Class: Mongo::Crypt::EncryptionIO Private

# File 'lib/mongo/crypt/encryption_io.rb', line 96

def collection_info(db_name, filter)
  unless @metadata_client
    raise ArgumentError, 'collection_info requires metadata_client to have been passed to the constructor, but it was not'
  end

  @metadata_client.use(db_name).database.list_collections(filter: filter, deserialize_as_bson: true).first
end

# File 'lib/mongo/crypt/encryption_io.rb', line 172

def delete_key(id)
  key_vault_collection.delete_one(_id: id)
end

# File 'lib/mongo/crypt/encryption_io.rb', line 139

def feed_kms(kms_context, tls_options)
  with_ssl_socket(kms_context.endpoint, tls_options) do |ssl_socket|
    Timeout.timeout(SOCKET_TIMEOUT, Error::SocketTimeoutError,
      'Socket write operation timed out'
    ) do
      ssl_socket.syswrite(kms_context.message)
    end

    bytes_needed = kms_context.bytes_needed
    while bytes_needed > 0 do
      bytes = Timeout.timeout(SOCKET_TIMEOUT, Error::SocketTimeoutError,
        'Socket read operation timed out'
      ) do
        ssl_socket.sysread(bytes_needed)
      end

      kms_context.feed(bytes)
      bytes_needed = kms_context.bytes_needed
    end
  end
end

# File 'lib/mongo/crypt/encryption_io.rb', line 78

def find_keys(filter)
  key_vault_collection.find(filter).to_a
end

# File 'lib/mongo/crypt/encryption_io.rb', line 177

def get_key(id)
  key_vault_collection.find(_id: id).first
end

# File 'lib/mongo/crypt/encryption_io.rb', line 183

def get_key_by_alt_name(key_alt_name)
  key_vault_collection.find(keyAltNames: key_alt_name).first
end

# File 'lib/mongo/crypt/encryption_io.rb', line 188

def get_keys
  key_vault_collection.find
end

# File 'lib/mongo/crypt/encryption_io.rb', line 87

def insert_data_key(document)
  key_vault_collection.insert_one(document)
end

# File 'lib/mongo/crypt/encryption_io.rb', line 256

def key_vault_collection
  @key_vault_collection ||= @key_vault_client.with(
    database: @key_vault_db_name,
    read_concern: { level: :majority },
    write_concern: { w: :majority }
  )[@key_vault_collection_name]
end

# File 'lib/mongo/crypt/encryption_io.rb', line 109

def mark_command(cmd)
  unless @mongocryptd_client
    raise ArgumentError, 'mark_command requires mongocryptd_client to have been passed to the constructor, but it was not'
  end

  # Ensure the response from mongocryptd is deserialized with { mode: :bson }
  # to prevent losing type information in commands
  options = { execution_options: { deserialize_as_bson: true } }

  begin
    response = @mongocryptd_client.database.command(cmd, options)
  rescue Error::NoServerAvailable => e
    raise e if @options[:mongocryptd_bypass_spawn]

    spawn_mongocryptd
    response = @mongocryptd_client.database.command(cmd, options)
  end

  return response.first
end

# File 'lib/mongo/crypt/encryption_io.rb', line 194

def remove_key_alt_name(id, key_alt_name)
  key_vault_collection.find_one_and_update(
    { _id: id },
    [
      {
        '$set' => {
          keyAltNames: {
            '$cond' => [
              { '$eq' => [ '$keyAltNames', [ key_alt_name ] ] },
              '$$REMOVE',
              {
                '$filter' => {
                  input: '$keyAltNames',
                  cond: { '$ne' =>  [ '$$this', key_alt_name ] }
                }
              }
            ]
          }
        }
      }
    ]
  )
end

# File 'lib/mongo/crypt/encryption_io.rb', line 276

def spawn_mongocryptd
  mongocryptd_spawn_args = @options[:mongocryptd_spawn_args]
  mongocryptd_spawn_path = @options[:mongocryptd_spawn_path]

  unless mongocryptd_spawn_path
    raise ArgumentError.new(
      'Cannot spawn mongocryptd process when no ' +
      ':mongocryptd_spawn_path option is provided'
    )
  end

  if mongocryptd_spawn_path.nil? ||
    mongocryptd_spawn_args.nil? || mongocryptd_spawn_args.empty?
  then
    raise ArgumentError.new(
      'Cannot spawn mongocryptd process when no :mongocryptd_spawn_args ' +
      'option is provided. To start mongocryptd without arguments, pass ' +
      '"--" for :mongocryptd_spawn_args'
    )
  end

  begin
    Process.spawn(
      mongocryptd_spawn_path,
      *mongocryptd_spawn_args,
      [:out, :err]=>'/dev/null'
    )
  rescue Errno::ENOENT => e
    raise Error::MongocryptdSpawnError.new(
      "Failed to spawn mongocryptd at the path \"#{mongocryptd_spawn_path}\" " +
      "with arguments #{mongocryptd_spawn_args}. Received error " +
      "#{e.class}: \"#{e.message}\""
    )
  end
end

# File 'lib/mongo/crypt/encryption_io.rb', line 223

def update_data_keys(updates)
  key_vault_collection.bulk_write(updates)
end

# File 'lib/mongo/crypt/encryption_io.rb', line 229

def validate_key_vault_client!(key_vault_client)
  unless key_vault_client
    raise ArgumentError.new('The :key_vault_client option cannot be nil')
  end

  unless key_vault_client.is_a?(Client)
    raise ArgumentError.new(
      'The :key_vault_client option must be an instance of Mongo::Client'
    )
  end
end

# File 'lib/mongo/crypt/encryption_io.rb', line 241

def validate_key_vault_namespace!(key_vault_namespace)
  unless key_vault_namespace
    raise ArgumentError.new('The :key_vault_namespace option cannot be nil')
  end

  unless key_vault_namespace.split('.').length == 2
    raise ArgumentError.new(
      "#{key_vault_namespace} is an invalid key vault namespace." +
      "The :key_vault_namespace option must be in the format database.collection"
    )
  end
end

# File 'lib/mongo/crypt/encryption_io.rb', line 325

def with_ssl_socket(endpoint, tls_options)
  address = begin
    host, port = endpoint.split(':')
    port ||= 443 # All supported KMS APIs use this port by default.
    Address.new([host, port].join(':'))
  end
  mongo_socket = address.socket(
    SOCKET_TIMEOUT,
    tls_options.merge(ssl: true)
  )
  yield(mongo_socket.socket)
rescue => e
  raise Error::KmsError, "Error when connecting to KMS provider: #{e.class}: #{e.message}"
ensure
  mongo_socket&.close
end