mongoid 9.1.0 → 9.1.2

data/lib/mongoid/atomic/modifiers.rb

@@ -13,13 +13,9 @@ module Mongoid
       # @param [ Hash ] modifications The add to set modifiers.
       def add_to_set(modifications)
         modifications.each_pair do |field, value|
-          if add_to_sets.has_key?(field)
-            value.each do |val|
-              add_to_sets[field]['$each'].push(val)
-            end
-          else
-            add_to_sets[field] = { '$each' => value }
-          end
+          mods = add_to_set_conflict?(field) ? conflicting_add_to_sets : add_to_sets
+          add_each_operation(mods, field, value)
+          add_to_set_fields[field.split('.', 2)[0]] = field
         end
       end
 
@@ -31,7 +27,8 @@ module Mongoid
       # @param [ Hash ] modifications The pull all modifiers.
       def pull_all(modifications)
         modifications.each_pair do |field, value|
-          add_operation(pull_alls, field, value)
+          mods = pull_all_conflict?(field) ? conflicting_pull_alls : pull_alls
+          add_operation(mods, field, value)
           pull_fields[field.split('.', 2)[0]] = field
         end
       end
@@ -41,6 +38,14 @@ module Mongoid
       # @example Add pull all operations.
       #   modifiers.pull({ "addresses" => { "_id" => { "$in" => [ 1, 2, 3 ]}}})
       #
+      # A $pull is never split out into a separate write. It shifts the
+      # positions of the remaining array elements, and the paths of the other
+      # operations on that array are built for the positions after the $pull.
+      # In a separate write the $pull could run after them, so they would hit
+      # a different element. Kept in the main update, an operation that
+      # conflicts with the $pull is rejected by MongoDB (code 40) without
+      # changing stored data.
+      #
       # @param [ Hash ] modifications The pull all modifiers.
       def pull(modifications)
         modifications.each_pair do |field, value|
@@ -99,6 +104,7 @@ module Mongoid
           else
             unsets.update(field => true)
           end
+          unset_fields[field.split('.', 2)[0]] = field
         end
       end
 
@@ -166,17 +172,28 @@ module Mongoid
       # @return [ true | false ] If this field is a conflict.
       def set_conflict?(field)
         name = field.split('.', 2)[0]
-        pull_fields.has_key?(name) || push_fields.has_key?(name)
+        pull_fields.has_key?(name) || push_fields.has_key?(name) ||
+          add_to_set_fields.has_key?(name)
       end
 
       # Is the operation going to be a conflict for an $unset?
       #
+      # A $push or $addToSet does not shift existing array element positions,
+      # so a conflicting $unset can be safely applied in a separate write
+      # afterwards. A $pull does shift positions, so the $unset is not split
+      # out in that case; the operations stay in the same update and MongoDB
+      # rejects the update (code 40) without changing stored data, rather
+      # than risking the $unset hitting a different element.
+      #
       # @param [ String ] field The field.
       #
       # @return [ true | false ] If this field is a conflict.
       def unset_conflict?(field)
         key = field.split('.', 2)[0]
-        set_fields.has_key?(key)
+        return true if set_fields.has_key?(key)
+        return false if pull_fields.has_key?(key)
+
+        push_fields.has_key?(key) || add_to_set_fields.has_key?(key)
       end
 
       # Is the operation going to be a conflict for a $push?
@@ -190,9 +207,36 @@ module Mongoid
       def push_conflict?(field)
         name = field.split('.', 2)[0]
         set_fields.has_key?(name) || pull_fields.has_key?(name) ||
+          add_to_set_fields.has_key?(name) || unset_fields.has_key?(name) ||
           (push_fields.keys.count { |item| item.split('.', 2).first == name } > 1)
       end
 
+      # Is the operation going to be a conflict for an $addToSet?
+      #
+      # As with $push, an $addToSet is only split out when the other
+      # operation does not shift array element positions. A conflicting
+      # $pull is left as-is so MongoDB rejects the update rather than the
+      # $addToSet possibly hitting a different element in a separate write.
+      #
+      # @param [ String ] field The field.
+      #
+      # @return [ true | false ] If this field is a conflict.
+      def add_to_set_conflict?(field)
+        name = field.split('.', 2)[0]
+        set_fields.has_key?(name) || push_fields.has_key?(name)
+      end
+
+      # Is the operation going to be a conflict for a $pullAll?
+      #
+      # @param [ String ] field The field.
+      #
+      # @return [ true | false ] If this field is a conflict.
+      def pull_all_conflict?(field)
+        name = field.split('.', 2)[0]
+        set_fields.has_key?(name) || push_fields.has_key?(name) ||
+          add_to_set_fields.has_key?(name) || pull_root?(name)
+      end
+
       # Returns true if the $unset is made redundant by a $set that covers
       # the entire root-level field. When $set "children" is issued, the
       # current (live) state of the array already includes all pending changes
@@ -202,16 +246,26 @@ module Mongoid
       # @param [ String ] field the field
       def unset_superseded_by_set?(field)
         key = field.split('.', 2).first
-        sets(initialize: false).has_key?(key)
+        sets(initialize: false)&.has_key?(key)
+      end
+
+      # Get the conflicting $addToSet operations.
+      #
+      # @example Get the conflicting add to sets.
+      #   modifiers.conflicting_add_to_sets
+      #
+      # @return [ Hash ] The conflicting add to set operations.
+      def conflicting_add_to_sets
+        conflicts['$addToSet'] ||= {}
       end
 
-      # Get the conflicting pull modifications.
+      # Get the conflicting pull all modifications.
       #
-      # @example Get the conflicting pulls.
-      #   modifiers.conflicting_pulls
+      # @example Get the conflicting pull alls.
+      #   modifiers.conflicting_pull_alls
       #
-      # @return [ Hash ] The conflicting pull operations.
-      def conflicting_pulls
+      # @return [ Hash ] The conflicting pull all operations.
+      def conflicting_pull_alls
         conflicts['$pullAll'] ||= {}
       end
 
@@ -282,6 +336,26 @@ module Mongoid
         @set_fields ||= {}
       end
 
+      # Get the names of the fields that need to be added to sets.
+      #
+      # @example Get the add to set fields.
+      #   modifiers.add_to_set_fields
+      #
+      # @return [ Array<String> ] The add to set fields.
+      def add_to_set_fields
+        @add_to_set_fields ||= {}
+      end
+
+      # Get the names of the fields that need to be unset.
+      #
+      # @example Get the unset fields.
+      #   modifiers.unset_fields
+      #
+      # @return [ Array<String> ] The unset fields.
+      def unset_fields
+        @unset_fields ||= {}
+      end
+
       # Get the $pullAll operations or initialize a new one.
       #
       # @example Get the $pullAll operations.
@@ -333,6 +407,16 @@ module Mongoid
       def unsets
         self['$unset'] ||= {}
       end
+
+      # Is there a $pull on the given root-level field? Does not initialize
+      # the $pull operations.
+      #
+      # @param [ String ] name The root-level field name.
+      #
+      # @return [ true | false ] If a $pull touches this field.
+      def pull_root?(name)
+        (self['$pull'] || {}).keys.any? { |key| key.split('.', 2)[0] == name }
+      end
     end
   end
 end

data/lib/mongoid/clients/factory.rb

@@ -90,6 +90,8 @@ module Mongoid
         return nil unless opts[:auto_encryption_options]
 
         opts[:auto_encryption_options].dup.tap do |auto_encryption_options|
+          Mongoid::Warnings.warn_bypass_auto_encryption if auto_encryption_options[:bypass_auto_encryption]
+
           if auto_encryption_options.key?(:schema_map)
             default_logger.warn(
               'The :schema_map is configured in the :auto_encryption_options for the client;' +
@@ -111,10 +113,6 @@ module Mongoid
         version: VERSION
       }.freeze
 
-      def driver_version
-        Mongo::VERSION.split('.')[0...2].map(&:to_i)
-      end
-
       # Prepare options for Mongo::Client based on Mongoid client configuration.
       #
       # @param [ Hash ] opts Parameters from options section of Mongoid client configuration.
@@ -125,16 +123,14 @@ module Mongoid
         options = opts.dup
         options[:platform] = PLATFORM_DETAILS
         options[:app_name] = Mongoid::Config.app_name if Mongoid::Config.app_name
-        if (driver_version <=> [ 2, 13 ]) >= 0
-          wrap_lib = if options[:wrapping_libraries]
-                       [ MONGOID_WRAPPING_LIBRARY ] + options[:wrapping_libraries]
-                     else
-                       [ MONGOID_WRAPPING_LIBRARY ]
-                     end.tap do |wrap|
-            wrap << { name: 'Rails', version: ::Rails.version } if defined?(::Rails) && ::Rails.respond_to?(:version)
-          end
-          options[:wrapping_libraries] = wrap_lib
+        wrap_lib = if options[:wrapping_libraries]
+                     [ MONGOID_WRAPPING_LIBRARY ] + options[:wrapping_libraries]
+                   else
+                     [ MONGOID_WRAPPING_LIBRARY ]
+                   end.tap do |wrap|
+          wrap << { name: 'Rails', version: ::Rails.version } if defined?(::Rails) && ::Rails.respond_to?(:version)
         end
+        options[:wrapping_libraries] = wrap_lib
         options.reject { |k, _v| k == :hosts }.to_hash.symbolize_keys!
       end
     end

data/lib/mongoid/collection_configurable.rb

@@ -20,6 +20,14 @@ module Mongoid
       # @raise [ Errors::CreateCollectionFailure ] If collection creation failed.
       # @raise [ Errors::DropCollectionFailure ] If an attempt to drop collection failed.
       def create_collection(force: false)
+        Threaded.with_collection_management do
+          perform_create_collection(force: force)
+        end
+      end
+
+      private
+
+      def perform_create_collection(force:)
         if collection_name.empty?
           # This is most probably an anonymous class, we ignore them.
           return

data/lib/mongoid/config/defaults.rb

@@ -30,7 +30,6 @@ module Mongoid
           load_defaults '9.0'
 
         when '9.0'
-          self.allow_reparenting_via_nested_attributes = true
           self.autosave_saves_unchanged_documents = true
 
           load_defaults '9.1'

data/lib/mongoid/config/encryption.rb

@@ -20,21 +20,51 @@ module Mongoid
       #
       # @return [ Hash ] The encryption schema map.
       def encryption_schema_map(default_database, models = ::Mongoid.models)
-        visited = Set.new
-        models.each_with_object({}) do |model, map|
-          next if visited.include?(model)
+        # Subclasses share their parent's collection but are not registered in
+        # Mongoid.models, so they have to be added to the walk explicitly.
+        classes = models.flat_map { |model| [ model ] + model.descendants }.uniq
 
-          visited << model
+        classes.each_with_object({}) do |model, map|
           next if model.embedded?
-          next unless model.encrypted?
+          next unless model.requires_encryption_schema?
 
           database = model.storage_options.fetch(:database) { default_database }
+          # A callable database name cannot be resolved here: the documented
+          # multi-tenant idiom has no correct value while the client is being
+          # built. Interpolating the callable would produce a key that never
+          # matches any namespace, so leave the model out of the map. Writes
+          # are refused later, by PersistenceContext, rather than silently
+          # going out unencrypted.
+          next if database.respond_to?(:call)
+
           key = "#{database}.#{model.collection_name}"
-          props = metadata_for(model).merge(properties_for(model, visited))
-          map[key] = props unless props.empty?
+          props = metadata_for(model).merge(properties_for(model, [ model ], key))
+          next if props.empty?
+
+          # The root of a collection schema describes the document, so it is
+          # always an object. Saying so matters when a nested schema carries
+          # encryptMetadata: mongocryptd rejects the schema otherwise.
+          entry = { 'bsonType' => 'object' }.merge(props)
+          map[key] = map.key?(key) ? merge_schema_entries(map[key], entry, key) : entry
         end
       end
 
+      # Collect the paths of the fields encrypted by the schema generated for
+      # a single model.
+      #
+      # @param [ Mongoid::Document ] model The model.
+      #
+      # @return [ Array<Array<String>> ] The property paths, outermost first.
+      #
+      # @api private
+      def encrypted_paths_for(model)
+        return model.instance_variable_get(:@encrypted_paths_for) if
+          model.instance_variable_defined?(:@encrypted_paths_for)
+
+        properties = properties_for(model, [ model ])['properties'] || {}
+        model.instance_variable_set(:@encrypted_paths_for, collect_encrypted_paths(properties, []))
+      end
+
       private
 
       # The algorithm to use for the deterministic encryption.
@@ -100,11 +130,14 @@ module Mongoid
       # are marked as encrypted.
       #
       # @param [ Mongoid::Document ] model The model to generate the properties for.
-      # @param [ Set<Mongoid::Document> ] visited The set of models that have already been visited.
+      # @param [ Array<Mongoid::Document> ] path The models the walk is already
+      #   inside of, outermost first.
+      # @param [ String | nil ] namespace The namespace the schema is built
+      #   for, used for error reporting.
       #
       # @return [ Hash ] The encryption properties.
-      def properties_for(model, visited)
-        result = properties_for_fields(model).merge(properties_for_relations(model, visited))
+      def properties_for(model, path, namespace = nil)
+        result = properties_for_fields(model).merge(properties_for_relations(model, path, namespace))
         if result.empty?
           {}
         else
@@ -141,26 +174,141 @@ module Mongoid
       # are configured to be encrypted.
       #
       # @param [ Mongoid::Document ] model The model to generate the properties for.
-      # @param [ Set<Mongoid::Document> ] visited The set of models that have already been visited.
+      # @param [ Array<Mongoid::Document> ] path The models the walk is already
+      #   inside of, outermost first.
+      # @param [ String | nil ] namespace The namespace the schema is built
+      #   for, used for error reporting.
       #
       # @return [ Hash ] The encryption properties.
-      def properties_for_relations(model, visited)
+      def properties_for_relations(model, path, namespace = nil)
         model.relations.each_with_object({}) do |(name, relation), props|
-          next if visited.include?(relation.relation_class)
+          # relation_class constantizes, and a polymorphic embedded_in has no
+          # class to resolve, so the relation type has to be checked first.
           next unless relation.is_a?(Association::Embedded::EmbedsOne)
-          next unless relation.relation_class.encrypted?
-
-          visited << relation.relation_class
-          metadata_for(
-            relation.relation_class
-          ).merge(
-            properties_for(relation.relation_class, visited)
-          ).tap do |properties|
-            props[name] = { 'bsonType' => 'object' }.merge(properties) unless properties.empty?
+
+          klass = relation.try_relation_class
+          # An association target does not have to be a Mongoid document, and
+          # the class it names does not have to exist.
+          next unless klass.respond_to?(:requires_encryption_schema?)
+
+          # Any subclass of the declared class can be assigned to the
+          # association, so its encrypted fields have to be mapped here too.
+          properties = ([ klass ] + klass.descendants).uniq.inject({}) do |merged, candidate|
+            # Stop at a model the walk is already inside of, or a self-embedding
+            # model never terminates. The path covers the current branch only:
+            # a model embedded by two parents, or twice by one parent, has to be
+            # emitted at every place it appears.
+            next merged if path.include?(candidate)
+            next merged unless candidate.respond_to?(:requires_encryption_schema?)
+            next merged unless candidate.requires_encryption_schema?
+
+            merge_schema_entries(
+              merged,
+              metadata_for(candidate).merge(
+                properties_for(candidate, path + [ candidate ], namespace)
+              ),
+              namespace
+            )
+          end
+          props[name] = { 'bsonType' => 'object' }.merge(properties) unless properties.empty?
+        end
+      end
+
+      # Walk the schema properties and collect the path of every encrypted
+      # leaf.
+      #
+      # @param [ Hash ] properties The properties to walk.
+      # @param [ Array<String> ] path The properties the walk is already
+      #   inside of.
+      #
+      # @return [ Array<Array<String>> ] The property paths.
+      def collect_encrypted_paths(properties, path)
+        properties.each_with_object([]) do |(name, schema), paths|
+          if schema.key?('encrypt')
+            paths << (path + [ name ])
+          elsif schema['properties']
+            paths.concat(collect_encrypted_paths(schema['properties'], path + [ name ]))
+          end
+        end
+      end
+
+      # Merge two schema objects covering the same model or namespace.
+      #
+      # Every model writing to one namespace contributes an entry to the
+      # schema map. Those entries have to agree on everything they have in
+      # common, or the schema would silently encrypt a field differently for
+      # one model than for another.
+      #
+      # @param [ Hash ] left The first schema.
+      # @param [ Hash ] right The second schema.
+      # @param [ String | nil ] namespace The namespace the schema belongs to.
+      #
+      # @return [ Hash ] The merged schema.
+      def merge_schema_entries(left, right, namespace = nil)
+        left.merge(right) do |key, left_value, right_value|
+          case key
+          when 'bsonType'
+            left_value
+          when 'encryptMetadata'
+            merge_encrypt_metadata(left_value, right_value, namespace)
+          when 'properties'
+            merge_properties(left_value, right_value, namespace)
+          else
+            raise_invalid_encryption_schema(namespace, key)
           end
         end
       end
 
+      # Merge two encryptMetadata objects.
+      #
+      # @param [ Hash ] left The first encryptMetadata object.
+      # @param [ Hash ] right The second encryptMetadata object.
+      # @param [ String | nil ] namespace The namespace the schema belongs to.
+      #
+      # @return [ Hash ] The merged encryptMetadata object.
+      def merge_encrypt_metadata(left, right, namespace)
+        left.merge(right) do |key, left_value, right_value|
+          unless left_value == right_value
+            raise_invalid_encryption_schema(namespace, "encryptMetadata.#{key}")
+          end
+
+          left_value
+        end
+      end
+
+      # Merge two properties objects.
+      #
+      # @param [ Hash ] left The first properties object.
+      # @param [ Hash ] right The second properties object.
+      # @param [ String | nil ] namespace The namespace the schema belongs to.
+      #
+      # @return [ Hash ] The merged properties object.
+      def merge_properties(left, right, namespace)
+        left.merge(right) do |name, left_value, right_value|
+          if left_value.key?('encrypt') && right_value.key?('encrypt')
+            unless left_value['encrypt'] == right_value['encrypt']
+              raise_invalid_encryption_schema(namespace, "properties.#{name}")
+            end
+
+            left_value
+          elsif left_value.key?('encrypt') || right_value.key?('encrypt')
+            raise_invalid_encryption_schema(namespace, "properties.#{name}")
+          else
+            merge_schema_entries(left_value, right_value, namespace)
+          end
+        end
+      end
+
+      # Raise an error for a schema conflicting with another one.
+      #
+      # @param [ String | nil ] namespace The namespace the schema belongs to.
+      # @param [ String ] path The conflicting path in the schema.
+      #
+      # @raise [ Errors::InvalidEncryptionSchema ] Always raised.
+      def raise_invalid_encryption_schema(namespace, path)
+        raise Errors::InvalidEncryptionSchema.new(namespace, path)
+      end
+
       # Get the BSON type identifier for the provided field according to the
       # https://www.mongodb.com/docs/manual/reference/bson-types/#std-label-bson-types
       #

data/lib/mongoid/config.rb

@@ -130,12 +130,14 @@ module Mongoid
       validate_isolation_level!(level)
     }
 
-    # When this flag is true, it will be possible to change the parent of a
-    # record in a "has_many" association by passing the child record's id in the
-    # nested attributes for another parent record.
+    # When this flag is true, it will be possible to add a record to a
+    # "has_many" or "has_and_belongs_to_many" association by passing that
+    # record's id in the nested attributes for another parent record, even
+    # when the record does not already belong to that association. For a
+    # "has_many" association this moves the record to the new parent.
     #
-    # When this flag is false, attempting to change the parent of a record in a
-    # "has-many" association via nested attributes will raise an error.
+    # When this flag is false, an id in nested attributes is only resolved
+    # within the association itself, and anything else raises an error.
     #
     # The default is `false`. Note that allowing reparenting via nested attributes
     # is a potential security risk, since it could allow a malicious user to move
@@ -294,6 +296,51 @@ module Mongoid
     # See https://jira.mongodb.org/browse/MONGOID-5892 for more details.
     option :serializable_hash_with_legacy_only, default: true
 
+    # When false (default), query operators are restricted when building a
+    # selector, so that user-supplied input reaching the query builder cannot
+    # make MongoDB execute arbitrary JavaScript. Two rules are enforced:
+    #
+    # - An operator at the top level of an expression must appear in
+    #   +Criteria::Queryable::Selectable::ALLOWED_QUERY_OPERATORS+.
+    # - +$where+, +$function+, and +$accumulator+ are rejected at any depth,
+    #   including inside +$expr+ and the logical operators.
+    #
+    # This applies to every query method that accepts an expression, including
+    # +where+, +find_by+, +and+, +or+, +nor+, +not+, +any_of+, and +none_of+.
+    # It also governs the string form of +where+, e.g.
+    # +where("this.name == 'admin'")+, which the server evaluates as +$where+.
+    # Applications relying on that form must set this option to true.
+    #
+    # The APIs that request JavaScript explicitly, +Criteria#for_js+ and
+    # +js_query+, are unaffected: there the developer has asked for it.
+    #
+    # Set to true to restore the unrestricted pass-through behavior.
+    #
+    # Note that this option is deliberately not tied to +load_defaults+: an
+    # application that has opted into older defaults still gets the guard, and
+    # must set this option explicitly to turn it off.
+    #
+    # See https://jira.mongodb.org/browse/MONGOID-5939,
+    # https://jira.mongodb.org/browse/MONGOID-5993,
+    # https://jira.mongodb.org/browse/MONGOID-5994 for details.
+    option :allow_unsafe_query_operators, default: false
+
+    # The maximum number of seconds that evaluating a single query in memory
+    # may spend executing regular expressions. Queries against an embedded
+    # association are evaluated in the calling thread, so a pattern built from
+    # user input runs locally and can otherwise consume unbounded CPU. The
+    # limit is cumulative over the whole query, since cost grows with the
+    # number of documents and conditions as well as with the pattern.
+    #
+    # Set to nil to remove the limit. On Ruby 3.2 and later the remaining
+    # budget is compiled into the pattern, so the limit counts only the time
+    # spent matching. Earlier Rubies have no per-Regexp timeout, so the query
+    # is bounded with Timeout instead and the limit is wall clock over the
+    # whole in-memory evaluation.
+    #
+    # See https://jira.mongodb.org/browse/MONGOID-5981 for details.
+    option :in_memory_regexp_time_limit, default: 5.0
+
     # Returns the Config singleton, for use in the configure DSL.
     #
     # @return [ self ] The Config singleton.
@@ -539,6 +586,10 @@ module Mongoid
       end
     end
 
+    # Wraps configuration options that have been deprecated so that assigning
+    # them emits a deprecation warning. OPTIONS is intentionally empty when no
+    # options are currently deprecated; it is populated as options are retired,
+    # at which point this module rewrites their setters to warn.
     module DeprecatedOptions
       OPTIONS = %i[]
 

data/lib/mongoid/contextual/aggregable/memory.rb

@@ -1,10 +1,14 @@
 # frozen_string_literal: true
 
+require 'mongoid/field_readable'
+
 module Mongoid
   module Contextual
     module Aggregable
       # Contains behavior for aggregating values in memory.
       module Memory
+        include FieldReadable
+
         # Get all the aggregate values for the provided field.
         # Provided for interface consistency with Aggregable::Mongo.
         #
@@ -28,7 +32,7 @@ module Mongoid
         #
         # @return [ Numeric ] The average.
         def avg(field)
-          total = count { |doc| !doc.send(field).nil? }
+          total = count { |doc| !read_field_value(doc, field).nil? }
           return nil unless total > 0
 
           total = total.to_f if total.is_a?(Integer)
@@ -114,7 +118,7 @@ module Mongoid
         def aggregate_by(field, method)
           return nil unless any?
 
-          map { |doc| doc.public_send(field) }.compact.public_send(method)
+          map { |doc| read_field_value(doc, field) }.compact.public_send(method)
         end
       end
     end

data/lib/mongoid/contextual/memory.rb

@@ -2,6 +2,7 @@
 
 require 'mongoid/contextual/aggregable/memory'
 require 'mongoid/association/eager_loadable'
+require 'mongoid/field_readable'
 
 module Mongoid
   module Contextual
@@ -15,6 +16,7 @@ module Mongoid
       include Association::EagerLoadable
       include Queryable
       include Positional
+      include FieldReadable
 
       # @attribute [r] root The root document.
       # @attribute [r] path The atomic path.
@@ -174,10 +176,20 @@ module Mongoid
       # @param [ Criteria ] criteria The criteria.
       def initialize(criteria)
         @criteria, @klass = criteria, criteria.klass
-        @documents = criteria.documents.select do |doc|
-          @root ||= doc._root
-          @collection ||= root.collection
-          doc._matches?(criteria.selector)
+
+        # Resolving the collection can build a Mongo::Client the first time it
+        # runs, so it happens before the budget opens. Where the budget is
+        # enforced with Timeout the exception is asynchronous, and landing in
+        # the middle of that would leave a half-built client behind.
+        if (first = criteria.documents.first)
+          @root = first._root
+          @collection = @root.collection
+        end
+
+        # One regexp budget covers the whole scan, so that the limit bounds the
+        # query rather than each document individually.
+        @documents = Matcher::RegexpBudget.open(criteria.selector) do
+          criteria.documents.select { |doc| doc._matches?(criteria.selector) }
         end
         apply_sorting
         apply_options
@@ -739,10 +751,9 @@ module Mongoid
                          # If this is a localized field, and there are remaining, get the
                          # _translations hash so that we can get the specified translation in
                          # the remaining
-                         document.send("#{segment}_translations") if field&.localized?
+                         document.public_send("#{segment}_translations") if field&.localized?
                        end
-                 meth = klass.aliased_associations[segment] || segment
-                 res.nil? ? document.try(meth) : res
+                 res.nil? ? read_field_value(document, segment) : res
                elsif document.is_a?(Hash)
                  # TODO: Remove the indifferent access when implementing MONGOID-5410.
                  if document.key?(segment.to_s)