Class: Mongo::Crypt::EncryptionIO Private

# File 'lib/mongo/crypt/encryption_io.rb', line 105

def collection_info(db_name, filter, timeout_ms: nil)
  unless @metadata_client
    raise ArgumentError, 'collection_info requires metadata_client to have been passed to the constructor, but it was not'
  end

  @metadata_client
    .use(db_name)
    .database
    .list_collections(filter: filter, deserialize_as_bson: true, timeout_ms: timeout_ms)
    .first
end

# File 'lib/mongo/crypt/encryption_io.rb', line 195

def delete_key(id, timeout_ms: nil)
  key_vault_collection.delete_one(_id: id, timeout_ms: timeout_ms)
end

# File 'lib/mongo/crypt/encryption_io.rb', line 161

def feed_kms(kms_context, tls_options, timeout_ms: nil)
  with_ssl_socket(kms_context.endpoint, tls_options) do |ssl_socket|
    Timeout.timeout(timeout_ms || SOCKET_TIMEOUT, Error::SocketTimeoutError,
      'Socket write operation timed out'
    ) do
      ssl_socket.syswrite(kms_context.message)
    end

    bytes_needed = kms_context.bytes_needed
    while bytes_needed > 0 do
      bytes = Timeout.timeout(timeout_ms || SOCKET_TIMEOUT, Error::SocketTimeoutError,
        'Socket read operation timed out'
      ) do
        ssl_socket.sysread(bytes_needed)
      end

      kms_context.feed(bytes)
      bytes_needed = kms_context.bytes_needed
    end
  end
end

# File 'lib/mongo/crypt/encryption_io.rb', line 81

def find_keys(filter, timeout_ms: nil)
  key_vault_collection.find(filter, timeout_ms: timeout_ms).to_a
end

# File 'lib/mongo/crypt/encryption_io.rb', line 200

def get_key(id, timeout_ms: nil)
  key_vault_collection.find(_id: id, timeout_ms: timeout_ms).first
end

# File 'lib/mongo/crypt/encryption_io.rb', line 206

def get_key_by_alt_name(key_alt_name, timeout_ms: nil)
  key_vault_collection.find(keyAltNames: key_alt_name, timeout_ms: timeout_ms).first
end

# File 'lib/mongo/crypt/encryption_io.rb', line 211

def get_keys(timeout_ms: nil)
  key_vault_collection.find(nil, timeout_ms: timeout_ms)
end

# File 'lib/mongo/crypt/encryption_io.rb', line 93

def insert_data_key(document, timeout_ms: nil)
  key_vault_collection.insert_one(document, timeout_ms: timeout_ms)
end

# File 'lib/mongo/crypt/encryption_io.rb', line 280

def key_vault_collection
  @key_vault_collection ||= @key_vault_client.with(
    database: @key_vault_db_name,
    read_concern: { level: :majority },
    write_concern: { w: :majority }
  )[@key_vault_collection_name]
end

# File 'lib/mongo/crypt/encryption_io.rb', line 125

def mark_command(cmd, timeout_ms: nil)
  unless @mongocryptd_client
    raise ArgumentError, 'mark_command requires mongocryptd_client to have been passed to the constructor, but it was not'
  end

  # Ensure the response from mongocryptd is deserialized with { mode: :bson }
  # to prevent losing type information in commands
  options = {
    execution_options: { deserialize_as_bson: true },
    timeout_ms: timeout_ms
  }

  begin
    response = @mongocryptd_client.database.command(cmd, options)
  rescue Error::NoServerAvailable => e
    raise e if @options[:mongocryptd_bypass_spawn]

    spawn_mongocryptd
    response = @mongocryptd_client.database.command(cmd, options)
  end

  return response.first
end

# File 'lib/mongo/crypt/encryption_io.rb', line 217

def remove_key_alt_name(id, key_alt_name, timeout_ms: nil)
  key_vault_collection.find_one_and_update(
    { _id: id },
    [
      {
        '$set' => {
          keyAltNames: {
            '$cond' => [
              { '$eq' => [ '$keyAltNames', [ key_alt_name ] ] },
              '$$REMOVE',
              {
                '$filter' => {
                  input: '$keyAltNames',
                  cond: { '$ne' =>  [ '$$this', key_alt_name ] }
                }
              }
            ]
          }
        }
      }
    ],
    timeout_ms: timeout_ms
  )
end

# File 'lib/mongo/crypt/encryption_io.rb', line 300

def spawn_mongocryptd
  mongocryptd_spawn_args = @options[:mongocryptd_spawn_args]
  mongocryptd_spawn_path = @options[:mongocryptd_spawn_path]

  unless mongocryptd_spawn_path
    raise ArgumentError.new(
      'Cannot spawn mongocryptd process when no ' +
      ':mongocryptd_spawn_path option is provided'
    )
  end

  if mongocryptd_spawn_path.nil? ||
    mongocryptd_spawn_args.nil? || mongocryptd_spawn_args.empty?
  then
    raise ArgumentError.new(
      'Cannot spawn mongocryptd process when no :mongocryptd_spawn_args ' +
      'option is provided. To start mongocryptd without arguments, pass ' +
      '"--" for :mongocryptd_spawn_args'
    )
  end

  begin
    Process.spawn(
      mongocryptd_spawn_path,
      *mongocryptd_spawn_args,
      [:out, :err]=>'/dev/null'
    )
  rescue Errno::ENOENT => e
    raise Error::MongocryptdSpawnError.new(
      "Failed to spawn mongocryptd at the path \"#{mongocryptd_spawn_path}\" " +
      "with arguments #{mongocryptd_spawn_args}. Received error " +
      "#{e.class}: \"#{e.message}\""
    )
  end
end

# File 'lib/mongo/crypt/encryption_io.rb', line 247

def update_data_keys(updates, timeout_ms: nil)
  key_vault_collection.bulk_write(updates, timeout_ms: timeout_ms)
end

# File 'lib/mongo/crypt/encryption_io.rb', line 253

def validate_key_vault_client!(key_vault_client)
  unless key_vault_client
    raise ArgumentError.new('The :key_vault_client option cannot be nil')
  end

  unless key_vault_client.is_a?(Client)
    raise ArgumentError.new(
      'The :key_vault_client option must be an instance of Mongo::Client'
    )
  end
end

# File 'lib/mongo/crypt/encryption_io.rb', line 265

def validate_key_vault_namespace!(key_vault_namespace)
  unless key_vault_namespace
    raise ArgumentError.new('The :key_vault_namespace option cannot be nil')
  end

  unless key_vault_namespace.split('.').length == 2
    raise ArgumentError.new(
      "#{key_vault_namespace} is an invalid key vault namespace." +
      "The :key_vault_namespace option must be in the format database.collection"
    )
  end
end

# File 'lib/mongo/crypt/encryption_io.rb', line 349

def with_ssl_socket(endpoint, tls_options, timeout_ms: nil)
  csot = !timeout_ms.nil?
  address = begin
    host, port = endpoint.split(':')
    port ||= 443 # All supported KMS APIs use this port by default.
    Address.new([host, port].join(':'))
  end
  socket_options = { ssl: true, csot: csot }.tap do |opts|
    if csot
      opts[:connect_timeout] = (timeout_ms / 1_000.0)
    end
  end
  mongo_socket = address.socket(
    SOCKET_TIMEOUT,
    tls_options.merge(socket_options)
  )
  yield(mongo_socket.socket)
rescue Error::KmsError
  raise
rescue StandardError => e
  raise Error::KmsError.new("Error when connecting to KMS provider: #{e.class}: #{e.message}", network_error: true)
ensure
  mongo_socket&.close
end