-
Notifications
You must be signed in to change notification settings - Fork 268
PHPLIB-1702: Always consult server encryptedFieldsMap when dropping collections #1742
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,64 @@ | ||
<?php | ||
|
||
namespace MongoDB\Tests\Collection; | ||
|
||
use MongoDB\BSON\Binary; | ||
use MongoDB\Database; | ||
use MongoDB\Driver\ClientEncryption; | ||
use MongoDB\Driver\WriteConcern; | ||
|
||
use function iterator_count; | ||
use function str_repeat; | ||
|
||
class DropEncryptedCollectionFunctionalTest extends FunctionalTestCase | ||
{ | ||
protected ClientEncryption $clientEncryption; | ||
protected Database $database; | ||
|
||
public function setUp(): void | ||
{ | ||
parent::setUp(); | ||
|
||
$this->skipIfClientSideEncryptionIsNotSupported(); | ||
|
||
if ($this->isStandalone()) { | ||
$this->markTestSkipped('Queryable encryption requires replica sets'); | ||
} | ||
|
||
$this->skipIfServerVersion('<', '7.0.0', 'Queryable encryption requires MongoDB 7.0 or later'); | ||
|
||
$client = static::createTestClient(); | ||
|
||
// Ensure the key vault collection is dropped before each test | ||
$collection = $client->selectCollection('keyvault', 'datakeys', ['writeConcern' => new WriteConcern(WriteConcern::MAJORITY)]); | ||
$collection->drop(); | ||
jmikola marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
||
$this->clientEncryption = $client->createClientEncryption([ | ||
'keyVaultNamespace' => 'keyvault.datakeys', | ||
jmikola marked this conversation as resolved.
Show resolved
Hide resolved
|
||
'kmsProviders' => ['local' => ['key' => new Binary(str_repeat("\0", 96)) ]], | ||
]); | ||
|
||
$this->database = $client->getDatabase($this->getDatabaseName()); | ||
} | ||
|
||
/** @see https://jira.mongodb.org/browse/PHPLIB-1702 */ | ||
public function testDropConsultsEncryptedFieldsFromServer(): void | ||
{ | ||
$originalNumCollections = iterator_count($this->database->listCollectionNames()); | ||
|
||
$this->database->createEncryptedCollection( | ||
$this->getCollectionName(), | ||
$this->clientEncryption, | ||
'local', | ||
null, | ||
['encryptedFields' => ['fields' => []]], | ||
); | ||
|
||
// createEncryptedCollection should create three collections | ||
$this->assertCount($originalNumCollections + 3, $this->database->listCollectionNames()); | ||
|
||
$this->collection->drop(); | ||
|
||
$this->assertCount($originalNumCollections, $this->database->listCollectionNames()); | ||
} | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,60 @@ | ||
<?php | ||
|
||
namespace MongoDB\Tests\Database; | ||
|
||
use MongoDB\BSON\Binary; | ||
use MongoDB\Driver\ClientEncryption; | ||
use MongoDB\Driver\WriteConcern; | ||
|
||
use function iterator_count; | ||
use function str_repeat; | ||
|
||
class DropEncryptedCollectionFunctionalTest extends FunctionalTestCase | ||
{ | ||
protected ClientEncryption $clientEncryption; | ||
|
||
public function setUp(): void | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Both test classes has the same There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Converted this to a single test file in a new PR. |
||
{ | ||
parent::setUp(); | ||
|
||
$this->skipIfClientSideEncryptionIsNotSupported(); | ||
|
||
if ($this->isStandalone()) { | ||
$this->markTestSkipped('Queryable encryption requires replica sets'); | ||
} | ||
|
||
$this->skipIfServerVersion('<', '7.0.0', 'Queryable encryption requires MongoDB 7.0 or later'); | ||
|
||
$client = static::createTestClient(); | ||
|
||
// Ensure the key vault collection is dropped before each test | ||
$collection = $client->selectCollection('keyvault', 'datakeys', ['writeConcern' => new WriteConcern(WriteConcern::MAJORITY)]); | ||
jmikola marked this conversation as resolved.
Show resolved
Hide resolved
|
||
$collection->drop(); | ||
|
||
$this->clientEncryption = $client->createClientEncryption([ | ||
'keyVaultNamespace' => 'keyvault.datakeys', | ||
'kmsProviders' => ['local' => ['key' => new Binary(str_repeat("\0", 96)) ]], | ||
]); | ||
} | ||
|
||
/** @see https://jira.mongodb.org/browse/PHPLIB-1702 */ | ||
public function testDropCollectionConsultsEncryptedFieldsFromServer(): void | ||
{ | ||
$originalNumCollections = iterator_count($this->database->listCollectionNames()); | ||
|
||
$this->database->createEncryptedCollection( | ||
$this->getCollectionName(), | ||
$this->clientEncryption, | ||
'local', | ||
null, | ||
['encryptedFields' => ['fields' => []]], | ||
); | ||
|
||
// createEncryptedCollection should create three collections | ||
$this->assertCount($originalNumCollections + 3, $this->database->listCollectionNames()); | ||
|
||
$this->database->dropCollection($this->getCollectionName()); | ||
|
||
$this->assertCount($originalNumCollections, $this->database->listCollectionNames()); | ||
} | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You'll get used to the new name of this method.
Why do you need to set the
writeConcern
, as that doesn't guarantee that all replica are up to date.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm borrowing that from the CSFLE spec tests, which use
w:majority
for all ops targeting the key vault collection. I reckon it makes little difference for tests, but in a production environment this would ensure that any modifications will persist through a replica set election.