mongoid 9.0.12 → 9.0.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 066d78f8b736bad08756e737ff7c0e1d0af9b97149366fc0b5b0a5997c3f1a63
-  data.tar.gz: b55ea0b166bd8d9a0f465e88507ee8db2c4cccc7166477aec4b07a94d98c0a43
+  metadata.gz: 030d90a4693fc5b3ccb72a7069ce6dc912089351df98fd04ead3595a414433a0
+  data.tar.gz: 10362c8758cb9ec1e535b9940eab11088261e7cf4831b8a07bfffb6be231e8df
 SHA512:
-  metadata.gz: 9e6529d35d0fba7786a830bec9ffc87937580c414d6925c5c14f3c799ea03599592ad943783690a29e24ae09f706b6462e42ec1058bd316a023c51d7467c457e
-  data.tar.gz: 6625aaf9412d9ef3e5141b06a019bc83c33446612c3c1b16361473fb5a3ac1a006e2f4d3c6cdf0daa36c0b2b4ee2a9702b135b380011226f219517a578e203ac
+  metadata.gz: 8e5d6bfa84e64cd80f756e55d6fe846f10b5a820c79881b26a54c305f08fb02ef98d27990d7b51b595342844b38c11e04b6e9be911cd3306748c023d226bf9a2
+  data.tar.gz: 5a92a5485360f68cea7bbfa48259f0441f0df723d634926230c80b78784e6f8719083b3fef9d81537223b0da8f2b96563c8d267c4bbe9a372c592b781163fe45

data/lib/config/locales/en.yml

@@ -239,6 +239,13 @@ en:
             Mongoid does not support."
           resolution: "Valid field operators are: %{valid_operators}.
             Ensure you are using one of these operators."
+        invalid_encryption_schema:
+          message: "The encryption schema for %{namespace} is invalid."
+          summary: "Two models writing to %{namespace} describe %{path}
+            differently. The encryption schema has one entry per namespace,
+            so the two descriptions cannot both be used."
+          resolution: "Make the models agree on the encryption options of the
+            conflicting field, or store them in different collections."
         invalid_estimated_count_criteria:
           message: "Invalid criteria for estimated_count."
           summary: "Estimated count is strictly a collection-level operation and cannot be called
@@ -544,22 +551,35 @@ en:
         no_encryption_schema:
           message: "The encryption schema of client %{client} does not cover
             %{namespace}."
-          summary: "%{klass} declares encrypted fields, but the namespace it
-            resolved to, %{namespace}, is not part of the automatic encryption
-            schema of client %{client}. The encryption schema is built once,
-            when the client is created, and is keyed by namespace, so a
-            database name that is only known later - a callable :database
-            option, Model.with(database:), Mongoid.override_database - is not
-            in it. Routing the model to a client that has no
-            auto_encryption_options has the same effect. Mongoid refuses the
-            operation because the driver would store the declared fields in
-            plaintext without reporting an error."
+          summary: "%{klass} declares encrypted fields, directly or through
+            an embedded model, but the namespace it resolved to, %{namespace},
+            is not part of the automatic encryption schema of client
+            %{client}. The encryption schema is built once, when the client
+            is created, and is keyed by namespace, so a database name that is
+            only known later - a callable :database option,
+            Model.with(database:), Mongoid.override_database - is not in it.
+            The same happens when an embedded model with encrypted fields was
+            not yet loaded when the client was created. Routing the model to a
+            client that has no auto_encryption_options has the same effect.
+            Mongoid refuses the operation because the driver would store the
+            declared fields in plaintext without reporting an error."
           resolution: "Give the model a namespace that is known when the
             client is created, and a client configured with
-            auto_encryption_options. If the model has to live in a database
+            auto_encryption_options. Load all models, including embedded
+            ones, before the first client is created, for example by
+            preloading them at boot. If the model has to live in a database
             chosen at runtime, configure one client per database, each with
             its own auto_encryption_options, and select between them with
             Model.with(client:) instead of switching the database."
+        no_encryption_schema_field:
+          message: "The encryption schema of client %{client} does not cover
+            the field %{field} of %{namespace}."
+          summary: "The namespace %{namespace} is in the automatic encryption
+            schema of client %{client}, but its entry does not encrypt
+            %{field}, which %{klass} declares as encrypted. Mongoid refuses
+            the operation rather than storing the field in plaintext."
+          resolution: "Regenerate the schema map of the client, or add
+            %{field} to the schema entry for %{namespace}."
         no_map_reduce_output:
           message: "No output location was specified for the map/reduce
             operation."

data/lib/mongoid/association/embedded/batchable.rb

@@ -138,6 +138,14 @@ module Mongoid
             _base.collect_children.each do |child|
               child.delayed_atomic_sets.clear
             end
+
+            # If the base document is itself inserted wholesale via a $set of
+            # its atomic path, that $set already contains these documents, and
+            # a nested $set under the same path would conflict with it. The
+            # cleanup above has already cleared the delayed sets the assigned
+            # children recorded, so skipping the recording here is safe.
+            return if _base.settable?
+
             _base.delayed_atomic_sets[path] = sets
           end
         end

data/lib/mongoid/clients/factory.rb

@@ -91,6 +91,8 @@ module Mongoid
         return nil unless opts[:auto_encryption_options]
 
         opts[:auto_encryption_options].dup.tap do |auto_encryption_options|
+          Mongoid::Warnings.warn_bypass_auto_encryption if auto_encryption_options[:bypass_auto_encryption]
+
           if auto_encryption_options.key?(:schema_map)
             default_logger.warn(
               'The :schema_map is configured in the :auto_encryption_options for the client;' +

data/lib/mongoid/config/encryption.rb

@@ -21,7 +21,11 @@ module Mongoid
       #
       # @return [ Hash ] The encryption schema map.
       def encryption_schema_map(default_database, models = ::Mongoid.models)
-        models.each_with_object({}) do |model, map|
+        # Subclasses share their parent's collection but are not registered in
+        # Mongoid.models, so they have to be added to the walk explicitly.
+        classes = models.flat_map { |model| [ model ] + model.descendants }.uniq
+
+        classes.each_with_object({}) do |model, map|
           next if model.embedded?
           next unless model.requires_encryption_schema?
 
@@ -35,14 +39,33 @@ module Mongoid
           next if database.respond_to?(:call)
 
           key = "#{database}.#{model.collection_name}"
-          props = metadata_for(model).merge(properties_for(model, [ model ]))
+          props = metadata_for(model).merge(properties_for(model, [ model ], key))
+          next if props.empty?
+
           # The root of a collection schema describes the document, so it is
           # always an object. Saying so matters when a nested schema carries
           # encryptMetadata: mongocryptd rejects the schema otherwise.
-          map[key] = { 'bsonType' => 'object' }.merge(props) unless props.empty?
+          entry = { 'bsonType' => 'object' }.merge(props)
+          map[key] = map.key?(key) ? merge_schema_entries(map[key], entry, key) : entry
         end
       end
 
+      # Collect the paths of the fields encrypted by the schema generated for
+      # a single model.
+      #
+      # @param [ Mongoid::Document ] model The model.
+      #
+      # @return [ Array<Array<String>> ] The property paths, outermost first.
+      #
+      # @api private
+      def encrypted_paths_for(model)
+        return model.instance_variable_get(:@encrypted_paths_for) if
+          model.instance_variable_defined?(:@encrypted_paths_for)
+
+        properties = properties_for(model, [ model ])['properties'] || {}
+        model.instance_variable_set(:@encrypted_paths_for, collect_encrypted_paths(properties, []))
+      end
+
       private
 
       # The algorithm to use for the deterministic encryption.
@@ -110,10 +133,12 @@ module Mongoid
       # @param [ Mongoid::Document ] model The model to generate the properties for.
       # @param [ Array<Mongoid::Document> ] path The models the walk is already
       #   inside of, outermost first.
+      # @param [ String | nil ] namespace The namespace the schema is built
+      #   for, used for error reporting.
       #
       # @return [ Hash ] The encryption properties.
-      def properties_for(model, path)
-        result = properties_for_fields(model).merge(properties_for_relations(model, path))
+      def properties_for(model, path, namespace = nil)
+        result = properties_for_fields(model).merge(properties_for_relations(model, path, namespace))
         if result.empty?
           {}
         else
@@ -152,9 +177,11 @@ module Mongoid
       # @param [ Mongoid::Document ] model The model to generate the properties for.
       # @param [ Array<Mongoid::Document> ] path The models the walk is already
       #   inside of, outermost first.
+      # @param [ String | nil ] namespace The namespace the schema is built
+      #   for, used for error reporting.
       #
       # @return [ Hash ] The encryption properties.
-      def properties_for_relations(model, path)
+      def properties_for_relations(model, path, namespace = nil)
         model.relations.each_with_object({}) do |(name, relation), props|
           # relation_class constantizes, and a polymorphic embedded_in has no
           # class to resolve, so the relation type has to be checked first.
@@ -164,21 +191,125 @@ module Mongoid
           # An association target does not have to be a Mongoid document, and
           # the class it names does not have to exist.
           next unless klass.respond_to?(:requires_encryption_schema?)
-          # Stop at a model the walk is already inside of, or a self-embedding
-          # model never terminates. The path covers the current branch only:
-          # a model embedded by two parents, or twice by one parent, has to be
-          # emitted at every place it appears.
-          next if path.include?(klass)
-          next unless klass.requires_encryption_schema?
-
-          metadata_for(klass).merge(
-            properties_for(klass, path + [ klass ])
-          ).tap do |properties|
-            props[name] = { 'bsonType' => 'object' }.merge(properties) unless properties.empty?
+
+          # Any subclass of the declared class can be assigned to the
+          # association, so its encrypted fields have to be mapped here too.
+          properties = ([ klass ] + klass.descendants).uniq.inject({}) do |merged, candidate|
+            # Stop at a model the walk is already inside of, or a self-embedding
+            # model never terminates. The path covers the current branch only:
+            # a model embedded by two parents, or twice by one parent, has to be
+            # emitted at every place it appears.
+            next merged if path.include?(candidate)
+            next merged unless candidate.respond_to?(:requires_encryption_schema?)
+            next merged unless candidate.requires_encryption_schema?
+
+            merge_schema_entries(
+              merged,
+              metadata_for(candidate).merge(
+                properties_for(candidate, path + [ candidate ], namespace)
+              ),
+              namespace
+            )
           end
+          props[name] = { 'bsonType' => 'object' }.merge(properties) unless properties.empty?
         end
       end
 
+      # Walk the schema properties and collect the path of every encrypted
+      # leaf.
+      #
+      # @param [ Hash ] properties The properties to walk.
+      # @param [ Array<String> ] path The properties the walk is already
+      #   inside of.
+      #
+      # @return [ Array<Array<String>> ] The property paths.
+      def collect_encrypted_paths(properties, path)
+        properties.each_with_object([]) do |(name, schema), paths|
+          if schema.key?('encrypt')
+            paths << (path + [ name ])
+          elsif schema['properties']
+            paths.concat(collect_encrypted_paths(schema['properties'], path + [ name ]))
+          end
+        end
+      end
+
+      # Merge two schema objects covering the same model or namespace.
+      #
+      # Every model writing to one namespace contributes an entry to the
+      # schema map. Those entries have to agree on everything they have in
+      # common, or the schema would silently encrypt a field differently for
+      # one model than for another.
+      #
+      # @param [ Hash ] left The first schema.
+      # @param [ Hash ] right The second schema.
+      # @param [ String | nil ] namespace The namespace the schema belongs to.
+      #
+      # @return [ Hash ] The merged schema.
+      def merge_schema_entries(left, right, namespace = nil)
+        left.merge(right) do |key, left_value, right_value|
+          case key
+          when 'bsonType'
+            left_value
+          when 'encryptMetadata'
+            merge_encrypt_metadata(left_value, right_value, namespace)
+          when 'properties'
+            merge_properties(left_value, right_value, namespace)
+          else
+            raise_invalid_encryption_schema(namespace, key)
+          end
+        end
+      end
+
+      # Merge two encryptMetadata objects.
+      #
+      # @param [ Hash ] left The first encryptMetadata object.
+      # @param [ Hash ] right The second encryptMetadata object.
+      # @param [ String | nil ] namespace The namespace the schema belongs to.
+      #
+      # @return [ Hash ] The merged encryptMetadata object.
+      def merge_encrypt_metadata(left, right, namespace)
+        left.merge(right) do |key, left_value, right_value|
+          unless left_value == right_value
+            raise_invalid_encryption_schema(namespace, "encryptMetadata.#{key}")
+          end
+
+          left_value
+        end
+      end
+
+      # Merge two properties objects.
+      #
+      # @param [ Hash ] left The first properties object.
+      # @param [ Hash ] right The second properties object.
+      # @param [ String | nil ] namespace The namespace the schema belongs to.
+      #
+      # @return [ Hash ] The merged properties object.
+      def merge_properties(left, right, namespace)
+        left.merge(right) do |name, left_value, right_value|
+          if left_value.key?('encrypt') && right_value.key?('encrypt')
+            unless left_value['encrypt'] == right_value['encrypt']
+              raise_invalid_encryption_schema(namespace, "properties.#{name}")
+            end
+
+            left_value
+          elsif left_value.key?('encrypt') || right_value.key?('encrypt')
+            raise_invalid_encryption_schema(namespace, "properties.#{name}")
+          else
+            merge_schema_entries(left_value, right_value, namespace)
+          end
+        end
+      end
+
+      # Raise an error for a schema conflicting with another one.
+      #
+      # @param [ String | nil ] namespace The namespace the schema belongs to.
+      # @param [ String ] path The conflicting path in the schema.
+      #
+      # @raise [ Errors::InvalidEncryptionSchema ] Always raised.
+      def raise_invalid_encryption_schema(namespace, path)
+        raise Errors::InvalidEncryptionSchema.new(namespace, path)
+      end
+
       # Get the BSON type identifier for the provided field according to the
       # https://www.mongodb.com/docs/manual/reference/bson-types/#std-label-bson-types
       #

data/lib/mongoid/encryptable.rb

@@ -44,21 +44,29 @@ module Mongoid
       # group has no encrypted field of its own, but its collection still needs
       # a schema, otherwise the embedded fields are written in plaintext.
       #
-      # The answer is memoized, since this runs on the persistence path.
-      # Declaring encryption on a model after it has already been persisted is
-      # not supported.
+      # This runs on the persistence path, so the answer is memoized. A true
+      # answer is always memoized. A false answer is memoized only when every
+      # embeds_one target in the walk resolved to a class; if one could not be
+      # resolved yet, the answer is recomputed next time, so a class loaded
+      # later is still detected. Declaring encryption on a model after it has
+      # already been persisted is not supported.
       #
       # @return [ true | false ] Whether the model needs an encryption schema.
       #
       # @api private
       def requires_encryption_schema?
         return @requires_encryption_schema if defined?(@requires_encryption_schema)
+        return @requires_encryption_schema = true if encrypted?
 
-        @requires_encryption_schema = encrypted? || embeds_encrypted?([ self ])
+        found, complete = embedded_encryption_scan([ self ])
+        @requires_encryption_schema = found if found || complete
+        found
       end
 
-      # Whether any model reachable through this model's embeds_one relations
-      # declares encryption.
+      # Walks the models reachable through this model's embeds_one relations,
+      # looking for one that declares encryption. Subclasses of an
+      # association target are included: any of them can be assigned to the
+      # association.
       #
       # embeds_many is not considered: libmongocrypt cannot express per-field
       # encryption under array items, so those fields are never mapped.
@@ -66,21 +74,40 @@ module Mongoid
       # @param [ Array<Class> ] path The models the walk is already inside of.
       #   A model embedding itself terminates here.
       #
-      # @return [ true | false ] Whether an embedded model is encrypted.
+      # @return [ Array<true | false> ] A pair: whether an embedded model is
+      #   encrypted, and whether every embeds_one target the walk needed
+      #   resolved to a class. The second value is only meaningful when the
+      #   first is false.
       #
       # @api private
-      def embeds_encrypted?(path)
-        relations.each_value.any? do |relation|
-          next false unless relation.is_a?(Association::Embedded::EmbedsOne)
+      def embedded_encryption_scan(path)
+        complete = true
+
+        relations.each_value do |relation|
+          next unless relation.is_a?(Association::Embedded::EmbedsOne)
 
           klass = relation.try_relation_class
-          # An association target does not have to be a Mongoid document, and
-          # the class it names does not have to exist.
-          next false unless klass.respond_to?(:encrypted?)
-          next false if path.include?(klass)
+          # The class an association names does not have to exist yet.
+          if klass.nil?
+            complete = false
+            next
+          end
+
+          # An association target does not have to be a Mongoid document.
+          next unless klass.respond_to?(:encrypted?)
+
+          ([ klass ] + klass.descendants).uniq.each do |candidate|
+            next if path.include?(candidate)
+            return [ true, true ] if candidate.encrypted?
 
-          klass.encrypted? || klass.embeds_encrypted?(path + [ klass ])
+            found, nested_complete = candidate.embedded_encryption_scan(path + [ candidate ])
+            return [ true, true ] if found
+
+            complete &&= nested_complete
+          end
         end
+
+        [ false, complete ]
       end
 
       # Override the key_id for the model.

data/lib/mongoid/errors/invalid_encryption_schema.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Mongoid
+  module Errors
+    # This error is raised when two models writing to the same namespace
+    # describe a field, or the collection metadata, differently. The schema map
+    # has one entry per namespace, so the two descriptions cannot both be
+    # honored.
+    class InvalidEncryptionSchema < MongoidError
+      # Create the new error.
+      #
+      # @example Create the error.
+      #   InvalidEncryptionSchema.new('music.bands', 'properties.code')
+      #
+      # @param [ String | nil ] namespace The namespace being described.
+      # @param [ String ] path The conflicting path in the schema.
+      def initialize(namespace, path)
+        super(
+          compose_message(
+            'invalid_encryption_schema',
+            { namespace: namespace || 'the collection', path: path }
+          )
+        )
+      end
+    end
+  end
+end

data/lib/mongoid/errors/no_encryption_schema.rb

@@ -15,11 +15,13 @@ module Mongoid
       # @param [ Class ] klass The model class.
       # @param [ String ] namespace The namespace the model resolved to.
       # @param [ String | Symbol ] client The name of the client in use.
-      def initialize(klass, namespace, client)
+      # @param [ String | nil ] field The encrypted field missing from the
+      #   schema entry, if the namespace itself is covered.
+      def initialize(klass, namespace, client, field = nil)
         super(
           compose_message(
-            'no_encryption_schema',
-            { klass: klass, namespace: namespace, client: client }
+            field ? 'no_encryption_schema_field' : 'no_encryption_schema',
+            { klass: klass, namespace: namespace, client: client, field: field }
           )
         )
       end

data/lib/mongoid/errors.rb

@@ -20,6 +20,7 @@ require "mongoid/errors/invalid_collection"
 require "mongoid/errors/invalid_config_file"
 require "mongoid/errors/invalid_config_option"
 require "mongoid/errors/invalid_dependent_strategy"
+require "mongoid/errors/invalid_encryption_schema"
 require "mongoid/errors/invalid_field"
 require "mongoid/errors/invalid_field_option"
 require "mongoid/errors/invalid_field_type"

data/lib/mongoid/persistence_context.rb

@@ -209,12 +209,15 @@ module Mongoid
     # that schema, and when it is absent it asks the server for a schema
     # instead; a collection without a validator then yields no encryption at
     # all, and no error. Checking the namespace here is what turns that silent
-    # downgrade into a failure.
+    # downgrade into a failure. When the namespace is present, its entry is
+    # checked against the fields the model declares as encrypted too: a
+    # hand-written schema can cover the namespace and still leave out a field.
     #
     # @param [ Mongo::Client ] client The client this context resolved to.
     #
     # @raise [ Errors::NoEncryptionSchema ] if the model needs an encryption
-    #   schema and the client's schema does not cover the target namespace.
+    #   schema and the client's schema does not cover the target namespace, or
+    #   the namespace entry does not cover every encrypted field of the model.
     def verify_encryption_schema!(client)
       klass = @object.is_a?(Class) ? @object : @object.class
       # A model whose encrypted fields all live on embedded models declares no
@@ -229,9 +232,48 @@ module Mongoid
 
       schema_map = client.options.dig(:auto_encryption_options, :schema_map)
       namespace = "#{client.database.name}.#{collection_name}"
-      return if schema_map&.key?(namespace)
+      entry = schema_map && schema_map[namespace]
+      raise Errors::NoEncryptionSchema.new(klass, namespace, client_name) unless entry
 
-      raise Errors::NoEncryptionSchema.new(klass, namespace, client_name)
+      # The schema map may have been written by hand, with symbol keys rather
+      # than strings; both are tolerated at every level.
+      Mongoid.config.encrypted_paths_for(klass).each do |path|
+        next if encryption_schema_has_path?(entry, path)
+
+        raise Errors::NoEncryptionSchema.new(
+          klass, namespace, client_name, path.join('.')
+        )
+      end
+    end
+
+    # Whether a schema entry encrypts the property at the given path.
+    #
+    # @param [ Hash ] entry The namespace schema entry.
+    # @param [ Array<String> ] path The property path, outermost first.
+    #
+    # @return [ true | false ] Whether the leaf is marked as encrypted.
+    def encryption_schema_has_path?(entry, path)
+      node = entry
+      path.each do |name|
+        properties = schema_value(node, 'properties')
+        return false unless properties.is_a?(Hash)
+
+        node = schema_value(properties, name)
+        return false unless node.is_a?(Hash)
+      end
+      !schema_value(node, 'encrypt').nil?
+    end
+
+    # Read a schema key that may be written as a string or a symbol.
+    #
+    # @param [ Hash ] hash The schema object.
+    # @param [ String ] key The key to read.
+    #
+    # @return [ Object ] The value, or nil when the key is absent.
+    def schema_value(hash, key)
+      return hash[key] if hash.key?(key)
+
+      hash[key.to_sym]
     end
 
     def client_options

data/lib/mongoid/search_indexable.rb

@@ -167,7 +167,11 @@ module Mongoid
       #
       # @return [ Array<Hash> ] the raw index documents
       def get_indexes(names)
-        collection.search_indexes.select { |i| names.include?(i['name']) }
+        # Reading index metadata sends no document data, so it is exempt from
+        # the encryption schema check, like the other index operations here.
+        Threaded.with_collection_management do
+          collection.search_indexes.select { |i| names.include?(i['name']) }
+        end
       end
     end
   end

data/lib/mongoid/tasks/database.rb

@@ -65,15 +65,18 @@ module Mongoid
       # @param [ true | false ] wait whether to wait for the indexes to be
       #   built.
       def create_search_indexes(models = ::Mongoid.models, wait: true)
-        searchable = models.select { |m| m.search_index_specs.any? }
+        Threaded.with_collection_management do
+          searchable = models.select { |m| m.search_index_specs.any? }
 
-        # queue up the search index creation requests
-        index_names_by_model = searchable.each_with_object({}) do |model, obj|
-          logger.info("MONGOID: Creating search indexes on #{model}...")
-          obj[model] = model.create_search_indexes
-        end
+          # queue up the search index creation requests
+          index_names_by_model = searchable.each_with_object({}) do |model, obj|
+            logger.info("MONGOID: Creating search indexes on #{model}...")
+            obj[model] = model.create_search_indexes
+          end
 
-        wait_for_search_indexes(index_names_by_model) if wait
+          wait_for_search_indexes(index_names_by_model) if wait
+          index_names_by_model
+        end
       end
 
       # Return the list of indexes by model that exist in the database but aren't

data/lib/mongoid/threaded.rb

@@ -40,7 +40,7 @@ module Mongoid
     EXECUTE_CALLBACKS = '[mongoid]:execute-callbacks'
 
     # The key for the time left in the current in-memory regexp budget.
-    REGEXP_BUDGET_KEY = 'regexp-budget'
+    REGEXP_BUDGET_KEY = '[mongoid]:regexp-budget'
 
     extend self
 

data/lib/mongoid/version.rb

@@ -5,5 +5,5 @@ module Mongoid
   #
   # Note that this file is automatically updated via `rake candidate:create`.
   # Manual changes to this file will be overwritten by that rake task.
-  VERSION = '9.0.12'
+  VERSION = '9.0.13'
 end

data/lib/mongoid/warnings.rb

@@ -37,5 +37,9 @@ module Mongoid
     warning :autosave_saves_unchanged_documents, "Autosave associations are currently configured to save documents even if they haven't changed. " \
                                                  'This legacy behavior is deprecated. Set Mongoid.autosave_saves_unchanged_documents to false to ' \
                                                  'skip saving unchanged documents in autosave associations.'
+    warning :bypass_auto_encryption,
+            'auto_encryption_options includes bypass_auto_encryption: true. The driver ' \
+            'will not encrypt anything for this client: fields declared with encrypt: true ' \
+            'are written to the database unencrypted.'
   end
 end