|
4 | 4 | * to create an auto-encryption-aware connection. |
5 | 5 | */ |
6 | 6 |
|
7 | | -export default String.raw` |
8 | | -const assert = function(value, message) { |
9 | | - if (!value) { |
10 | | - console.error('assertion failed:', message); |
11 | | - unencryptedDb.dropDatabase(); |
12 | | - process.exit(1); |
13 | | - } |
14 | | -}; |
15 | | -if (db.version().startsWith('4.0.') || |
16 | | - !db.runCommand({buildInfo:1}).modules.includes('enterprise')) { |
17 | | - // No FLE on mongod < 4.2 or community |
18 | | - print('Test skipped') |
19 | | - process.exit(0) |
20 | | -} |
21 | | -
|
22 | | -const dbname = 'testdb_fle' + new Date().getTime(); |
23 | | -use(dbname); |
24 | | -unencryptedDb = db; |
25 | | -assert(db.getName() === dbname, 'db name must match'); |
26 | | -
|
27 | | -const local = { key: Buffer.from('kh4Gv2N8qopZQMQYMEtww/AkPsIrXNmEMxTrs3tUoTQZbZu4msdRUaR8U5fXD7A7QXYHcEvuu4WctJLoT+NvvV3eeIg3MD+K8H9SR794m/safgRHdIfy6PD+rFpvmFbY', 'base64') }; |
28 | | -
|
29 | | -const keyMongo = Mongo(db.getMongo(), { |
30 | | - keyVaultNamespace: dbname + '.__keyVault', |
31 | | - kmsProviders: { local } |
32 | | -}); |
33 | | -
|
34 | | -const keyVault = keyMongo.getKeyVault(); |
35 | | -const keyId = keyVault.createKey('local'); |
36 | | -sleep(100); |
37 | | -
|
38 | | -const schemaMap = {}; |
39 | | -schemaMap[dbname + '.employees'] = { |
40 | | - bsonType: 'object', |
41 | | - properties: { |
42 | | - taxid: { |
43 | | - encrypt: { |
44 | | - keyId: [keyId], |
45 | | - bsonType: 'string', |
46 | | - algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Random' |
47 | | - } |
48 | | - } |
49 | | - } |
50 | | -}; |
51 | | -
|
52 | | -console.log('Using schema map', schemaMap); |
53 | | -
|
54 | | -const autoMongo = Mongo(db.getMongo(), { |
55 | | - keyVaultNamespace: dbname + '.__keyVault', |
56 | | - kmsProviders: { local }, |
57 | | - schemaMap |
58 | | -}); |
59 | | -
|
60 | | -db = autoMongo.getDB(dbname); |
61 | | -db.employees.insertOne({ taxid: 'abc' }); |
62 | | -
|
63 | | -// If there is some failure that is not related to the assert() calls, we still |
64 | | -// want to make sure that we only print the success message if everything |
65 | | -// has worked so far, because the shell keeps evaluating statements after errors. |
66 | | -let verifiedEncrypted = false |
67 | | -let verifiedUnencrypted = false |
68 | | -{ |
69 | | - const document = db.employees.find().toArray()[0]; |
70 | | - console.log('auto-decrypted document', document); |
71 | | - verifiedEncrypted = document.taxid === 'abc'; |
72 | | - assert(verifiedEncrypted, 'Must do automatic decryption'); |
73 | | -} |
74 | | -db = unencryptedDb; |
75 | | -{ |
76 | | - const document = db.employees.find().toArray()[0]; |
77 | | - console.log('non-decrypted document', document); |
78 | | - verifiedUnencrypted = document.taxid instanceof Binary && document.taxid.sub_type === 6; |
79 | | - assert(verifiedUnencrypted, 'Must not do decryption without keys'); |
80 | | -} |
81 | | -if (verifiedEncrypted && verifiedUnencrypted) { |
82 | | - print('Test succeeded') |
83 | | -} |
84 | | -db.dropDatabase(); |
85 | | -`; |
| 7 | +export default String.raw`print('Test skipped')`; |
0 commit comments