Module: Mongoid::Config::Encryption Private

# File 'lib/mongoid/config/encryption.rb', line 187

def bson_type_for(field)
  TYPE_MAPPINGS[field.type]
end

# File 'lib/mongoid/config/encryption.rb', line 22

def encryption_schema_map(default_database, models = ::Mongoid.models)
  models.each_with_object({}) do |model, map|
    next if model.embedded?
    next unless model.requires_encryption_schema?

    database = model.storage_options.fetch(:database) { default_database }
    # A callable database name cannot be resolved here: the documented
    # multi-tenant idiom has no correct value while the client is being
    # built. Interpolating the callable would produce a key that never
    # matches any namespace, so leave the model out of the map. Writes
    # are refused later, by PersistenceContext, rather than silently
    # going out unencrypted.
    next if database.respond_to?(:call)

    key = "#{database}.#{model.collection_name}"
    props = metadata_for(model).merge(properties_for(model, [ model ]))
    # The root of a collection schema describes the document, so it is
    # always an object. Saying so matters when a nested schema carries
    # encryptMetadata: mongocryptd rejects the schema otherwise.
    map[key] = { 'bsonType' => 'object' }.merge(props) unless props.empty?
  end
end

# File 'lib/mongoid/config/encryption.rb', line 214

def key_id_for(key_id_base64, key_name_field)
  return nil if key_id_base64.nil? && key_name_field.nil?
  if !key_id_base64.nil? && !key_name_field.nil?
    raise ArgumentError, 'Specifying both key_id and key_name_field is not allowed'
  end

  if key_id_base64.nil?
    "/#{key_name_field}"
  else
    [ BSON::Binary.new(Base64.decode64(key_id_base64), :uuid) ]
  end
end

# File 'lib/mongoid/config/encryption.rb', line 81

def metadata_for(model)
  metadata = {}.tap do |metadata|
    if (key_id = key_id_for(model.encrypt_metadata[:key_id], model.encrypt_metadata[:key_name_field]))
      metadata['keyId'] = key_id
    end
    if model.encrypt_metadata.key?(:deterministic)
      metadata['algorithm'] = if model.encrypt_metadata[:deterministic]
                                DETERMINISTIC_ALGORITHM
                              else
                                RANDOM_ALGORITHM
                              end
    end
  end
  if metadata.empty?
    {}
  else
    {
      'bsonType' => 'object',
      'encryptMetadata' => metadata
    }
  end
end

# File 'lib/mongoid/config/encryption.rb', line 114

def properties_for(model, path)
  result = properties_for_fields(model).merge(properties_for_relations(model, path))
  if result.empty?
    {}
  else
    { 'properties' => result }
  end
end

# File 'lib/mongoid/config/encryption.rb', line 128

def properties_for_fields(model)
  model.fields.each_with_object({}) do |(name, field), props|
    next unless field.is_a?(Mongoid::Fields::Encrypted)

    props[name] = {
      'encrypt' => {
        'bsonType' => bson_type_for(field)
      }
    }
    if (algorithm = algorithm_for(field))
      props[name]['encrypt']['algorithm'] = algorithm
    end
    if (key_id = key_id_for(field.key_id, field.key_name_field))
      props[name]['encrypt']['keyId'] = key_id
    end
  end
end

# File 'lib/mongoid/config/encryption.rb', line 156

def properties_for_relations(model, path)
  model.relations.each_with_object({}) do |(name, relation), props|
    # relation_class constantizes, and a polymorphic embedded_in has no
    # class to resolve, so the relation type has to be checked first.
    next unless relation.is_a?(Association::Embedded::EmbedsOne)

    klass = relation.try_relation_class
    # An association target does not have to be a Mongoid document, and
    # the class it names does not have to exist.
    next unless klass.respond_to?(:requires_encryption_schema?)
    # Stop at a model the walk is already inside of, or a self-embedding
    # model never terminates. The path covers the current branch only:
    # a model embedded by two parents, or twice by one parent, has to be
    # emitted at every place it appears.
    next if path.include?(klass)
    next unless klass.requires_encryption_schema?

    metadata_for(klass).merge(
      properties_for(klass, path + [ klass ])
    ).tap do |properties|
      props[name] = { 'bsonType' => 'object' }.merge(properties) unless properties.empty?
    end
  end
end