1runOn:
2 - minServerVersion: "4.1.10"
3database_name: &database_name "default"
4collection_name: &collection_name "default"
5
6data:
7 - &doc0_encrypted { _id: 1, encrypted_string: {'$binary': {'base64': 'AQAAAAAAAAAAAAAAAAAAAAACwj+3zkv2VM+aTfk60RqhXq6a/77WlLwu/BxXFkL7EppGsju/m8f0x5kBDD3EZTtGALGXlym5jnpZAoSIkswHoA==', 'subType': '06'}} }
8json_schema: {'properties': {'encrypted_w_altname': {'encrypt': {'keyId': '/altname', 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Random'}}, 'encrypted_string': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'random': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Random'}}, 'encrypted_string_equivalent': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}}, 'bsonType': 'object'}
9key_vault_data: [{'status': 1, '_id': {'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}, 'masterKey': {'provider': 'aws', 'key': 'arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0', 'region': 'us-east-1'}, 'updateDate': {'$date': {'$numberLong': '1552949630483'}}, 'keyMaterial': {'$binary': {'base64': 'AQICAHhQNmWG2CzOm1dq3kWLM+iDUZhEqnhJwH9wZVpuZ94A8gEqnsxXlR51T5EbEVezUqqKAAAAwjCBvwYJKoZIhvcNAQcGoIGxMIGuAgEAMIGoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDHa4jo6yp0Z18KgbUgIBEIB74sKxWtV8/YHje5lv5THTl0HIbhSwM6EqRlmBiFFatmEWaeMk4tO4xBX65eq670I5TWPSLMzpp8ncGHMmvHqRajNBnmFtbYxN3E3/WjxmdbOOe+OXpnGJPcGsftc7cB2shRfA4lICPnE26+oVNXT6p0Lo20nY5XC7jyCO', 'subType': '00'}}, 'creationDate': {'$date': {'$numberLong': '1552949630483'}}, 'keyAltNames': ['altname', 'another_altname']}]
10
11tests:
12 - description: "Aggregate with deterministic encryption"
13 skipReason: "SERVER-39395"
14 clientOptions:
15 autoEncryptOpts:
16 kmsProviders:
17 aws: {} # Credentials filled in from environment.
18 operations:
19 - name: aggregate
20 arguments:
21 pipeline:
22 - { $match: { encrypted_string: "457-55-5642" } }
23 result:
24 - &doc0 { _id: 1, encrypted_string: "string0" }
25 expectations:
26 # Auto encryption will request the collection info.
27 - command_started_event:
28 command:
29 listCollections: 1
30 filter:
31 name: *collection_name
32 command_name: listCollections
33 # Then key is fetched from the key vault.
34 - command_started_event:
35 command:
36 find: datakeys
37 filter: {"$or": [{"_id": {"$in": [ {'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}} ] }}, {"keyAltNames": {"$in": []}}]}
38 $db: keyvault
39 readConcern: { level: "majority" }
40 command_name: find
41 - command_started_event:
42 command:
43 aggregate: *collection_name
44 pipeline:
45 - { $match: { encrypted_string: "457-55-5642" } }
46 command_name: aggregate
47 outcome:
48 collection:
49 # Outcome is checked using a separate MongoClient without auto encryption.
50 data:
51 - *doc0_encrypted
52 - description: "Aggregate with empty pipeline"
53 skipReason: "SERVER-40829 hides agg support behind enableTestCommands flag."
54 clientOptions:
55 autoEncryptOpts:
56 kmsProviders:
57 aws: {} # Credentials filled in from environment.
58 operations:
59 - name: aggregate
60 arguments:
61 pipeline: []
62 result:
63 - { _id: 1, encrypted_string: "string0" }
64 expectations:
65 # Auto encryption will request the collection info.
66 - command_started_event:
67 command:
68 listCollections: 1
69 filter:
70 name: *collection_name
71 command_name: listCollections
72 - command_started_event:
73 command:
74 aggregate: *collection_name
75 pipeline: []
76 cursor: {}
77 command_name: aggregate
78 # Needs to fetch key when decrypting results
79 # Then key is fetched from the key vault.
80 - command_started_event:
81 command:
82 find: datakeys
83 filter: {"$or": [{"_id": {"$in": [ {'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}} ] }}, {"keyAltNames": {"$in": []}}]}
84 $db: keyvault
85 readConcern: { level: "majority" }
86 command_name: find
87 outcome:
88 collection:
89 # Outcome is checked using a separate MongoClient without auto encryption.
90 data:
91 - *doc0_encrypted
92 - description: "Aggregate should fail with random encryption"
93 skipReason: "SERVER-39395"
94 clientOptions:
95 autoEncryptOpts:
96 kmsProviders:
97 aws: {} # Credentials filled in from environment.
98 operations:
99 - name: aggregate
100 arguments:
101 pipeline:
102 - { $match: { random: "abc" } }
103 result:
104 errorContains: "Cannot query on fields encrypted with the randomized encryption"
105 - description: "Database aggregate should fail"
106 clientOptions:
107 autoEncryptOpts:
108 kmsProviders:
109 aws: {} # Credentials filled in from environment.
110 operations:
111 - name: aggregate
112 object: database
113 arguments:
114 pipeline:
115 - $currentOp: { allUsers: false, idleConnections: false, localOps: true }
116 - $match: { command.aggregate: { $eq: 1 } }
117 - $project: { command: 1 }
118 - $project: { command.lsid: 0 }
119 result:
120 errorContains: "non-collection command not supported for auto encryption: aggregate"View as plain text