored.
+  describe 'when more than one model writes to a namespace' do
+    let(:root_models) do
+      [ Crypt::Badge, Crypt::BadgeScan, Crypt::Member, Crypt::Listing, Crypt::Box, Crypt::Locker ]
+    end
 
+    let(:keyed_models) do
+      [ Crypt::Badge, Crypt::BadgeScan, Crypt::Member, Crypt::PrivateListing, Crypt::Box, Crypt::SecretContent ]
+    end
+
+    around do |example|
+      original_options = root_models.to_h { |model| [ model, model.storage_options ] }
+      existing_key_ids = keyed_models.to_h { |model| [ model, model.encrypt_metadata[:key_id] ] }
+      keyed_models.each { |model| model.set_key_id(data_key_id) }
+      root_models.each do |model|
+        unencrypted_client[model.collection_name.to_s].drop
+        model.store_in(client: :encrypted)
+      end
+      # The schema map is generated when the client is built, so the client has
+      # to be built after the key ids above are in place.
+      Mongoid::Clients.clear
+
+      example.run
+
+      original_options.each { |model, options| model.storage_options = options }
+      existing_key_ids.each { |model, key_id| model.set_key_id(key_id) }
+      Mongoid::Clients.clear
+    end
+
+    def stored_document(model, id)
+      unencrypted_client[model.collection_name.to_s].find(_id: id).first
+    end
+
+    def expect_ciphertext(value)
+      expect(value).to be_a(BSON::Binary).and(have_attributes(type: :ciphertext))
+    end
+
+    context 'when two models are stored in one collection' do
+      it 'stores the fields of both models encrypted', :aggregate_failures do
+        badge = Crypt::Badge.create!(serial: 'SERIAL-1')
+        scan = Crypt::BadgeScan.create!(holder: 'HOLDER-1')
+
+        expect_ciphertext(stored_document(Crypt::Badge, badge.id)['serial'])
+        expect_ciphertext(stored_document(Crypt::BadgeScan, scan.id)['holder'])
+      end
+    end
+
+    context 'when a subclass adds an encrypted field to an encrypted parent' do
+      it 'stores the fields of the parent and of the subclass encrypted', :aggregate_failures do
+        employee = Crypt::Employee.create!(ssn: 'SSN-1', salary: 'SALARY-1')
+
+        stored_document(Crypt::Member, employee.id).tap do |doc|
+          expect_ciphertext(doc['ssn'])
+          expect_ciphertext(doc['salary'])
+        end
+      end
+
+      it 'stores the fields of a sibling subclass encrypted' do
+        contractor = Crypt::Contractor.create!(ssn: 'SSN-2', rate: 'RATE-1')
+
+        expect_ciphertext(stored_document(Crypt::Member, contractor.id)['rate'])
+      end
+
+      it 'reads the fields back' do
+        employee = Crypt::Employee.create!(ssn: 'SSN-3', salary: 'SALARY-3')
+
+        expect(Crypt::Member.find(employee.id).salary).to eq('SALARY-3')
+      end
+    end
+
+    context 'when only a subclass has encrypted fields' do
+      it 'stores the fields of the subclass encrypted' do
+        listing = Crypt::PrivateListing.create!(title: 'TITLE-1', owner_ssn: 'SSN-4')
+
+        expect_ciphertext(stored_document(Crypt::Listing, listing.id)['owner_ssn'])
+      end
+    end
+
+    context 'when a subclass of an embeds_one target adds an encrypted field' do
+      it 'stores the fields of the target and of the subclass encrypted', :aggregate_failures do
+        box = Crypt::Box.create!(item: Crypt::SealedItem.new(label: 'LABEL-1', seal: 'SEAL-1'))
+
+        stored_document(Crypt::Box, box.id)['item'].tap do |item|
+          expect_ciphertext(item['label'])
+          expect_ciphertext(item['seal'])
+        end
+      end
+    end
+
+    context 'when only a subclass of an embeds_one target has encrypted fields' do
+      it 'stores the fields of the subclass encrypted' do
+        locker = Crypt::Locker.create!(content: Crypt::SecretContent.new(label: 'LABEL-2', code: 'CODE-1'))
+
+        expect_ciphertext(stored_document(Crypt::Locker, locker.id)['content']['code'])
+      end
+    end
+
+    # An entry for the namespace exists, but it does not cover every encrypted
+    # field of the model. The driver encrypts what the entry lists and writes
+    # the rest in plaintext.
+    context 'when the schema entry for the namespace misses an encrypted field' do
+      let(:config) do
+        super().merge(
+          partial: {
+            hosts: SpecConfig.instance.addresses,
+            database: database_id,
+            options: {
+              auto_encryption_options: {
+                key_vault_client: :key_vault,
+                kms_providers: kms_providers,
+                key_vault_namespace: key_vault_namespace,
+                extra_options: extra_options,
+                schema_map: partial_schema_map
+              }
+            }
+          }
+        )
+      end
+
+      let(:partial_schema_map) do
+        {
+          "#{database_id}.#{Crypt::Member.collection_name}" => {
+            'bsonType' => 'object',
+            'encryptMetadata' => {
+              'keyId' => [ BSON::Binary.new(Base64.decode64(data_key_id), :uuid) ],
+              'algorithm' => 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
+            },
+            'properties' => {
+              'ssn' => { 'encrypt' => { 'bsonType' => 'string' } }
+            }
+          }
+        }
+      end
+
+      it 'does not store the field in plaintext', :aggregate_failures do
+        expect do
+          Crypt::Employee.with(client: :partial) { |klass| klass.create!(ssn: 'SSN-5', salary: 'PARTIAL-1') }
+        end.to raise_error(Mongoid::Errors::NoEncryptionSchema)
+
+        expect(
+          unencrypted_client[Crypt::Member.collection_name.to_s].find(salary: 'PARTIAL-1').to_a
+        ).to be_empty
+      end
+    end
+  end
 end

data/spec/integration/matcher_operator_data/regex.yml

@@ -135,6 +135,27 @@
       $regex: bar
   matches: false
 
+# Object#=~ is gone as of Ruby 3.2, so an element that cannot be matched
+# against has to be skipped rather than passed to =~.
+- name: array field value - element that cannot be matched against
+  document:
+    title:
+      - 42
+      - foo
+  query:
+    title:
+      $regex: foo
+  matches: true
+
+- name: array field value - no element can be matched against
+  document:
+    title:
+      - 42
+  query:
+    title:
+      $regex: foo
+  matches: false
+
 - name: true field value
   document:
     title: true