DRIVERS-2888 Support QE with Client.bulkWrite #1770

mdb-ad · 2025-03-17T21:39:29Z

Add spec test for client bulkWrite QE.

C driver implementation

libmongocrypt requirement: 1.10
Drivers changes required:

QE unified test support (DRIVERS-3106)
bulkWrite specific changes: don't error on QE bulkWrite. Implement batch splitting.

Please complete the following before merging:

Update changelog.
Test changes in at least one language driver. (C driver)
Test these changes against all server versions and topologies (including standalone, replica set, sharded
clusters, and serverless). (Note: C driver doesn't currently test CSFLE with sharded)

Co-authored-by: Kevin Albertson <[email protected]>

nbbeeken

I may be out of the loop on some of the context, are drivers changes needed to get these passing? Is there a specific libmongocrypt version needed?

There seems to be more unified test changes in the C driver than are here, are those just extra test sync(s) or are they new tests?

Node.js Test Failures

  1) CRUD unified
       client bulkWrite with queryable encryption
         client bulkWrite QE replaceOne:
     MongoBulkWriteError: Document failed validation
      at LegacyOrderedBulkOperation.handleWriteError (src/bulk/common.ts:1224:13)
      at executeCommands (src/bulk/common.ts:587:19)
      at processTicksAndRejections (node:internal/process/task_queues:105:5)
      at async BulkWriteShimOperation.execute (src/bulk/common.ts:882:12)
      at async tryOperation (src/operations/execute_operation.ts:283:14)
      at async executeOperation (src/operations/execute_operation.ts:115:12)
      at async LegacyOrderedBulkOperation.execute (src/bulk/common.ts:1211:12)
      at async BulkWriteOperation.execute (src/operations/bulk_write.ts:60:12)
      at async InsertManyOperation.execute (src/operations/insert.ts:147:19)
      at async tryOperation (src/operations/execute_operation.ts:283:14)
      at async executeOperation (src/operations/execute_operation.ts:115:12)
      at async Collection.insertMany (src/collection.ts:307:12)
      at async insertMany (test/tools/unified-spec-runner/operations.ts:411:10)
      at async executeOperationAndCheck (test/tools/unified-spec-runner/operations.ts:1039:14)
      at async runUnifiedTest (test/tools/unified-spec-runner/runner.ts:226:9)
      at async Context.<anonymous> (test/tools/unified-spec-runner/runner.ts:336:13)

  2) CRUD unified
       client bulkWrite with queryable encryption
         client bulkWrite QE with multiple replace fails:
     AssertionError: Operation clientBulkWrite succeeded but was not supposed to
      at executeOperationAndCheck (test/tools/unified-spec-runner/operations.ts:1057:12)
      at processTicksAndRejections (node:internal/process/task_queues:105:5)
      at async runUnifiedTest (test/tools/unified-spec-runner/runner.ts:226:9)
      at async Context.<anonymous> (test/tools/unified-spec-runner/runner.ts:336:13)

kevinAlbs

Suggest updating this PR description to give an overview of needed changes. I expect implementors will refer to this PR (and the C driver PR).

C driver implementation

Suggest linking to the C driver PR (once created) rather than the Evergreen patch. The patch appears to include unrelated spec tests.

source/crud/tests/unified/client-bulkWrite-qe.yml

source/crud/bulk-write.md

source/crud/tests/unified/client-bulkWrite-qe.yml

mdb-ad · 2025-07-24T19:30:10Z

I may be out of the loop on some of the context, are drivers changes needed to get these passing? Is there a specific libmongocrypt version needed?

libmongocrypt 1.10 is required.

There seems to be more unified test changes in the C driver than are here, are those just extra test sync(s) or are they new tests?

Description updated: the linked C driver changes in the description are bulkWrite-related only

isabelatkinson

Tests pass in Rust. Draft PR: mongodb/mongo-rust-driver#1445

There are some updates needed in the bulk write spec to account for the different command-building logic. Here's a commit with proposed changes: isabelatkinson@a060234

source/client-side-encryption/tests/README.md

baileympearson · 2025-08-11T15:56:53Z

source/crud/tests/unified/client-bulkWrite-qe.yml

+runOnRequirements:
+  - minServerVersion: "8.0"
+    serverless: forbid # Serverless does not support bulkWrite: CLOUDP-256344.
+    csfle: true


Can we update the tests in this PR to specify the libmongocrypt version as a runOnRequirement?

https://github.com/mongodb/specifications/blob/master/source/unified-test-format/unified-test-format.md#:~:text=minLibmongocryptVersion%3A%20Optional%20string.%20The%20minimum%20libmongocrypt%20(inclusive)%20required%20to%20successfully%20run%20the%20tests.%20If%20this%20field%20is%20omitted%2C%20there%20is%20no%20lower%20bound%20on%20the%20required%20libmongocrypt%20version.%20The%20format%20of%20this%20string%20is%20defined%20in%20Version%20String.

@mdb-ad I expect this can be specified with:

csfle: minLibmongocryptVersion: 1.10.0

And update schemaVersion to 1.25 to include the change for minLibmongocryptVersion.

See mongodb/mongo-c-driver#2069 for an implementation of minLibmongocryptVersion in the C driver.

baileympearson · 2025-08-11T16:20:53Z

@kevinAlbs @mdb-ad Is there any chance https://jira.mongodb.org/browse/DRIVERS-2859 can be completed before DRIVERS-2888? It makes much more sense to make the change in once place than making the changes in every driver. This is especially true because drivers supporting non-document sequences for client bulk write will be temporary until https://jira.mongodb.org/browse/DRIVERS-2859 is addressed. So making drivers implement the changes before https://jira.mongodb.org/browse/DRIVERS-2859 will cost extra work in every driver, extra work updating the spec to allow (or enforce) document sequences with bulk write after https://jira.mongodb.org/browse/DRIVERS-2859 is implemented, and then again extra work in drivers to support document sequencing for bulkWrite with QE.

From a more selfish, Node-specific perspective - our bulkWrite implementation is tightly coupled to document sequences and making this change might be non-trivial. I'd rather not refactor our bulk write implementation unless absolutely necessary.

kevinAlbs · 2025-08-11T19:20:13Z

drivers supporting non-document sequences for client bulk write will be temporary until https://jira.mongodb.org/browse/DRIVERS-2859 is addressed

The C driver only required a minor change to support QE with MongoClient.bulkWrite. Supporting CSFLE with MongoCollection.bulkWrite already requires passing all write documents in a non-document sequence, and the C driver reuses it.

I propose: proceed with this PR to unblock some drivers with QE, but add a blurb suggesting drivers wait for DRIVERS-2859:

Auto-Encryption

libmongocrypt does not-yet support OP_MSG document sequences (DRIVERS-2859). Drivers requiring significant changes to pass a bulkWrite command to libmongocrypt may prefer to wait until DRIVERS-2859 is implemented to support automatic encryption.

kevinAlbs · 2025-08-14T14:56:10Z

source/crud/tests/unified/client-bulkWrite-qe.yml

+runOnRequirements:
+  - minServerVersion: "8.0"
+    serverless: forbid # Serverless does not support bulkWrite: CLOUDP-256344.
+    csfle: true


@mdb-ad I expect this can be specified with:

csfle: minLibmongocryptVersion: 1.10.0

And update schemaVersion to 1.25 to include the change for minLibmongocryptVersion.

See mongodb/mongo-c-driver#2069 for an implementation of minLibmongocryptVersion in the C driver.

kevinAlbs · 2025-08-14T15:21:09Z

source/client-side-encryption/tests/README.md

@@ -563,10 +563,13 @@ First, perform the setup.
 2. Using `client`, drop and create the collection `db.coll` configured with the included JSON schema
    [limits/limits-schema.json](../limits/limits-schema.json).

-3. Using `client`, drop the collection `keyvault.datakeys`. Insert the document
+3. Using `client`, drop and create the collection `db.coll2` configured with the included encryptedFields


Suggested change

3. Using `client`, drop and create the collection `db.coll2` configured with the included encryptedFields

3. If using MongoDB 8.0+, use `client` to drop and create the collection `db.coll2` configured with the included encryptedFields

This step requires at least QE server support (server 7.0+). Since the MongoCollection.bulkWrite cases can run on older servers, suggest conditioning this step on server 8.0+

kevinAlbs · 2025-08-14T15:24:20Z

source/client-side-encryption/tests/README.md


    Expect this to fail since encryption results in a document exceeding the `maxBsonObjectSize` limit.

+> [!NOTE]
+> MongoDB 8.0+ is required for MongoClient.bulkWrite


mdformat appears to break on this blurb:

% pre-commit run --all-files --hook-stage manual mdformat mdformat.................................................................Failed - hook id: mdformat - exit code: 1 Error: Could not format "/Users/kevin.albertson/review/specifications-1770/source/client-side-encryption/tests/README.md".

Suggest removing this blurb, and instead changing steps 7 and 8 to be:

If using MongoDB 8.0+, use MongoClient.bulkWrite ...

kevinAlbs · 2025-08-14T15:29:57Z

source/crud/bulk-write.md

+
+Auto-encryption does not currently support document sequences. This specification should be updated when
+[DRIVERS-2859](https://jira.mongodb.org/browse/DRIVERS-2859) is completed to require use of document sequences for `ops`
+and `nsInfo` when auto-encryption is enabled.


Suggest adding a blurb suggesting waiting for DRIVERS-2859 before implementing if using non-document-sequences is a significant change:

Suggested change

and `nsInfo` when auto-encryption is enabled.

and `nsInfo` when auto-encryption is enabled.

Drivers requiring significant changes to pass a bulkWrite command to libmongocrypt are recommended to wait until

[DRIVERS-2859](https://jira.mongodb.org/browse/DRIVERS-2859) is implemented before supporting automatic encryption.

Motivated by this comment: #1770 (comment)

kevinAlbs · 2025-08-14T17:12:22Z

source/crud/bulk-write.md

@@ -645,13 +647,6 @@ write concern containing the following message:

 > Cannot request unacknowledged write concern and ordered writes

-## Auto-Encryption
-
-If `MongoClient.bulkWrite` is called on a `MongoClient` configured with `AutoEncryptionOpts`, drivers MUST return an


Remove prose test 13 (expects an error) in the CRUD tests: https://github.com/mongodb/specifications/blob/0f4e11e78f50cf7f4dd167d5ba37a519dd8164f5/source/crud/tests/README.md#13-mongoclientbulkwrite-returns-an-error-if-auto-encryption-is-configured

mdb-ad and others added 13 commits February 11, 2025 19:01

add qe to unified tests

c6f645d

move encryptedFields to initialData

aa51fc3

Apply suggestions from code review

fe8ed1c

Co-authored-by: Kevin Albertson <[email protected]>

poc test feedback

44d883c

make keyVaultNamespace required

ad2fd55

remaining auto encrypt options

573aac1

simple schema for schemaMap and encryptedFieldsMap

112d5bd

convert localSchema.yml

f910f65

convert fle2v2-EncryptedFields-vs-EncryptedFieldsMap

364eb4c

document auto encrypt fields

01505fc

client bulkWrite test

87d3c41

Merge branch 'master' into bulkwrite-qe

7f4021a

keyvault namespace

bd7a0fc

mdb-ad marked this pull request as ready for review April 18, 2025 18:00

mdb-ad requested a review from a team as a code owner April 18, 2025 18:00

mdb-ad requested review from nbbeeken and removed request for a team April 18, 2025 18:00

kevinAlbs self-requested a review April 18, 2025 18:05

nbbeeken reviewed Apr 18, 2025

View reviewed changes

kevinAlbs reviewed Apr 21, 2025

View reviewed changes

source/crud/tests/unified/client-bulkWrite-qe.yml Show resolved Hide resolved

source/crud/tests/unified/client-bulkWrite-qe.yml Show resolved Hide resolved

mdb-ad added 2 commits April 23, 2025 20:07

use unencrypted client to check collection contents

b2893e7

remove bulkWrite QE error

28b2ced

kevinAlbs mentioned this pull request May 28, 2025

DRIVERS-2295 Convert CSFLE spec tests to unified test format #1784

Open

add csfle requirement to test

6415c1a

mdb-ad requested a review from kevinAlbs July 17, 2025 06:07

kevinAlbs requested changes Jul 18, 2025

View reviewed changes

source/crud/tests/unified/client-bulkWrite-qe.yml Show resolved Hide resolved

source/crud/bulk-write.md Outdated Show resolved Hide resolved

source/crud/tests/unified/client-bulkWrite-qe.yml Show resolved Hide resolved

bulkWrite prose tests

a388a7e

mdb-ad requested a review from a team as a code owner July 23, 2025 23:25

mdb-ad requested review from katcharov and removed request for a team July 23, 2025 23:25

errorContains in test

148ed07

mdb-ad requested a review from kevinAlbs July 23, 2025 23:29

mdb-ad requested a review from isabelatkinson July 24, 2025 19:32

kevinAlbs removed the request for review from katcharov July 25, 2025 11:58

mdb-ad added 2 commits August 6, 2025 00:12

tests draft

10d34d7

add limits-qe-doc

f85e42e

isabelatkinson mentioned this pull request Aug 7, 2025

RUST-2078 Support QE with bulk write mongodb/mongo-rust-driver#1445

Draft

isabelatkinson reviewed Aug 11, 2025

View reviewed changes

source/client-side-encryption/tests/README.md Show resolved Hide resolved

source/client-side-encryption/tests/README.md Show resolved Hide resolved

baileympearson reviewed Aug 11, 2025

View reviewed changes

mdb-ad and others added 5 commits August 13, 2025 22:17

note server 8.0 requirement

6a0daee

add limits-encryptedFields

90b3701

add language for auto-encryption to bulk write spec

c046c98

Merge branch 'master' into bulkwrite-qe

175096a

Merge branch 'master' into bulkwrite-qe

c6ca35a

mdb-ad requested a review from isabelatkinson August 14, 2025 05:26

format

0f4e11e

kevinAlbs reviewed Aug 14, 2025

View reviewed changes

	3. Using `client`, drop and create the collection `db.coll2` configured with the included encryptedFields
	3. If using MongoDB 8.0+, use `client` to drop and create the collection `db.coll2` configured with the included encryptedFields

DRIVERS-2888 Support QE with Client.bulkWrite #1770

Are you sure you want to change the base?

DRIVERS-2888 Support QE with Client.bulkWrite #1770

Uh oh!

Conversation

mdb-ad commented Mar 17, 2025 • edited by kevinAlbs Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nbbeeken left a comment

Choose a reason for hiding this comment

Uh oh!

kevinAlbs left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mdb-ad commented Jul 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

isabelatkinson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

baileympearson Aug 11, 2025

Choose a reason for hiding this comment

Uh oh!

kevinAlbs Aug 14, 2025

Choose a reason for hiding this comment

Uh oh!

baileympearson commented Aug 11, 2025

Uh oh!

kevinAlbs commented Aug 11, 2025

Auto-Encryption

Uh oh!

kevinAlbs Aug 14, 2025

Choose a reason for hiding this comment

Uh oh!

kevinAlbs Aug 14, 2025

Choose a reason for hiding this comment

Uh oh!

kevinAlbs Aug 14, 2025

Choose a reason for hiding this comment

Uh oh!

kevinAlbs Aug 14, 2025

Choose a reason for hiding this comment

Uh oh!

kevinAlbs Aug 14, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mdb-ad commented Mar 17, 2025 •

edited by kevinAlbs

Loading

mdb-ad commented Jul 24, 2025 •

edited

Loading