|
| 1 | +'use strict'; |
| 2 | + |
| 3 | +const assert = require('assert'); |
| 4 | +const mongodb = require('mongodb'); |
| 5 | +const fs = require('fs'); |
| 6 | +const isBsonType = require('../../lib/helpers/isBsonType'); |
| 7 | + |
| 8 | +const LOCAL_KEY = Buffer.from('Mng0NCt4ZHVUYUJCa1kxNkVyNUR1QURhZ2h2UzR2d2RrZzh0cFBwM3R6NmdWMDFBMUN3YkQ5aXRRMkhGRGdQV09wOGVNYUMxT2k3NjZKelhaQmRCZGJkTXVyZG9uSjFk', 'base64'); |
| 9 | + |
| 10 | +describe('ci', () => { |
| 11 | + |
| 12 | + const cachedUri = process.env.MONGOOSE_TEST_URI; |
| 13 | + const cachedLib = process.env.CRYPT_SHARED_LIB_PATH; |
| 14 | + |
| 15 | + before(function() { |
| 16 | + const cwd = process.cwd(); |
| 17 | + const file = fs.readFileSync(cwd + '/data/mo-expansion.yml', { encoding: 'utf-8' }).trim().split('\n'); |
| 18 | + const regex = /^(?<key>.*): "(?<value>.*)"$/; |
| 19 | + const variables = file.map((line) => regex.exec(line.trim()).groups).reduce((acc, { key, value }) => ({ ...acc, [key]: value }), {}); |
| 20 | + process.env.CRYPT_SHARED_LIB_PATH = variables.CRYPT_SHARED_LIB_PATH; |
| 21 | + process.env.MONGOOSE_TEST_URI = variables.MONGODB_URI; |
| 22 | + }); |
| 23 | + |
| 24 | + after(function() { |
| 25 | + process.env.CRYPT_SHARED_LIB_PATH = cachedLib; |
| 26 | + process.env.MONGOOSE_TEST_URI = cachedUri; |
| 27 | + }); |
| 28 | + |
| 29 | + describe('environmental variables', () => { |
| 30 | + it('MONGOOSE_TEST_URI is set', async function() { |
| 31 | + const uri = process.env.MONGOOSE_TEST_URI; |
| 32 | + assert.ok(uri); |
| 33 | + }); |
| 34 | + |
| 35 | + it('CRYPT_SHARED_LIB_PATH is set', async function() { |
| 36 | + const shared_library_path = process.env.CRYPT_SHARED_LIB_PATH; |
| 37 | + assert.ok(shared_library_path); |
| 38 | + }); |
| 39 | + }); |
| 40 | + |
| 41 | + describe('basic integration', () => { |
| 42 | + let keyVaultClient; |
| 43 | + let dataKey; |
| 44 | + let encryptedClient; |
| 45 | + let unencryptedClient; |
| 46 | + |
| 47 | + beforeEach(async function() { |
| 48 | + keyVaultClient = new mongodb.MongoClient(process.env.MONGOOSE_TEST_URI); |
| 49 | + await keyVaultClient.connect(); |
| 50 | + await keyVaultClient.db('keyvault').collection('datakeys'); |
| 51 | + const clientEncryption = new mongodb.ClientEncryption(keyVaultClient, { |
| 52 | + keyVaultNamespace: 'keyvault.datakeys', |
| 53 | + kmsProviders: { local: { key: LOCAL_KEY } } |
| 54 | + }); |
| 55 | + dataKey = await clientEncryption.createDataKey('local'); |
| 56 | + |
| 57 | + encryptedClient = new mongodb.MongoClient( |
| 58 | + process.env.MONGOOSE_TEST_URI, |
| 59 | + { |
| 60 | + autoEncryption: { |
| 61 | + keyVaultNamespace: 'keyvault.datakeys', |
| 62 | + kmsProviders: { local: { key: LOCAL_KEY } }, |
| 63 | + schemaMap: { |
| 64 | + 'db.coll': { |
| 65 | + bsonType: 'object', |
| 66 | + encryptMetadata: { |
| 67 | + keyId: [dataKey] |
| 68 | + }, |
| 69 | + properties: { |
| 70 | + a: { |
| 71 | + encrypt: { |
| 72 | + bsonType: 'int', |
| 73 | + algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Random', |
| 74 | + keyId: [dataKey] |
| 75 | + } |
| 76 | + } |
| 77 | + } |
| 78 | + } |
| 79 | + }, |
| 80 | + extraOptions: { |
| 81 | + cryptdSharedLibRequired: true, |
| 82 | + cryptSharedLibPath: process.env.CRYPT_SHARED_LIB_PATH |
| 83 | + } |
| 84 | + } |
| 85 | + } |
| 86 | + ); |
| 87 | + |
| 88 | + unencryptedClient = new mongodb.MongoClient(process.env.MONGOOSE_TEST_URI); |
| 89 | + }); |
| 90 | + |
| 91 | + afterEach(async function() { |
| 92 | + await keyVaultClient.close(); |
| 93 | + await encryptedClient.close(); |
| 94 | + await unencryptedClient.close(); |
| 95 | + }); |
| 96 | + |
| 97 | + it('ci set-up should support basic mongodb auto-encryption integration', async() => { |
| 98 | + await encryptedClient.connect(); |
| 99 | + const { insertedId } = await encryptedClient.db('db').collection('coll').insertOne({ a: 1 }); |
| 100 | + |
| 101 | + // client not configured with autoEncryption, returns a encrypted binary type, meaning that encryption succeeded |
| 102 | + const encryptedResult = await unencryptedClient.db('db').collection('coll').findOne({ _id: insertedId }); |
| 103 | + |
| 104 | + assert.ok(encryptedResult); |
| 105 | + assert.ok(encryptedResult.a); |
| 106 | + assert.ok(isBsonType(encryptedResult.a, 'Binary')); |
| 107 | + assert.ok(encryptedResult.a.sub_type === 6); |
| 108 | + |
| 109 | + // when the encryptedClient runs a find, the original unencrypted value is returned |
| 110 | + const unencryptedResult = await encryptedClient.db('db').collection('coll').findOne({ _id: insertedId }); |
| 111 | + assert.ok(unencryptedResult); |
| 112 | + assert.ok(unencryptedResult.a === 1); |
| 113 | + }); |
| 114 | + }); |
| 115 | +}); |
0 commit comments