mongoid 9.0.12 → 9.0.13

data/spec/integration/atomic/modifiers_spec.rb

@@ -114,4 +114,61 @@ describe Mongoid::Atomic::Modifiers do
     end
   end
 
+  context 'when assigning embeds_many attributes on a new embedded document' do
+    let(:cabinet) do
+      ModifierModels::Cabinet.create!
+    end
+
+    before do
+      cabinet.reload
+    end
+
+    context 'when the nested documents are assigned on the built document' do
+      before do
+        cabinet.build_drawer(matcher: 'all')
+        cabinet.drawer.assign_attributes(items: [ { name: 'a' } ])
+      end
+
+      it 'saves without conflicting $set paths' do
+        expect { cabinet.save! }.not_to raise_error
+
+        cabinet.reload
+        expect(cabinet.drawer.matcher).to eq('all')
+        expect(cabinet.drawer.items.map(&:name)).to eq([ 'a' ])
+      end
+    end
+
+    context 'when the nested documents are assigned via the parent' do
+      before do
+        cabinet.assign_attributes(drawer: { matcher: 'all', items: [ { name: 'a' } ] })
+      end
+
+      it 'saves without conflicting $set paths' do
+        expect { cabinet.save! }.not_to raise_error
+
+        cabinet.reload
+        expect(cabinet.drawer.matcher).to eq('all')
+        expect(cabinet.drawer.items.map(&:name)).to eq([ 'a' ])
+      end
+    end
+
+    context 'when an assigned child has its own embedded collection' do
+      let(:item) { ModifierModels::Item.new(name: 'a') }
+
+      before do
+        item.assign_attributes(widgets: [ { label: 'w' } ])
+        cabinet.build_drawer(matcher: 'all')
+        cabinet.drawer.assign_attributes(items: [ item ])
+      end
+
+      it 'does not write the child collection to the root document' do
+        expect { cabinet.save! }.not_to raise_error
+
+        stored = ModifierModels::Cabinet.collection.find(_id: cabinet.id).first
+        expect(stored.keys).to contain_exactly('_id', 'drawer')
+        expect(stored['drawer']['items'].first['widgets'].first['label']).to eq('w')
+      end
+    end
+  end
+
 end

data/spec/integration/encryption_spec.rb

@@ -246,4 +246,153 @@ describe 'Encryption' do
       end
     end
   end
+
+  # The schema map has one entry per namespace, and it has to cover every model
+  # that writes there: models sharing a collection, subclasses, and subclasses
+  # of embedded models. Documents are read back through a client without
+  # automatic encryption, to see what is actually stored.
+  describe 'when more than one model writes to a namespace' do
+    let(:root_models) do
+      [ Crypt::Badge, Crypt::BadgeScan, Crypt::Member, Crypt::Listing, Crypt::Box, Crypt::Locker ]
+    end
+
+    let(:keyed_models) do
+      [ Crypt::Badge, Crypt::BadgeScan, Crypt::Member, Crypt::PrivateListing, Crypt::Box, Crypt::SecretContent ]
+    end
+
+    around do |example|
+      original_options = root_models.to_h { |model| [ model, model.storage_options ] }
+      existing_key_ids = keyed_models.to_h { |model| [ model, model.encrypt_metadata[:key_id] ] }
+      keyed_models.each { |model| model.set_key_id(data_key_id) }
+      root_models.each do |model|
+        unencrypted_client[model.collection_name.to_s].drop
+        model.store_in(client: :encrypted)
+      end
+      # The schema map is generated when the client is built, so the client has
+      # to be built after the key ids above are in place.
+      Mongoid::Clients.clear
+
+      example.run
+
+      original_options.each { |model, options| model.storage_options = options }
+      existing_key_ids.each { |model, key_id| model.set_key_id(key_id) }
+      Mongoid::Clients.clear
+    end
+
+    def stored_document(model, id)
+      unencrypted_client[model.collection_name.to_s].find(_id: id).first
+    end
+
+    def expect_ciphertext(value)
+      expect(value).to be_a(BSON::Binary).and(have_attributes(type: :ciphertext))
+    end
+
+    context 'when two models are stored in one collection' do
+      it 'stores the fields of both models encrypted', :aggregate_failures do
+        badge = Crypt::Badge.create!(serial: 'SERIAL-1')
+        scan = Crypt::BadgeScan.create!(holder: 'HOLDER-1')
+
+        expect_ciphertext(stored_document(Crypt::Badge, badge.id)['serial'])
+        expect_ciphertext(stored_document(Crypt::BadgeScan, scan.id)['holder'])
+      end
+    end
+
+    context 'when a subclass adds an encrypted field to an encrypted parent' do
+      it 'stores the fields of the parent and of the subclass encrypted', :aggregate_failures do
+        employee = Crypt::Employee.create!(ssn: 'SSN-1', salary: 'SALARY-1')
+
+        stored_document(Crypt::Member, employee.id).tap do |doc|
+          expect_ciphertext(doc['ssn'])
+          expect_ciphertext(doc['salary'])
+        end
+      end
+
+      it 'stores the fields of a sibling subclass encrypted' do
+        contractor = Crypt::Contractor.create!(ssn: 'SSN-2', rate: 'RATE-1')
+
+        expect_ciphertext(stored_document(Crypt::Member, contractor.id)['rate'])
+      end
+
+      it 'reads the fields back' do
+        employee = Crypt::Employee.create!(ssn: 'SSN-3', salary: 'SALARY-3')
+
+        expect(Crypt::Member.find(employee.id).salary).to eq('SALARY-3')
+      end
+    end
+
+    context 'when only a subclass has encrypted fields' do
+      it 'stores the fields of the subclass encrypted' do
+        listing = Crypt::PrivateListing.create!(title: 'TITLE-1', owner_ssn: 'SSN-4')
+
+        expect_ciphertext(stored_document(Crypt::Listing, listing.id)['owner_ssn'])
+      end
+    end
+
+    context 'when a subclass of an embeds_one target adds an encrypted field' do
+      it 'stores the fields of the target and of the subclass encrypted', :aggregate_failures do
+        box = Crypt::Box.create!(item: Crypt::SealedItem.new(label: 'LABEL-1', seal: 'SEAL-1'))
+
+        stored_document(Crypt::Box, box.id)['item'].tap do |item|
+          expect_ciphertext(item['label'])
+          expect_ciphertext(item['seal'])
+        end
+      end
+    end
+
+    context 'when only a subclass of an embeds_one target has encrypted fields' do
+      it 'stores the fields of the subclass encrypted' do
+        locker = Crypt::Locker.create!(content: Crypt::SecretContent.new(label: 'LABEL-2', code: 'CODE-1'))
+
+        expect_ciphertext(stored_document(Crypt::Locker, locker.id)['content']['code'])
+      end
+    end
+
+    # An entry for the namespace exists, but it does not cover every encrypted
+    # field of the model. The driver encrypts what the entry lists and writes
+    # the rest in plaintext.
+    context 'when the schema entry for the namespace misses an encrypted field' do
+      let(:config) do
+        super().merge(
+          partial: {
+            hosts: SpecConfig.instance.addresses,
+            database: database_id,
+            options: {
+              auto_encryption_options: {
+                key_vault_client: :key_vault,
+                kms_providers: kms_providers,
+                key_vault_namespace: key_vault_namespace,
+                extra_options: extra_options,
+                schema_map: partial_schema_map
+              }
+            }
+          }
+        )
+      end
+
+      let(:partial_schema_map) do
+        {
+          "#{database_id}.#{Crypt::Member.collection_name}" => {
+            'bsonType' => 'object',
+            'encryptMetadata' => {
+              'keyId' => [ BSON::Binary.new(Base64.decode64(data_key_id), :uuid) ],
+              'algorithm' => 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
+            },
+            'properties' => {
+              'ssn' => { 'encrypt' => { 'bsonType' => 'string' } }
+            }
+          }
+        }
+      end
+
+      it 'does not store the field in plaintext', :aggregate_failures do
+        expect do
+          Crypt::Employee.with(client: :partial) { |klass| klass.create!(ssn: 'SSN-5', salary: 'PARTIAL-1') }
+        end.to raise_error(Mongoid::Errors::NoEncryptionSchema)
+
+        expect(
+          unencrypted_client[Crypt::Member.collection_name.to_s].find(salary: 'PARTIAL-1').to_a
+        ).to be_empty
+      end
+    end
+  end
 end

data/spec/mongoid/clients/factory_spec.rb

@@ -354,6 +354,42 @@ describe Mongoid::Clients::Factory do
           end
         end
       end
+
+      context 'when bypass_auto_encryption is set' do
+        it 'warns that encryption is bypassed' do
+          expect(Mongoid::Warnings).to receive(:warn_bypass_auto_encryption)
+
+          described_class.send(
+            :build_auto_encryption_options,
+            { auto_encryption_options: { bypass_auto_encryption: true, schema_map: {} } },
+            database_id
+          )
+        end
+      end
+
+      context 'when bypass_auto_encryption is not set' do
+        it 'does not warn' do
+          expect(Mongoid::Warnings).not_to receive(:warn_bypass_auto_encryption)
+
+          described_class.send(
+            :build_auto_encryption_options,
+            { auto_encryption_options: { schema_map: {} } },
+            database_id
+          )
+        end
+      end
+
+      context 'when bypass_auto_encryption is false' do
+        it 'does not warn' do
+          expect(Mongoid::Warnings).not_to receive(:warn_bypass_auto_encryption)
+
+          described_class.send(
+            :build_auto_encryption_options,
+            { auto_encryption_options: { bypass_auto_encryption: false, schema_map: {} } },
+            database_id
+          )
+        end
+      end
     end
 
     context "when no name is provided" do

data/spec/mongoid/config/encryption_spec.rb

@@ -376,5 +376,228 @@ describe Mongoid::Config::Encryption do
         )
       end
     end
+
+    # The map has one entry per namespace. Every model that writes to the
+    # namespace, including subclasses that are never registered in
+    # Mongoid.models, has to be covered by that entry, or its encrypted fields
+    # are written in plaintext.
+    context 'when more than one model writes to a namespace' do
+      let(:encrypt_metadata) do
+        {
+          'keyId' => [ BSON::Binary.new(Base64.decode64('grolrnFVSSW9Gq04Q87R9Q=='), :uuid) ],
+          'algorithm' => 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
+        }
+      end
+
+      let(:encrypted_string) do
+        { 'encrypt' => { 'bsonType' => 'string' } }
+      end
+
+      context 'when two models are stored in one collection' do
+        let(:expected_entry) do
+          {
+            'bsonType' => 'object',
+            'encryptMetadata' => encrypt_metadata,
+            'properties' => {
+              'serial' => encrypted_string,
+              'holder' => encrypted_string
+            }
+          }
+        end
+
+        context 'when the models are registered in one order' do
+          let(:models) do
+            [ Crypt::Badge, Crypt::BadgeScan ]
+          end
+
+          it 'maps the fields of both models' do
+            expect(encryption_schema_map['mongoid_test.crypt_badges']).to eq(expected_entry)
+          end
+        end
+
+        context 'when the models are registered in the other order' do
+          let(:models) do
+            [ Crypt::BadgeScan, Crypt::Badge ]
+          end
+
+          it 'maps the fields of both models' do
+            expect(encryption_schema_map['mongoid_test.crypt_badges']).to eq(expected_entry)
+          end
+        end
+      end
+
+      context 'when a subclass adds an encrypted field to an encrypted parent' do
+        let(:expected_entry) do
+          {
+            'bsonType' => 'object',
+            'encryptMetadata' => encrypt_metadata,
+            'properties' => {
+              'ssn' => encrypted_string,
+              'salary' => encrypted_string,
+              'rate' => encrypted_string
+            }
+          }
+        end
+
+        # Subclasses are not registered in Mongoid.models, so only the parent
+        # is passed in.
+        context 'when only the parent is registered' do
+          let(:models) do
+            [ Crypt::Member ]
+          end
+
+          it 'maps the fields of the parent and of every subclass' do
+            expect(encryption_schema_map['mongoid_test.crypt_members']).to eq(expected_entry)
+          end
+        end
+
+        context 'when a subclass is registered as well' do
+          let(:models) do
+            [ Crypt::Member, Crypt::Employee ]
+          end
+
+          it 'maps the fields of the parent and of every subclass' do
+            expect(encryption_schema_map['mongoid_test.crypt_members']).to eq(expected_entry)
+          end
+        end
+      end
+
+      context 'when only a subclass has encrypted fields' do
+        let(:models) do
+          [ Crypt::Listing ]
+        end
+
+        it 'maps the fields of the subclass' do
+          expect(encryption_schema_map['mongoid_test.crypt_listings']).to eq(
+            'bsonType' => 'object',
+            'encryptMetadata' => encrypt_metadata,
+            'properties' => {
+              'owner_ssn' => encrypted_string
+            }
+          )
+        end
+      end
+
+      context 'when a subclass of an embeds_one target adds an encrypted field' do
+        let(:models) do
+          [ Crypt::Box ]
+        end
+
+        it 'maps the fields of the target and of its subclass' do
+          expect(encryption_schema_map.dig('mongoid_test.crypt_boxes', 'properties', 'item')).to eq(
+            'bsonType' => 'object',
+            'properties' => {
+              'label' => encrypted_string,
+              'seal' => encrypted_string
+            }
+          )
+        end
+      end
+
+      context 'when only a subclass of an embeds_one target has encrypted fields' do
+        let(:models) do
+          [ Crypt::Locker ]
+        end
+
+        it 'maps the fields of the subclass' do
+          expect(encryption_schema_map.dig('mongoid_test.crypt_lockers', 'properties', 'content')).to eq(
+            'bsonType' => 'object',
+            'encryptMetadata' => encrypt_metadata,
+            'properties' => {
+              'code' => encrypted_string
+            }
+          )
+        end
+      end
+
+      # These models are not added to the shared support file: every client
+      # with automatic encryption builds the map over all registered models,
+      # and a conflict would make every such client fail to build.
+      context 'when models on one collection disagree on encryption' do
+        let(:defined_models) { [] }
+
+        after do
+          defined_models.each { |model| Mongoid.deregister_model(model) }
+        end
+
+        def define_model(&block)
+          model = Class.new do
+            include Mongoid::Document
+
+            store_in collection: 'crypt_conflicts'
+          end
+          model.class_eval(&block)
+          defined_models << model
+          model
+        end
+
+        context 'when the same field is encrypted the same way' do
+          let(:models) do
+            [
+              define_model { field :code, type: String, encrypt: { deterministic: true } },
+              define_model { field :code, type: String, encrypt: { deterministic: true } }
+            ]
+          end
+
+          it 'maps the field once' do
+            expect(encryption_schema_map['mongoid_test.crypt_conflicts']).to eq(
+              'bsonType' => 'object',
+              'properties' => {
+                'code' => {
+                  'encrypt' => {
+                    'bsonType' => 'string',
+                    'algorithm' => 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
+                  }
+                }
+              }
+            )
+          end
+        end
+
+        context 'when the same field is encrypted differently' do
+          let(:models) do
+            [
+              define_model { field :code, type: String, encrypt: { deterministic: true } },
+              define_model { field :code, type: String, encrypt: { deterministic: false } }
+            ]
+          end
+
+          it 'raises' do
+            expect { encryption_schema_map }.to raise_error(Mongoid::Errors::InvalidEncryptionSchema)
+          end
+        end
+
+        context 'when the collection metadata differs' do
+          let(:models) do
+            [
+              define_model do
+                encrypt_with key_id: 'grolrnFVSSW9Gq04Q87R9Q==', deterministic: true
+                field :code, type: String, encrypt: true
+              end,
+              define_model do
+                encrypt_with key_id: 'grolrnFVSSW9Gq04Q87R9Q==', deterministic: false
+                field :name, type: String, encrypt: true
+              end
+            ]
+          end
+
+          it 'raises' do
+            expect { encryption_schema_map }.to raise_error(Mongoid::Errors::InvalidEncryptionSchema)
+          end
+        end
+
+        context 'when a subclass encrypts an inherited field differently' do
+          let(:models) do
+            parent = define_model { field :code, type: String, encrypt: { deterministic: true } }
+            Class.new(parent) { field :code, type: String, encrypt: { deterministic: false } }
+            [ parent ]
+          end
+
+          it 'raises' do
+            expect { encryption_schema_map }.to raise_error(Mongoid::Errors::InvalidEncryptionSchema)
+          end
+        end
+      end
+    end
   end
 end

data/spec/mongoid/encryptable_spec.rb

@@ -29,6 +29,14 @@ describe Mongoid::Encryptable do
       end
     end
 
+    # Any subclass of the declared class can be assigned to an embeds_one
+    # association, so the check has to look at the subclasses too.
+    context 'when only a subclass of an embedded model is encrypted' do
+      it 'returns true' do
+        expect(Crypt::Locker.requires_encryption_schema?).to be true
+      end
+    end
+
     context 'when the model declares no encryption anywhere' do
       it 'returns false' do
         expect(Person.requires_encryption_schema?).to be false
@@ -57,5 +65,51 @@ describe Mongoid::Encryptable do
         expect(Crypt::Drawer.requires_encryption_schema?).to be false
       end
     end
+
+    context 'when every embedded association resolves' do
+      it 'memoizes a false answer' do
+        expect(Truck.requires_encryption_schema?).to be false
+        expect(Truck.instance_variable_defined?(:@requires_encryption_schema)).to be true
+      end
+    end
+
+    context 'when an embedded association does not resolve' do
+      it 'does not memoize a false answer' do
+        expect(Crypt::Drawer.requires_encryption_schema?).to be false
+        expect(Crypt::Drawer.instance_variable_defined?(:@requires_encryption_schema)).to be false
+      end
+    end
+
+    context 'when an embedded encrypted class is defined after the first check' do
+      after do
+        if Crypt.const_defined?(:MissingNote, false)
+          Mongoid.deregister_model(Crypt::MissingNote)
+          Crypt.send(:remove_const, :MissingNote)
+        end
+        # While the class above existed, resolving it through the association
+        # memoized the class on the association, and a true answer on the
+        # model. Drop both, so the other examples see the model as it was
+        # before the class was defined.
+        relation = Crypt::Drawer.relations['missing_note']
+        relation.remove_instance_variable(:@klass) if relation.instance_variable_defined?(:@klass)
+        if Crypt::Drawer.instance_variable_defined?(:@requires_encryption_schema)
+          Crypt::Drawer.remove_instance_variable(:@requires_encryption_schema)
+        end
+      end
+
+      it 'returns true once the class is loaded' do
+        expect(Crypt::Drawer.requires_encryption_schema?).to be false
+
+        missing_note = Class.new do
+          include Mongoid::Document
+
+          embedded_in :drawer, class_name: 'Crypt::Drawer'
+          field :text, type: String, encrypt: true
+        end
+        Crypt.const_set(:MissingNote, missing_note)
+
+        expect(Crypt::Drawer.requires_encryption_schema?).to be true
+      end
+    end
   end
 end

data/spec/mongoid/matcher/regexp_budget_spec.rb

@@ -32,6 +32,12 @@ describe Mongoid::Matcher::RegexpBudget do
   # exercising one has to hand .open something to bound.
   let(:regexp_selector) { { 'name' => /\Aabc\z/ } }
 
+  describe 'REGEXP_BUDGET_KEY' do
+    it 'is namespaced so a foreign thread-local cannot collide with it' do
+      expect(Mongoid::Threaded::REGEXP_BUDGET_KEY).to start_with('[mongoid]:')
+    end
+  end
+
   describe '.open' do
     context 'when no limit is configured' do
       config_override :in_memory_regexp_time_limit, nil

data/spec/mongoid/search_indexable_spec.rb

@@ -62,7 +62,7 @@ class SearchIndexHelper
 end
 
 # rubocop:disable RSpec/MultipleMemoizedHelpers
-describe Mongoid::SearchIndexable do
+describe Mongoid::SearchIndexable do # rubocop:disable RSpec/MultipleDescribes
   before do
     skip "#{described_class} requires at Atlas environment (set ATLAS_URI)" if ENV['ATLAS_URI'].nil?
   end
@@ -145,3 +145,36 @@ describe Mongoid::SearchIndexable do
   end
 end
 # rubocop:enable RSpec/MultipleMemoizedHelpers
+
+# A unit test that does not need an Atlas connection.
+describe Mongoid::SearchIndexable, '.wait_for_search_indexes' do
+  # Mongo::Collection#search_indexes was added in driver 2.19; the
+  # driver-min and driver-oldstable CI jobs pin the driver to 2.18-stable.
+  min_driver_version '2.19'
+
+  context 'when an index is ready' do
+    let(:model) do
+      Class.new do
+        include Mongoid::Document
+
+        store_in collection: BSON::ObjectId.new.to_s
+        search_index :idx, mappings: { dynamic: false }
+      end
+    end
+
+    it 'reads the index status inside collection management' do
+      managing = nil
+      search_indexes = [ { 'name' => 'idx', 'queryable' => true, 'status' => 'READY' } ]
+      collection = instance_double(Mongo::Collection)
+      allow(collection).to receive(:search_indexes) do
+        managing = Mongoid::Threaded.managing_collection?
+        search_indexes
+      end
+      allow(model).to receive(:collection).and_return(collection)
+
+      model.wait_for_search_indexes([ 'idx' ])
+
+      expect(managing).to be true
+    end
+  end
+end

data/spec/mongoid/tasks/database_spec.rb

@@ -265,6 +265,19 @@ describe Mongoid::Tasks::Database do
         described_class.create_search_indexes([searchable_model_spy], wait: false)
       end
     end
+
+    context 'when waiting for the indexes' do
+      it 'runs the wait inside collection management' do
+        managing = nil
+        allow(described_class).to receive(:wait_for_search_indexes) do
+          managing = Mongoid::Threaded.managing_collection?
+        end
+
+        described_class.create_search_indexes([ searchable_model_spy ], wait: true)
+
+        expect(managing).to be true
+      end
+    end
   end
 
   describe '.remove_search_indexes' do