INTPYTHON-527 Add Queryable Encryption support

.evergreen/run-tests.sh

@@ -6,6 +6,7 @@ set -eux
 /opt/python/3.10/bin/python3 -m venv venv
 . venv/bin/activate
 python -m pip install -U pip
+pip install ".[encryption]"
 pip install -e .
 
 # Install django and test dependencies

.github/workflows/encrypted_settings.py

@@ -0,0 +1,18 @@
+import os
+
+from mongodb_settings import *  # noqa: F403
+from pymongo.encryption import AutoEncryptionOpts
+
+DATABASES["encrypted"] = {  # noqa: F405
+    "ENGINE": "django_mongodb_backend",
+    "NAME": "djangotests-encrypted",
+    "OPTIONS": {
+        "auto_encryption_opts": AutoEncryptionOpts(
+            key_vault_namespace="my_encrypted_database.keyvault",
+            kms_providers={"local": {"key": os.urandom(96)}},
+            # crypt_shared_lib_path="lib/mongo_crypt_v1.so",
+        ),
+        "directConnection": True,
+    },
+    "KMS_CREDENTIALS": {},
+}

.github/workflows/mongodb_settings.py

@@ -14,6 +14,7 @@
     DATABASES = {
         "default": {**db_settings, "NAME": "djangotests"},
         "other": {**db_settings, "NAME": "djangotests-other"},
+        "encrypted": {},
     }
 else:
     DATABASES = {
@@ -28,8 +29,26 @@
             "NAME": "djangotests-other",
             "OPTIONS": {"directConnection": True},
         },
+        "encrypted": {},
     }
 
+
+class EncryptedRouter:
+    def allow_migrate(self, db, app_label, model_name=None, **hints):
+        # The encryption_ app's models are only created in the encrypted
+        # database.
+        if app_label == "encryption_":
+            return db == "encrypted"
+        # Don't create other app's models in the encrypted database.
+        if db == "encrypted":
+            return False
+        return None
+
+    def kms_provider(self, model, **hints):
+        return "local"
+
+
+DATABASE_ROUTERS = [EncryptedRouter()]
 DEFAULT_AUTO_FIELD = "django_mongodb_backend.fields.ObjectIdAutoField"
 PASSWORD_HASHERS = ("django.contrib.auth.hashers.MD5PasswordHasher",)
 SECRET_KEY = "django_tests_secret_key"