mongoid 9.1.1 → 9.1.2

data/lib/mongoid/config/encryption.rb

@@ -20,7 +20,11 @@ module Mongoid
       #
       # @return [ Hash ] The encryption schema map.
       def encryption_schema_map(default_database, models = ::Mongoid.models)
-        models.each_with_object({}) do |model, map|
+        # Subclasses share their parent's collection but are not registered in
+        # Mongoid.models, so they have to be added to the walk explicitly.
+        classes = models.flat_map { |model| [ model ] + model.descendants }.uniq
+
+        classes.each_with_object({}) do |model, map|
           next if model.embedded?
           next unless model.requires_encryption_schema?
 
@@ -34,14 +38,33 @@ module Mongoid
           next if database.respond_to?(:call)
 
           key = "#{database}.#{model.collection_name}"
-          props = metadata_for(model).merge(properties_for(model, [ model ]))
+          props = metadata_for(model).merge(properties_for(model, [ model ], key))
+          next if props.empty?
+
           # The root of a collection schema describes the document, so it is
           # always an object. Saying so matters when a nested schema carries
           # encryptMetadata: mongocryptd rejects the schema otherwise.
-          map[key] = { 'bsonType' => 'object' }.merge(props) unless props.empty?
+          entry = { 'bsonType' => 'object' }.merge(props)
+          map[key] = map.key?(key) ? merge_schema_entries(map[key], entry, key) : entry
         end
       end
 
+      # Collect the paths of the fields encrypted by the schema generated for
+      # a single model.
+      #
+      # @param [ Mongoid::Document ] model The model.
+      #
+      # @return [ Array<Array<String>> ] The property paths, outermost first.
+      #
+      # @api private
+      def encrypted_paths_for(model)
+        return model.instance_variable_get(:@encrypted_paths_for) if
+          model.instance_variable_defined?(:@encrypted_paths_for)
+
+        properties = properties_for(model, [ model ])['properties'] || {}
+        model.instance_variable_set(:@encrypted_paths_for, collect_encrypted_paths(properties, []))
+      end
+
       private
 
       # The algorithm to use for the deterministic encryption.
@@ -109,10 +132,12 @@ module Mongoid
       # @param [ Mongoid::Document ] model The model to generate the properties for.
       # @param [ Array<Mongoid::Document> ] path The models the walk is already
       #   inside of, outermost first.
+      # @param [ String | nil ] namespace The namespace the schema is built
+      #   for, used for error reporting.
       #
       # @return [ Hash ] The encryption properties.
-      def properties_for(model, path)
-        result = properties_for_fields(model).merge(properties_for_relations(model, path))
+      def properties_for(model, path, namespace = nil)
+        result = properties_for_fields(model).merge(properties_for_relations(model, path, namespace))
         if result.empty?
           {}
         else
@@ -151,9 +176,11 @@ module Mongoid
       # @param [ Mongoid::Document ] model The model to generate the properties for.
       # @param [ Array<Mongoid::Document> ] path The models the walk is already
       #   inside of, outermost first.
+      # @param [ String | nil ] namespace The namespace the schema is built
+      #   for, used for error reporting.
       #
       # @return [ Hash ] The encryption properties.
-      def properties_for_relations(model, path)
+      def properties_for_relations(model, path, namespace = nil)
         model.relations.each_with_object({}) do |(name, relation), props|
           # relation_class constantizes, and a polymorphic embedded_in has no
           # class to resolve, so the relation type has to be checked first.
@@ -163,21 +190,125 @@ module Mongoid
           # An association target does not have to be a Mongoid document, and
           # the class it names does not have to exist.
           next unless klass.respond_to?(:requires_encryption_schema?)
-          # Stop at a model the walk is already inside of, or a self-embedding
-          # model never terminates. The path covers the current branch only:
-          # a model embedded by two parents, or twice by one parent, has to be
-          # emitted at every place it appears.
-          next if path.include?(klass)
-          next unless klass.requires_encryption_schema?
-
-          metadata_for(klass).merge(
-            properties_for(klass, path + [ klass ])
-          ).tap do |properties|
-            props[name] = { 'bsonType' => 'object' }.merge(properties) unless properties.empty?
+
+          # Any subclass of the declared class can be assigned to the
+          # association, so its encrypted fields have to be mapped here too.
+          properties = ([ klass ] + klass.descendants).uniq.inject({}) do |merged, candidate|
+            # Stop at a model the walk is already inside of, or a self-embedding
+            # model never terminates. The path covers the current branch only:
+            # a model embedded by two parents, or twice by one parent, has to be
+            # emitted at every place it appears.
+            next merged if path.include?(candidate)
+            next merged unless candidate.respond_to?(:requires_encryption_schema?)
+            next merged unless candidate.requires_encryption_schema?
+
+            merge_schema_entries(
+              merged,
+              metadata_for(candidate).merge(
+                properties_for(candidate, path + [ candidate ], namespace)
+              ),
+              namespace
+            )
           end
+          props[name] = { 'bsonType' => 'object' }.merge(properties) unless properties.empty?
         end
       end
 
+      # Walk the schema properties and collect the path of every encrypted
+      # leaf.
+      #
+      # @param [ Hash ] properties The properties to walk.
+      # @param [ Array<String> ] path The properties the walk is already
+      #   inside of.
+      #
+      # @return [ Array<Array<String>> ] The property paths.
+      def collect_encrypted_paths(properties, path)
+        properties.each_with_object([]) do |(name, schema), paths|
+          if schema.key?('encrypt')
+            paths << (path + [ name ])
+          elsif schema['properties']
+            paths.concat(collect_encrypted_paths(schema['properties'], path + [ name ]))
+          end
+        end
+      end
+
+      # Merge two schema objects covering the same model or namespace.
+      #
+      # Every model writing to one namespace contributes an entry to the
+      # schema map. Those entries have to agree on everything they have in
+      # common, or the schema would silently encrypt a field differently for
+      # one model than for another.
+      #
+      # @param [ Hash ] left The first schema.
+      # @param [ Hash ] right The second schema.
+      # @param [ String | nil ] namespace The namespace the schema belongs to.
+      #
+      # @return [ Hash ] The merged schema.
+      def merge_schema_entries(left, right, namespace = nil)
+        left.merge(right) do |key, left_value, right_value|
+          case key
+          when 'bsonType'
+            left_value
+          when 'encryptMetadata'
+            merge_encrypt_metadata(left_value, right_value, namespace)
+          when 'properties'
+            merge_properties(left_value, right_value, namespace)
+          else
+            raise_invalid_encryption_schema(namespace, key)
+          end
+        end
+      end
+
+      # Merge two encryptMetadata objects.
+      #
+      # @param [ Hash ] left The first encryptMetadata object.
+      # @param [ Hash ] right The second encryptMetadata object.
+      # @param [ String | nil ] namespace The namespace the schema belongs to.
+      #
+      # @return [ Hash ] The merged encryptMetadata object.
+      def merge_encrypt_metadata(left, right, namespace)
+        left.merge(right) do |key, left_value, right_value|
+          unless left_value == right_value
+            raise_invalid_encryption_schema(namespace, "encryptMetadata.#{key}")
+          end
+
+          left_value
+        end
+      end
+
+      # Merge two properties objects.
+      #
+      # @param [ Hash ] left The first properties object.
+      # @param [ Hash ] right The second properties object.
+      # @param [ String | nil ] namespace The namespace the schema belongs to.
+      #
+      # @return [ Hash ] The merged properties object.
+      def merge_properties(left, right, namespace)
+        left.merge(right) do |name, left_value, right_value|
+          if left_value.key?('encrypt') && right_value.key?('encrypt')
+            unless left_value['encrypt'] == right_value['encrypt']
+              raise_invalid_encryption_schema(namespace, "properties.#{name}")
+            end
+
+            left_value
+          elsif left_value.key?('encrypt') || right_value.key?('encrypt')
+            raise_invalid_encryption_schema(namespace, "properties.#{name}")
+          else
+            merge_schema_entries(left_value, right_value, namespace)
+          end
+        end
+      end
+
+      # Raise an error for a schema conflicting with another one.
+      #
+      # @param [ String | nil ] namespace The namespace the schema belongs to.
+      # @param [ String ] path The conflicting path in the schema.
+      #
+      # @raise [ Errors::InvalidEncryptionSchema ] Always raised.
+      def raise_invalid_encryption_schema(namespace, path)
+        raise Errors::InvalidEncryptionSchema.new(namespace, path)
+      end
+
       # Get the BSON type identifier for the provided field according to the
       # https://www.mongodb.com/docs/manual/reference/bson-types/#std-label-bson-types
       #

data/lib/mongoid/document.rb

@@ -410,6 +410,8 @@ module Mongoid
       def instantiate_document(attrs = nil, selected_fields = nil, options = {}, &block)
         execute_callbacks = options.fetch(:execute_callbacks, Threaded.execute_callbacks?)
         attributes = attrs.to_h
+        preloaded_fields = attributes.keys.select { |key| key.start_with?(Association::PRELOADED_PREFIX) }
+        preloaded = attributes.extract!(*preloaded_fields)
 
         doc = allocate
         doc.__selected_fields = selected_fields
@@ -417,6 +419,7 @@ module Mongoid
         doc.instance_variable_set(:@attributes_before_type_cast, attributes.dup)
 
         doc._handle_callbacks_after_instantiation(execute_callbacks, &block)
+        doc.load_preloaded_associations(preloaded)
 
         doc.remember_storage_options!
         doc

data/lib/mongoid/encryptable.rb

@@ -43,21 +43,29 @@ module Mongoid
       # group has no encrypted field of its own, but its collection still needs
       # a schema, otherwise the embedded fields are written in plaintext.
       #
-      # The answer is memoized, since this runs on the persistence path.
-      # Declaring encryption on a model after it has already been persisted is
-      # not supported.
+      # This runs on the persistence path, so the answer is memoized. A true
+      # answer is always memoized. A false answer is memoized only when every
+      # embeds_one target in the walk resolved to a class; if one could not be
+      # resolved yet, the answer is recomputed next time, so a class loaded
+      # later is still detected. Declaring encryption on a model after it has
+      # already been persisted is not supported.
       #
       # @return [ true | false ] Whether the model needs an encryption schema.
       #
       # @api private
       def requires_encryption_schema?
         return @requires_encryption_schema if defined?(@requires_encryption_schema)
+        return @requires_encryption_schema = true if encrypted?
 
-        @requires_encryption_schema = encrypted? || embeds_encrypted?([ self ])
+        found, complete = embedded_encryption_scan([ self ])
+        @requires_encryption_schema = found if found || complete
+        found
       end
 
-      # Whether any model reachable through this model's embeds_one relations
-      # declares encryption.
+      # Walks the models reachable through this model's embeds_one relations,
+      # looking for one that declares encryption. Subclasses of an
+      # association target are included: any of them can be assigned to the
+      # association.
       #
       # embeds_many is not considered: libmongocrypt cannot express per-field
       # encryption under array items, so those fields are never mapped.
@@ -65,21 +73,40 @@ module Mongoid
       # @param [ Array<Class> ] path The models the walk is already inside of.
       #   A model embedding itself terminates here.
       #
-      # @return [ true | false ] Whether an embedded model is encrypted.
+      # @return [ Array<true | false> ] A pair: whether an embedded model is
+      #   encrypted, and whether every embeds_one target the walk needed
+      #   resolved to a class. The second value is only meaningful when the
+      #   first is false.
       #
       # @api private
-      def embeds_encrypted?(path)
-        relations.each_value.any? do |relation|
-          next false unless relation.is_a?(Association::Embedded::EmbedsOne)
+      def embedded_encryption_scan(path)
+        complete = true
+
+        relations.each_value do |relation|
+          next unless relation.is_a?(Association::Embedded::EmbedsOne)
 
           klass = relation.try_relation_class
-          # An association target does not have to be a Mongoid document, and
-          # the class it names does not have to exist.
-          next false unless klass.respond_to?(:encrypted?)
-          next false if path.include?(klass)
+          # The class an association names does not have to exist yet.
+          if klass.nil?
+            complete = false
+            next
+          end
+
+          # An association target does not have to be a Mongoid document.
+          next unless klass.respond_to?(:encrypted?)
+
+          ([ klass ] + klass.descendants).uniq.each do |candidate|
+            next if path.include?(candidate)
+            return [ true, true ] if candidate.encrypted?
 
-          klass.encrypted? || klass.embeds_encrypted?(path + [ klass ])
+            found, nested_complete = candidate.embedded_encryption_scan(path + [ candidate ])
+            return [ true, true ] if found
+
+            complete &&= nested_complete
+          end
         end
+
+        [ false, complete ]
       end
 
       # Override the key_id for the model.

data/lib/mongoid/errors/invalid_encryption_schema.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Mongoid
+  module Errors
+    # This error is raised when two models writing to the same namespace
+    # describe a field, or the collection metadata, differently. The schema map
+    # has one entry per namespace, so the two descriptions cannot both be
+    # honored.
+    class InvalidEncryptionSchema < MongoidError
+      # Create the new error.
+      #
+      # @example Create the error.
+      #   InvalidEncryptionSchema.new('music.bands', 'properties.code')
+      #
+      # @param [ String | nil ] namespace The namespace being described.
+      # @param [ String ] path The conflicting path in the schema.
+      def initialize(namespace, path)
+        super(
+          compose_message(
+            'invalid_encryption_schema',
+            { namespace: namespace || 'the collection', path: path }
+          )
+        )
+      end
+    end
+  end
+end

data/lib/mongoid/errors/no_encryption_schema.rb

@@ -15,11 +15,13 @@ module Mongoid
       # @param [ Class ] klass The model class.
       # @param [ String ] namespace The namespace the model resolved to.
       # @param [ String | Symbol ] client The name of the client in use.
-      def initialize(klass, namespace, client)
+      # @param [ String | nil ] field The encrypted field missing from the
+      #   schema entry, if the namespace itself is covered.
+      def initialize(klass, namespace, client, field = nil)
         super(
           compose_message(
-            'no_encryption_schema',
-            { klass: klass, namespace: namespace, client: client }
+            field ? 'no_encryption_schema_field' : 'no_encryption_schema',
+            { klass: klass, namespace: namespace, client: client, field: field }
           )
         )
       end

data/lib/mongoid/errors.rb

@@ -20,6 +20,7 @@ require 'mongoid/errors/invalid_collection'
 require 'mongoid/errors/invalid_config_file'
 require 'mongoid/errors/invalid_config_option'
 require 'mongoid/errors/invalid_dependent_strategy'
+require 'mongoid/errors/invalid_encryption_schema'
 require 'mongoid/errors/invalid_field'
 require 'mongoid/errors/invalid_field_option'
 require 'mongoid/errors/invalid_field_type'

data/lib/mongoid/fields.rb

@@ -412,6 +412,13 @@ module Mongoid
         return '' unless name.present?
 
         key = name.to_s
+
+        # A key without a "." refers to an immediate field, so it resolves to
+        # its alias (or itself) with no splitting. Short-circuiting here avoids
+        # the split and dup on every read, which is a hot path. This mirrors the
+        # same optimization already applied to the matcher.
+        return aliased_fields[key]&.dup || key unless key.include?('.')
+
         segment, remaining = key.split('.', 2)
 
         # Don't get the alias for the field when a belongs_to association

data/lib/mongoid/persistable/creatable.rb

@@ -39,13 +39,79 @@ module Mongoid
         { atomic_insert_modifier => { atomic_position => as_attributes } }
       end
 
+      # Determine whether merging the touch updates into the insert
+      # operations would produce an update whose operators target both a
+      # path and one of its ancestors or descendants. MongoDB rejects such
+      # an update with error 40. This can happen for embeds_many inserts,
+      # where the operations target the array (via $push) but the touches
+      # include a path inside that array (e.g. items.0.updated_at) when a
+      # sibling has a pending touch.
+      #
+      # @api private
+      #
+      # @param [ Hash ] operations The atomic insert operations.
+      # @param [ Hash ] touches The touch updates to merge.
+      #
+      # @return [ true | false ] Whether any touch path conflicts with a
+      #   path the insert operations target.
+      def conflicting_touch_paths?(operations, touches)
+        targeted = operations.each_value.flat_map do |doc|
+          doc.respond_to?(:keys) ? doc.keys.map(&:to_s) : []
+        end
+
+        touches.each_key.any? do |touch_path|
+          path = touch_path.to_s
+          targeted.any? do |target|
+            path == target || path.start_with?("#{target}.") ||
+              target.start_with?("#{path}.")
+          end
+        end
+      end
+
+      # Rewrite the indices in the touch updates to the positional operator,
+      # as the final update will do to the merged operations. The touches of
+      # the parent chain target the inserted element, so rewriting them is
+      # safe, and merging the rewritten keys into the operations lets the
+      # final update reuse them as-is. A pending touch on a different element
+      # of the same array, however, would be rewritten to the same positional
+      # path and silently touch the wrong document; in that case this method
+      # returns nil and the caller persists the touch updates in their own
+      # round-trip after the insert instead of merging them.
+      #
+      # @api private
+      #
+      # @param [ Hash ] selector The update selector.
+      # @param [ Document ] parent The parent document being touched.
+      # @param [ Symbol, String, nil ] field The parent's custom touch field.
+      # @param [ Hash ] touches The touch updates to rewrite.
+      #
+      # @return [ Hash | nil ] The rewritten touch updates, or nil if any
+      #   touch would be misdirected by the rewriting.
+      def rewritten_touch_updates(selector, parent, field, touches)
+        rewritten = positionally(selector, { '$set' => touches })['$set']
+
+        chain_paths = parent._touchable_chain_paths(field)
+        touches.each_key do |key|
+          path = key.to_s
+          next if rewritten.key?(path)
+
+          return nil unless chain_paths.include?(path)
+        end
+        rewritten
+      end
+
       # Insert the embedded document.
       #
       # When the parent association is touchable (which is the default for
-      # +embedded_in+), the touch timestamp updates are merged into the
-      # same +update_one+ call that performs the insert. This avoids a
-      # second round-trip that the +after_save+ touch callback would
-      # otherwise issue.
+      # +embedded_in+), the touch updates are merged into the same
+      # +update_one+ call that performs the insert. This avoids a second
+      # round-trip that the +after_save+ touch callback would otherwise
+      # issue. The merge is skipped when a touch path would conflict with a
+      # path the insert targets (see +conflicting_touch_paths?+) or when
+      # rewriting the touch indices to the positional operator would
+      # misdirect a touch (see +rewritten_touch_updates+); such touches are
+      # persisted in their own round-trip right after the insert, so their
+      # persistence does not depend on the callback chain running.
       #
       # @api private
       #
@@ -62,19 +128,59 @@ module Mongoid
           selector = _parent.atomic_selector
           operations = atomic_inserts
 
-          if _touchable_parent?
-            touches = _parent._gather_touch_updates(Time.current)
-            if touches.present?
-              operations['$set'] = (operations['$set'] || {}).merge(touches)
-              Threaded.begin_touch_merged(self)
-            end
+          deferred_touches = merge_touch_updates(selector, operations)
+
+          begin
+            _root.collection.find(selector).update_one(
+              positionally(selector, operations),
+              session: _session
+            )
+            _root.persist_atomic_operations('$set' => deferred_touches) if deferred_touches
+          rescue StandardError
+            # If the insert failed, the after_save callback will not run to
+            # consume and clear the merged-touch flag, so clear it here.
+            Threaded.exit_touch_merged(self)
+            raise
           end
+        end
+      end
+
+      # Merge the parent chain's pending touch updates into the insert
+      # operations when doing so would not produce a conflicting update
+      # (see +conflicting_touch_paths?+ and +rewritten_touch_updates+).
+      # Either way, marks the touch as merged so the after_save callback
+      # does not persist the updates a second time. Returns the touch
+      # updates that could not be merged; they are persisted in their own
+      # round-trip right after the insert, rather than relying on the
+      # after_save callback, so that an aborted callback chain cannot
+      # silently drop them.
+      #
+      # @api private
+      #
+      # @param [ Hash ] selector The update selector.
+      # @param [ Hash ] operations The atomic insert operations, modified
+      #   in place when the touches are merged.
+      #
+      # @return [ Hash | nil ] The deferred touch updates, if any.
+      def merge_touch_updates(selector, operations)
+        return nil unless _touchable_parent?
 
-          _root.collection.find(selector).update_one(
-            positionally(selector, operations),
-            session: _session
-          )
+        field = _association&.inverse_association&.touch_field
+        touches = _parent._gather_touch_updates(Time.current, field)
+        return nil if touches.blank?
+
+        if conflicting_touch_paths?(operations, touches)
+          deferred_touches = touches
+        else
+          rewritten = rewritten_touch_updates(selector, _parent, field, touches)
+          if rewritten
+            operations['$set'] = (operations['$set'] || {}).merge(rewritten)
+          else
+            deferred_touches = touches
+          end
         end
+        Threaded.begin_touch_merged(self)
+        deferred_touches
       end
 
       # Insert the root document.

data/lib/mongoid/persistable.rb

@@ -142,6 +142,21 @@ module Mongoid
       raise Errors::Callback.new(self.class, method)
     end
 
+    # Persist the atomic operations.
+    #
+    # @api private
+    #
+    # @example Persist the atomic operations.
+    #   persist_atomic_operations(ops)
+    #
+    # @param [ Hash ] operations The atomic operations.
+    def persist_atomic_operations(operations)
+      return unless persisted? && operations && !operations.empty?
+
+      selector = atomic_selector
+      _root.collection.find(selector).update_one(positionally(selector, operations), session: _session)
+    end
+
     private
 
     # Are we executing an atomically block on the current document?
@@ -300,20 +315,5 @@ module Mongoid
         persist_atomic_operations(operation)
       end
     end
-
-    # Persist the atomic operations.
-    #
-    # @api private
-    #
-    # @example Persist the atomic operations.
-    #   persist_atomic_operations(ops)
-    #
-    # @param [ Hash ] operations The atomic operations.
-    def persist_atomic_operations(operations)
-      return unless persisted? && operations && !operations.empty?
-
-      selector = atomic_selector
-      _root.collection.find(selector).update_one(positionally(selector, operations), session: _session)
-    end
   end
 end

data/lib/mongoid/persistence_context.rb

@@ -209,12 +209,15 @@ module Mongoid
     # that schema, and when it is absent it asks the server for a schema
     # instead; a collection without a validator then yields no encryption at
     # all, and no error. Checking the namespace here is what turns that silent
-    # downgrade into a failure.
+    # downgrade into a failure. When the namespace is present, its entry is
+    # checked against the fields the model declares as encrypted too: a
+    # hand-written schema can cover the namespace and still leave out a field.
     #
     # @param [ Mongo::Client ] client The client this context resolved to.
     #
     # @raise [ Errors::NoEncryptionSchema ] if the model needs an encryption
-    #   schema and the client's schema does not cover the target namespace.
+    #   schema and the client's schema does not cover the target namespace, or
+    #   the namespace entry does not cover every encrypted field of the model.
     def verify_encryption_schema!(client)
       klass = @object.is_a?(Class) ? @object : @object.class
       # A model whose encrypted fields all live on embedded models declares no
@@ -229,9 +232,48 @@ module Mongoid
 
       schema_map = client.options.dig(:auto_encryption_options, :schema_map)
       namespace = "#{client.database.name}.#{collection_name}"
-      return if schema_map&.key?(namespace)
+      entry = schema_map && schema_map[namespace]
+      raise Errors::NoEncryptionSchema.new(klass, namespace, client_name) unless entry
 
-      raise Errors::NoEncryptionSchema.new(klass, namespace, client_name)
+      # The schema map may have been written by hand, with symbol keys rather
+      # than strings; both are tolerated at every level.
+      Mongoid.config.encrypted_paths_for(klass).each do |path|
+        next if encryption_schema_has_path?(entry, path)
+
+        raise Errors::NoEncryptionSchema.new(
+          klass, namespace, client_name, path.join('.')
+        )
+      end
+    end
+
+    # Whether a schema entry encrypts the property at the given path.
+    #
+    # @param [ Hash ] entry The namespace schema entry.
+    # @param [ Array<String> ] path The property path, outermost first.
+    #
+    # @return [ true | false ] Whether the leaf is marked as encrypted.
+    def encryption_schema_has_path?(entry, path)
+      node = entry
+      path.each do |name|
+        properties = schema_value(node, 'properties')
+        return false unless properties.is_a?(Hash)
+
+        node = schema_value(properties, name)
+        return false unless node.is_a?(Hash)
+      end
+      !schema_value(node, 'encrypt').nil?
+    end
+
+    # Read a schema key that may be written as a string or a symbol.
+    #
+    # @param [ Hash ] hash The schema object.
+    # @param [ String ] key The key to read.
+    #
+    # @return [ Object ] The value, or nil when the key is absent.
+    def schema_value(hash, key)
+      return hash[key] if hash.key?(key)
+
+      hash[key.to_sym]
     end
 
     def client_options

data/lib/mongoid/search_indexable.rb

@@ -421,7 +421,11 @@ module Mongoid
       #
       # @return [ Array<Hash> ] the raw index documents
       def get_indexes(names)
-        collection.search_indexes.select { |i| names.include?(i['name']) }
+        # Reading index metadata sends no document data, so it is exempt from
+        # the encryption schema check, like the other index operations here.
+        Threaded.with_collection_management do
+          collection.search_indexes.select { |i| names.include?(i['name']) }
+        end
       end
 
       # Resolves the index name and vector path from the declared specs,