Update test_create_new_keys to test production flow

We need to ensure that the "production flow" for QE works as expected
which includes:

- Run `showencryptedfieldsmap --create-new-keys` for new
  encrypted_fields_map.
- Update client settings to include new encrypted_fields_map.
- Check the key vault to make sure the keys in the map match the keys in
  the key vault.

Author: aclark4life

tests/encryption_/test_management.py

@@ -1,8 +1,12 @@
+import os
 from io import StringIO
 
+import pymongo
 from bson import json_util
 from django.core.management import call_command
+from django.db import connections
 from django.test import TransactionTestCase, modify_settings, override_settings
+from pymongo.encryption import AutoEncryptionOpts
 
 from .routers import TestEncryptedRouter
 
@@ -83,5 +87,20 @@ def test_create_new_keys(self):
             command_output["encryption__patientrecord"],
         )
 
-        # TODO: Create a new connection to verify that the keys can be used
-        # in a client-side configuration to migrate the encrypted fields.
+        # Create a new connection to verify that the keys can be used in a
+        # client-side configuration to migrate the encrypted fields.
+        conn_params = connections["encrypted"].get_connection_params()
+        auto_encryption_opts = AutoEncryptionOpts(
+            key_vault_namespace="encryption.__keyvault",
+            kms_providers={"local": {"key": os.urandom(96)}},
+            encrypted_fields_map=command_output,
+        )
+        if conn_params.pop("auto_encryption_opts", False):
+            # Call MongoClient instead of get_new_connection because
+            # get_new_connection will return the encrypted connection from the
+            # connection pool.
+            with pymongo.MongoClient(**conn_params, auto_encryption_opts=auto_encryption_opts):
+                call_command("migrate", "--database", "encrypted", verbosity=0)
+
+        # TODO: Check the key vault to ensure that the keys created by
+        # `showencryptedfieldsmap --create-new-keys` are in the key vault.