@@ -543,55 +543,44 @@ def _get_encrypted_fields(
543
543
master_key = connection .settings_dict .get ("KMS_CREDENTIALS" , {}).get (kms_provider )
544
544
client_encryption = getattr (self .connection , "client_encryption" , None )
545
545
546
- def _field_dict (bson_type , path , new_key_alt_name , queries = None ):
547
- """Helper to generate a dictionary for an encrypted field.
548
- Included in parent function's scope to avoid passing parameters.
549
- """
550
- data_key = self ._get_data_key (
551
- client_encryption ,
552
- key_vault_collection ,
553
- create_data_keys ,
554
- kms_provider ,
555
- master_key ,
556
- new_key_alt_name ,
557
- )
558
- field_dict = {
559
- "bsonType" : bson_type ,
560
- "path" : path ,
561
- "keyId" : data_key ,
562
- }
563
- if queries :
564
- field_dict ["queries" ] = queries
565
- return field_dict
566
-
567
546
field_list = []
568
547
569
548
for field in fields :
570
549
new_key_alt_name = f"{ key_alt_name } .{ field .column } "
571
550
path = f"{ path_prefix } .{ field .column } " if path_prefix else field .column
572
551
573
- if isinstance (field , (EmbeddedModelField , EmbeddedModelArrayField )):
574
- if getattr (field , "encrypted" , False ):
575
- bson_type = "object" if isinstance (field , EmbeddedModelField ) else "array"
576
- field_list .append (
577
- _field_dict (
578
- bson_type , path , new_key_alt_name , getattr (field , "queries" , None )
579
- )
580
- )
581
- else :
582
- embedded_result = self ._get_encrypted_fields (
583
- field .embedded_model ,
584
- create_data_keys = create_data_keys ,
585
- key_alt_name = new_key_alt_name ,
586
- path_prefix = path ,
587
- )
588
- if embedded_result :
589
- field_list .extend (embedded_result ["fields" ])
590
- elif getattr (field , "encrypted" , False ):
552
+ if isinstance (field , (EmbeddedModelField , EmbeddedModelArrayField )) and not getattr (
553
+ field , "encrypted" , False
554
+ ):
555
+ embedded_result = self ._get_encrypted_fields (
556
+ field .embedded_model ,
557
+ create_data_keys = create_data_keys ,
558
+ key_alt_name = new_key_alt_name ,
559
+ path_prefix = path ,
560
+ )
561
+ if embedded_result :
562
+ field_list .extend (embedded_result ["fields" ])
563
+ continue
564
+
565
+ if getattr (field , "encrypted" , False ):
591
566
bson_type = field .db_type (connection )
592
- field_list .append (
593
- _field_dict (bson_type , path , new_key_alt_name , getattr (field , "queries" , None ))
567
+ data_key = self ._get_data_key (
568
+ client_encryption ,
569
+ key_vault_collection ,
570
+ create_data_keys ,
571
+ kms_provider ,
572
+ master_key ,
573
+ new_key_alt_name ,
594
574
)
575
+ field_dict = {
576
+ "bsonType" : bson_type ,
577
+ "path" : path ,
578
+ "keyId" : data_key ,
579
+ }
580
+ queries = getattr (field , "queries" , None )
581
+ if queries :
582
+ field_dict ["queries" ] = queries
583
+ field_list .append (field_dict )
595
584
596
585
return {"fields" : field_list } if field_list else None
597
586
0 commit comments