feat(NODE-6627): Add TS support to encrypted schemas

test/types/schema.test.ts

@@ -24,7 +24,7 @@ import {
   ValidateOpts,
   BufferToBinary
 } from 'mongoose';
-import { Binary } from 'mongodb';
+import { Binary, BSON } from 'mongodb';
 import { IsPathRequired } from '../../types/inferschematype';
 import { expectType, expectError, expectAssignable } from 'tsd';
 import { ObtainDocumentPathType, ResolvePathType } from '../../types/inferschematype';
@@ -591,6 +591,16 @@ const batchSchema2 = new Schema({ name: String }, { discriminatorKey: 'kind', st
 } } });
 batchSchema2.discriminator('event', eventSchema2);
 
+
+function encryptionType() {
+  const keyId = new BSON.UUID();
+  expectError<Schema>(new Schema({ name: { type: String, encrypt: { keyId } } }, { encryptionType: 'newFakeEncryptionType' }));
+  expectError<Schema>(new Schema({ name: { type: String, encrypt: { keyId } } }, { encryptionType: 1 }));
+
+  expectType<Schema>(new Schema({ name: { type: String, encrypt: { keyId } } }, { encryptionType: 'queryableEncryption' }));
+  expectType<Schema>(new Schema({ name: { type: String, encrypt: { keyId } } }, { encryptionType: 'csfle' }));
+}
+
 function gh11828() {
   interface IUser {
     name: string;

test/types/schemaTypeOptions.test.ts

@@ -1,3 +1,4 @@
+import { BSON } from 'mongodb';
 import {
   AnyArray,
   Schema,
@@ -74,3 +75,39 @@ function defaultOptions() {
   expectType<Record<string, any>>(new Schema.Types.Subdocument('none').defaultOptions);
   expectType<Record<string, any>>(new Schema.Types.UUID('none').defaultOptions);
 }
+
+function encrypt() {
+  const keyId = new BSON.UUID();
+
+  new SchemaTypeOptions<string>()['encrypt'] = { keyId, algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' };
+  new SchemaTypeOptions<string>()['encrypt'] = { keyId, algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' };
+  new SchemaTypeOptions<string>()['encrypt'] = { keyId, algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Random' };
+  new SchemaTypeOptions<string>()['encrypt'] = { keyId, algorithm: 'Indexed' };
+  new SchemaTypeOptions<string>()['encrypt'] = { keyId, algorithm: 'Unindexed' };
+  new SchemaTypeOptions<string>()['encrypt'] = { keyId, algorithm: 'Range' };
+  new SchemaTypeOptions<string>()['encrypt'] = { keyId, algorithm: undefined };
+
+  // qe + valid queries
+  new SchemaTypeOptions<string>()['encrypt'] = { keyId, queries: 'equality' };
+  new SchemaTypeOptions<string>()['encrypt'] = { keyId, queries: 'range' };
+  new SchemaTypeOptions<string>()['encrypt'] = { keyId, queries: undefined };
+
+  // empty object
+  expectError<SchemaTypeOptions<string>['encrypt']>({});
+
+  // invalid keyId
+  expectError<SchemaTypeOptions<string>['encrypt']>({ keyId: 'fakeId' });
+
+  // missing keyId
+  expectError<SchemaTypeOptions<string>['encrypt']>({ queries: 'equality' });
+  expectError<SchemaTypeOptions<string>['encrypt']>({ algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' });
+
+  // invalid algorithm
+  expectError<SchemaTypeOptions<string>['encrypt']>({ keyId, algorithm: 'SHA_FAKE_ALG' });
+
+  // invalid queries
+  expectError<SchemaTypeOptions<string>['encrypt']>({ keyId, queries: 'fakeQueryOption' });
+
+  // invalid input option
+  expectError<SchemaTypeOptions<string>['encrypt']>({ keyId, invalidKey: 'fakeKeyOption' });
+}

types/schemaoptions.d.ts

@@ -258,6 +258,11 @@ declare module 'mongoose' {
      * @default false
      */
     overwriteModels?: boolean;
+
+    /**
+     *  Required when the schema is encrypted.
+     */
+    encryptionType?: 'csfle' | 'queryableEncryption';
   }
 
   interface DefaultSchemaOptions {

types/schematypes.d.ts

@@ -1,3 +1,5 @@
+import * as BSON from 'bson';
+
 declare module 'mongoose' {
 
   /** The Mongoose Date [SchemaType](/docs/schematypes.html). */
@@ -207,6 +209,23 @@ declare module 'mongoose' {
     maxlength?: number | [number, string] | readonly [number, string];
 
     [other: string]: any;
+
+    encrypt?: {
+      /** The id of the  dataKey to use for encryption */
+      keyId: BSON.UUID;
+
+      /**
+       * Specifies the type of queries that the field can be queried on for Queryable Encryption.
+       * Required when `SchemaOptions.encryptionType` is 'queryableEncryption'
+      */
+      queries?: 'equality' | 'range';
+
+      /**
+       * The algorithm to use for encryption.
+       * Required when `SchemaOptions.encryptionType` is 'csfle'
+       */
+      algorithm?: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' | 'AEAD_AES_256_CBC_HMAC_SHA_512-Random' | 'Indexed' | 'Unindexed' | 'Range';
+    };
   }
 
   interface Validator<DocType = any> {