Skip to content

Commit 129b80f

Browse files
baileympearsonbaileympearson
committed
fix(NODE-6085): add TS support for KMIP data key options (mongodb#4128)
1 parent 17febb4 commit 129b80f

File tree

14 files changed

+919
-60
lines changed

14 files changed

+919
-60
lines changed

‎package-lock.json‎

Lines changed: 14 additions & 14 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@
9898
"js-yaml": "^4.1.0",
9999
"mocha": "^10.4.0",
100100
"mocha-sinon": "^2.1.2",
101-
"mongodb-client-encryption": "^6.0.0",
101+
"mongodb-client-encryption": "^6.0.1",
102102
"mongodb-legacy": "^6.0.1",
103103
"nyc": "^15.1.0",
104104
"prettier": "^2.8.8",

‎src/client-side-encryption/client_encryption.ts‎

Lines changed: 43 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -773,6 +773,7 @@ export interface ClientEncryptionRewrapManyDataKeyProviderOptions {
773773
| AWSEncryptionKeyOptions
774774
| AzureEncryptionKeyOptions
775775
| GCPEncryptionKeyOptions
776+
| KMIPEncryptionKeyOptions
776777
| undefined;
777778
}
778779

@@ -885,6 +886,47 @@ export interface AzureEncryptionKeyOptions {
885886
keyVersion?: string | undefined;
886887
}
887888

889+
/**
890+
* @public
891+
* Configuration options for making a KMIP encryption key
892+
*/
893+
export interface KMIPEncryptionKeyOptions {
894+
/**
895+
* keyId is the KMIP Unique Identifier to a 96 byte KMIP Secret Data managed object.
896+
*
897+
* If keyId is omitted, a random 96 byte KMIP Secret Data managed object will be created.
898+
*/
899+
keyId?: string;
900+
901+
/**
902+
* Host with optional port.
903+
*/
904+
endpoint?: string;
905+
906+
/**
907+
* If true, this key should be decrypted by the KMIP server.
908+
*/
909+
delegated?: boolean;
910+
}
911+
912+
/**
913+
* @public
914+
* Configuration options for making a KMIP encryption key
915+
*/
916+
export interface KMIPEncryptionKeyOptions {
917+
/**
918+
* keyId is the KMIP Unique Identifier to a 96 byte KMIP Secret Data managed object.
919+
*
920+
* If keyId is omitted, a random 96 byte KMIP Secret Data managed object will be created.
921+
*/
922+
keyId?: string;
923+
924+
/**
925+
* Host with optional port.
926+
*/
927+
endpoint?: string;
928+
}
929+
888930
/**
889931
* @public
890932
* Options to provide when creating a new data key.
@@ -897,6 +939,7 @@ export interface ClientEncryptionCreateDataKeyProviderOptions {
897939
| AWSEncryptionKeyOptions
898940
| AzureEncryptionKeyOptions
899941
| GCPEncryptionKeyOptions
942+
| KMIPEncryptionKeyOptions
900943
| undefined;
901944

902945
/**
@@ -909,19 +952,6 @@ export interface ClientEncryptionCreateDataKeyProviderOptions {
909952
keyMaterial?: Buffer | Binary;
910953
}
911954

912-
/**
913-
* @public
914-
* @experimental
915-
*/
916-
export interface ClientEncryptionRewrapManyDataKeyProviderOptions {
917-
provider: ClientEncryptionDataKeyProvider;
918-
masterKey?:
919-
| AWSEncryptionKeyOptions
920-
| AzureEncryptionKeyOptions
921-
| GCPEncryptionKeyOptions
922-
| undefined;
923-
}
924-
925955
/**
926956
* @public
927957
* @experimental

‎src/index.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,7 @@ export type {
225225
ClientEncryptionRewrapManyDataKeyResult,
226226
DataKey,
227227
GCPEncryptionKeyOptions,
228+
KMIPEncryptionKeyOptions,
228229
RangeOptions
229230
} from './client-side-encryption/client_encryption';
230231
export {

‎test/spec/client-side-encryption/tests/legacy/azureKMS.json‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,17 @@
7878
"bsonType": "string",
7979
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
8080
}
81+
},
82+
"encrypted_string_kmip_delegated": {
83+
"encrypt": {
84+
"keyId": [
85+
{
86+
"$uuid": "7411e9af-c688-4df7-8143-5e60ae96cba6"
87+
}
88+
],
89+
"bsonType": "string",
90+
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
91+
}
8192
}
8293
},
8394
"bsonType": "object"

‎test/spec/client-side-encryption/tests/legacy/azureKMS.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ database_name: &database_name "default"
44
collection_name: &collection_name "default"
55

66
data: []
7-
json_schema: {'properties': {'encrypted_string_aws': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_azure': {'encrypt': {'keyId': [{'$binary': {'base64': 'AZURE+AAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_gcp': {'encrypt': {'keyId': [{'$binary': {'base64': 'GCP+AAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_local': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_kmip': {'encrypt': {'keyId': [{'$binary': {'base64': 'dBHpr8aITfeBQ15grpbLpQ==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}}, 'bsonType': 'object'}
7+
json_schema: {'properties': {'encrypted_string_aws': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_azure': {'encrypt': {'keyId': [{'$binary': {'base64': 'AZURE+AAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_gcp': {'encrypt': {'keyId': [{'$binary': {'base64': 'GCP+AAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_local': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_kmip': {'encrypt': {'keyId': [{'$binary': {'base64': 'dBHpr8aITfeBQ15grpbLpQ==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_kmip_delegated': {'encrypt': {'keyId': [{'$uuid': '7411e9af-c688-4df7-8143-5e60ae96cba6'}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}}, 'bsonType': 'object'}
88
key_vault_data: [{'_id': {'$binary': {'base64': 'AZURE+AAAAAAAAAAAAAAAA==', 'subType': '04'}}, 'keyMaterial': {'$binary': {'base64': 'n+HWZ0ZSVOYA3cvQgP7inN4JSXfOH85IngmeQxRpQHjCCcqT3IFqEWNlrsVHiz3AELimHhX4HKqOLWMUeSIT6emUDDoQX9BAv8DR1+E1w4nGs/NyEneac78EYFkK3JysrFDOgl2ypCCTKAypkn9CkAx1if4cfgQE93LW4kczcyHdGiH36CIxrCDGv1UzAvERN5Qa47DVwsM6a+hWsF2AAAJVnF0wYLLJU07TuRHdMrrphPWXZsFgyV+lRqJ7DDpReKNO8nMPLV/mHqHBHGPGQiRdb9NoJo8CvokGz4+KE8oLwzKf6V24dtwZmRkrsDV4iOhvROAzz+Euo1ypSkL3mw==', 'subType': '00'}}, 'creationDate': {'$date': {'$numberLong': '1601573901680'}}, 'updateDate': {'$date': {'$numberLong': '1601573901680'}}, 'status': {'$numberInt': '0'}, 'masterKey': {'provider': 'azure', 'keyVaultEndpoint': 'key-vault-csfle.vault.azure.net', 'keyName': 'key-name-csfle'}, 'keyAltNames': ['altname', 'azure_altname']}]
99

1010
tests:

‎test/spec/client-side-encryption/tests/legacy/gcpKMS.json‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,17 @@
7878
"bsonType": "string",
7979
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
8080
}
81+
},
82+
"encrypted_string_kmip_delegated": {
83+
"encrypt": {
84+
"keyId": [
85+
{
86+
"$uuid": "7411e9af-c688-4df7-8143-5e60ae96cba6"
87+
}
88+
],
89+
"bsonType": "string",
90+
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
91+
}
8192
}
8293
},
8394
"bsonType": "object"

‎test/spec/client-side-encryption/tests/legacy/gcpKMS.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ database_name: &database_name "default"
44
collection_name: &collection_name "default"
55

66
data: []
7-
json_schema: {'properties': {'encrypted_string_aws': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_azure': {'encrypt': {'keyId': [{'$binary': {'base64': 'AZURE+AAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_gcp': {'encrypt': {'keyId': [{'$binary': {'base64': 'GCP+AAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_local': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_kmip': {'encrypt': {'keyId': [{'$binary': {'base64': 'dBHpr8aITfeBQ15grpbLpQ==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}}, 'bsonType': 'object'}
7+
json_schema: {'properties': {'encrypted_string_aws': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_azure': {'encrypt': {'keyId': [{'$binary': {'base64': 'AZURE+AAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_gcp': {'encrypt': {'keyId': [{'$binary': {'base64': 'GCP+AAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_local': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_kmip': {'encrypt': {'keyId': [{'$binary': {'base64': 'dBHpr8aITfeBQ15grpbLpQ==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'encrypted_string_kmip_delegated': {'encrypt': {'keyId': [{'$uuid': '7411e9af-c688-4df7-8143-5e60ae96cba6'}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}}, 'bsonType': 'object'}
88
key_vault_data: [{'_id': {'$binary': {'base64': 'GCP+AAAAAAAAAAAAAAAAAA==', 'subType': '04'}}, 'keyMaterial': {'$binary': {'base64': 'CiQAIgLj0WyktnB4dfYHo5SLZ41K4ASQrjJUaSzl5vvVH0G12G0SiQEAjlV8XPlbnHDEDFbdTO4QIe8ER2/172U1ouLazG0ysDtFFIlSvWX5ZnZUrRMmp/R2aJkzLXEt/zf8Mn4Lfm+itnjgo5R9K4pmPNvvPKNZX5C16lrPT+aA+rd+zXFSmlMg3i5jnxvTdLHhg3G7Q/Uv1ZIJskKt95bzLoe0tUVzRWMYXLIEcohnQg==', 'subType': '00'}}, 'creationDate': {'$date': {'$numberLong': '1601574333107'}}, 'updateDate': {'$date': {'$numberLong': '1601574333107'}}, 'status': {'$numberInt': '0'}, 'masterKey': {'provider': 'gcp', 'projectId': 'devprod-drivers', 'location': 'global', 'keyRing': 'key-ring-csfle', 'keyName': 'key-name-csfle'}, 'keyAltNames': ['altname', 'gcp_altname']}]
99

1010
tests:

‎test/spec/client-side-encryption/tests/legacy/kmipKMS.json‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,17 @@
7878
"bsonType": "string",
7979
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
8080
}
81+
},
82+
"encrypted_string_kmip_delegated": {
83+
"encrypt": {
84+
"keyId": [
85+
{
86+
"$uuid": "7411e9af-c688-4df7-8143-5e60ae96cba6"
87+
}
88+
],
89+
"bsonType": "string",
90+
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
91+
}
8192
}
8293
},
8394
"bsonType": "object"
@@ -117,6 +128,38 @@
117128
"altname",
118129
"kmip_altname"
119130
]
131+
},
132+
{
133+
"_id": {
134+
"$uuid": "7411e9af-c688-4df7-8143-5e60ae96cba6"
135+
},
136+
"keyMaterial": {
137+
"$binary": {
138+
"base64": "5TLMFWlguBWe5GUESTvOVtkdBsCrynhnV72XRyZ66/nk+EP9/1oEp1t1sg0+vwCTqULHjBiUE6DRx2mYD/Eup1+u2Jgz9/+1sV1drXeOPALNPkSgiZiDbIb67zRi+wTABEcKcegJH+FhmSGxwUoQAiHCsCbcvia5P8tN1lt98YQ=",
139+
"subType": "00"
140+
}
141+
},
142+
"creationDate": {
143+
"$date": {
144+
"$numberLong": "1634220190041"
145+
}
146+
},
147+
"updateDate": {
148+
"$date": {
149+
"$numberLong": "1634220190041"
150+
}
151+
},
152+
"status": {
153+
"$numberInt": "0"
154+
},
155+
"masterKey": {
156+
"provider": "kmip",
157+
"delegated": true,
158+
"keyId": "11"
159+
},
160+
"keyAltNames": [
161+
"delegated"
162+
]
120163
}
121164
],
122165
"tests": [
@@ -218,6 +261,113 @@
218261
]
219262
}
220263
}
264+
},
265+
{
266+
"description": "Insert a document with auto encryption using KMIP delegated KMS provider",
267+
"clientOptions": {
268+
"autoEncryptOpts": {
269+
"kmsProviders": {
270+
"kmip": {}
271+
}
272+
}
273+
},
274+
"operations": [
275+
{
276+
"name": "insertOne",
277+
"arguments": {
278+
"document": {
279+
"_id": 1,
280+
"encrypted_string_kmip_delegated": "string0"
281+
}
282+
}
283+
}
284+
],
285+
"expectations": [
286+
{
287+
"command_started_event": {
288+
"command": {
289+
"listCollections": 1,
290+
"filter": {
291+
"name": "default"
292+
}
293+
},
294+
"command_name": "listCollections"
295+
}
296+
},
297+
{
298+
"command_started_event": {
299+
"command": {
300+
"listCollections": 1,
301+
"filter": {
302+
"name": "datakeys"
303+
}
304+
},
305+
"command_name": "listCollections"
306+
}
307+
},
308+
{
309+
"command_started_event": {
310+
"command": {
311+
"find": "datakeys",
312+
"filter": {
313+
"$or": [
314+
{
315+
"_id": {
316+
"$in": [
317+
{
318+
"$uuid": "7411e9af-c688-4df7-8143-5e60ae96cba6"
319+
}
320+
]
321+
}
322+
},
323+
{
324+
"keyAltNames": {
325+
"$in": []
326+
}
327+
}
328+
]
329+
},
330+
"$db": "keyvault"
331+
},
332+
"command_name": "find"
333+
}
334+
},
335+
{
336+
"command_started_event": {
337+
"command": {
338+
"insert": "default",
339+
"documents": [
340+
{
341+
"_id": 1,
342+
"encrypted_string_kmip_delegated": {
343+
"$binary": {
344+
"base64": "AXQR6a/GiE33gUNeYK6Wy6YCkB+8NVfAAjIbvLqyXIg6g1a8tXrym92DPoqmxpcdQyH0vQM3aFNMz7tZwQBimKs29ztZV/LWjM633HhO5ACl9A==",
345+
"subType": "06"
346+
}
347+
}
348+
}
349+
],
350+
"ordered": true
351+
},
352+
"command_name": "insert"
353+
}
354+
}
355+
],
356+
"outcome": {
357+
"collection": {
358+
"data": [
359+
{
360+
"_id": 1,
361+
"encrypted_string_kmip_delegated": {
362+
"$binary": {
363+
"base64": "AXQR6a/GiE33gUNeYK6Wy6YCkB+8NVfAAjIbvLqyXIg6g1a8tXrym92DPoqmxpcdQyH0vQM3aFNMz7tZwQBimKs29ztZV/LWjM633HhO5ACl9A==",
364+
"subType": "06"
365+
}
366+
}
367+
}
368+
]
369+
}
370+
}
221371
}
222372
]
223373
}

0 commit comments

Comments
 (0)