diff --git a/test/types/schema.test.ts b/test/types/schema.test.ts index 13408eaf293..00e0445878f 100644 --- a/test/types/schema.test.ts +++ b/test/types/schema.test.ts @@ -24,7 +24,7 @@ import { ValidateOpts, BufferToBinary } from 'mongoose'; -import { Binary } from 'mongodb'; +import { Binary, BSON } from 'mongodb'; import { IsPathRequired } from '../../types/inferschematype'; import { expectType, expectError, expectAssignable } from 'tsd'; import { ObtainDocumentPathType, ResolvePathType } from '../../types/inferschematype'; @@ -591,6 +591,16 @@ const batchSchema2 = new Schema({ name: String }, { discriminatorKey: 'kind', st } } }); batchSchema2.discriminator('event', eventSchema2); + +function encryptionType() { + const keyId = new BSON.UUID(); + expectError(new Schema({ name: { type: String, encrypt: { keyId } } }, { encryptionType: 'newFakeEncryptionType' })); + expectError(new Schema({ name: { type: String, encrypt: { keyId } } }, { encryptionType: 1 })); + + expectType(new Schema({ name: { type: String, encrypt: { keyId } } }, { encryptionType: 'queryableEncryption' })); + expectType(new Schema({ name: { type: String, encrypt: { keyId } } }, { encryptionType: 'csfle' })); +} + function gh11828() { interface IUser { name: string; diff --git a/test/types/schemaTypeOptions.test.ts b/test/types/schemaTypeOptions.test.ts index 3514b01d7e9..4f38ceab909 100644 --- a/test/types/schemaTypeOptions.test.ts +++ b/test/types/schemaTypeOptions.test.ts @@ -1,3 +1,4 @@ +import { BSON } from 'mongodb'; import { AnyArray, Schema, @@ -74,3 +75,39 @@ function defaultOptions() { expectType>(new Schema.Types.Subdocument('none').defaultOptions); expectType>(new Schema.Types.UUID('none').defaultOptions); } + +function encrypt() { + const keyId = new BSON.UUID(); + + new SchemaTypeOptions()['encrypt'] = { keyId, algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' }; + new SchemaTypeOptions()['encrypt'] = { keyId, algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' }; + new SchemaTypeOptions()['encrypt'] = { keyId, algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Random' }; + new SchemaTypeOptions()['encrypt'] = { keyId, algorithm: 'Indexed' }; + new SchemaTypeOptions()['encrypt'] = { keyId, algorithm: 'Unindexed' }; + new SchemaTypeOptions()['encrypt'] = { keyId, algorithm: 'Range' }; + new SchemaTypeOptions()['encrypt'] = { keyId, algorithm: undefined }; + + // qe + valid queries + new SchemaTypeOptions()['encrypt'] = { keyId, queries: 'equality' }; + new SchemaTypeOptions()['encrypt'] = { keyId, queries: 'range' }; + new SchemaTypeOptions()['encrypt'] = { keyId, queries: undefined }; + + // empty object + expectError['encrypt']>({}); + + // invalid keyId + expectError['encrypt']>({ keyId: 'fakeId' }); + + // missing keyId + expectError['encrypt']>({ queries: 'equality' }); + expectError['encrypt']>({ algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' }); + + // invalid algorithm + expectError['encrypt']>({ keyId, algorithm: 'SHA_FAKE_ALG' }); + + // invalid queries + expectError['encrypt']>({ keyId, queries: 'fakeQueryOption' }); + + // invalid input option + expectError['encrypt']>({ keyId, invalidKey: 'fakeKeyOption' }); +} diff --git a/types/schemaoptions.d.ts b/types/schemaoptions.d.ts index 4df87a806ea..f661e1643de 100644 --- a/types/schemaoptions.d.ts +++ b/types/schemaoptions.d.ts @@ -258,6 +258,11 @@ declare module 'mongoose' { * @default false */ overwriteModels?: boolean; + + /** + * Required when the schema is encrypted. + */ + encryptionType?: 'csfle' | 'queryableEncryption'; } interface DefaultSchemaOptions { diff --git a/types/schematypes.d.ts b/types/schematypes.d.ts index 5f364f0cea4..a59f8c46668 100644 --- a/types/schematypes.d.ts +++ b/types/schematypes.d.ts @@ -1,3 +1,5 @@ +import * as BSON from 'bson'; + declare module 'mongoose' { /** The Mongoose Date [SchemaType](/docs/schematypes.html). */ @@ -207,6 +209,23 @@ declare module 'mongoose' { maxlength?: number | [number, string] | readonly [number, string]; [other: string]: any; + + encrypt?: { + /** The id of the dataKey to use for encryption */ + keyId: BSON.UUID; + + /** + * Specifies the type of queries that the field can be queried on for Queryable Encryption. + * Required when `SchemaOptions.encryptionType` is 'queryableEncryption' + */ + queries?: 'equality' | 'range'; + + /** + * The algorithm to use for encryption. + * Required when `SchemaOptions.encryptionType` is 'csfle' + */ + algorithm?: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' | 'AEAD_AES_256_CBC_HMAC_SHA_512-Random' | 'Indexed' | 'Unindexed' | 'Range'; + }; } interface Validator {