Skip to content

Commit dbba6f6

Browse files
GromNaNGromNaN
committed
Flatten autoEncryption driver options in MongoDB\Manager::__construct
1 parent fc9cab7 commit dbba6f6

File tree

3 files changed

+145
-147
lines changed

3 files changed

+145
-147
lines changed

‎language-snippets.ent

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -3073,24 +3073,13 @@ paths</simpara></warning>
30733073
</row>
30743074
'>
30753075
<!ENTITY mongodb.option.encryption.keyVaultClient '
3076-
<row xmlns="http://docbook.org/ns/docbook">
3077-
<entry>keyVaultClient</entry>
3078-
<entry><classname>MongoDB\Driver\Manager</classname></entry>
3079-
<entry>The Manager used to route data key queries to a separate MongoDB cluster. By default, the current Manager and cluster is used.</entry>
3080-
</row>
3076+
<entry xmlns="http://docbook.org/ns/docbook">The Manager used to route data key queries to a separate MongoDB cluster. By default, the current Manager and cluster is used.</entry>
30813077
'>
30823078
<!ENTITY mongodb.option.encryption.keyVaultNamespace '
3083-
<row xmlns="http://docbook.org/ns/docbook">
3084-
<entry>keyVaultNamespace</entry>
3085-
<entry><type>string</type></entry>
3086-
<entry>A fully qualified namespace (e.g. <literal>"databaseName.collectionName"</literal>) denoting the collection that contains all data keys used for encryption and decryption. This option is required.</entry>
3087-
</row>
3079+
<entry xmlns="http://docbook.org/ns/docbook">A fully qualified namespace (e.g. <literal>"databaseName.collectionName"</literal>) denoting the collection that contains all data keys used for encryption and decryption. This option is required.</entry>
30883080
'>
30893081
<!ENTITY mongodb.option.encryption.kmsProviders '
3090-
<row xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
3091-
<entry>kmsProviders</entry>
3092-
<entry><type>array</type></entry>
3093-
<entry>
3082+
<entry xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
30943083
<para>
30953084
A document containing the configuration for one or more KMS providers, which are used to encrypt data keys. Supported providers include <literal>"aws"</literal>, <literal>"azure"</literal>, <literal>"gcp"</literal>, <literal>"kmip"</literal>, and <literal>"local"</literal> and at least one must be specified.
30963085
</para>
@@ -3159,7 +3148,6 @@ local: {
31593148
]]>
31603149
</programlisting>
31613150
</entry>
3162-
</row>
31633151
'>
31643152
<!ENTITY mongodb.option.encryption.masterKey-options-by-provider '
31653153
<para xmlns="http://docbook.org/ns/docbook">
@@ -3303,10 +3291,7 @@ local: {
33033291
</para>
33043292
'>
33053293
<!ENTITY mongodb.option.encryption.tlsOptions '
3306-
<row xmlns="http://docbook.org/ns/docbook">
3307-
<entry>tlsOptions</entry>
3308-
<entry><type>array</type></entry>
3309-
<entry>
3294+
<entry xmlns="http://docbook.org/ns/docbook">
33103295
<para>
33113296
A document containing the TLS configuration for one or more KMS providers. Supported providers include <literal>"aws"</literal>, <literal>"azure"</literal>, <literal>"gcp"</literal>, and <literal>"kmip"</literal>. All providers support the following options:
33123297
</para>
@@ -3321,7 +3306,6 @@ local: {
33213306
]]>
33223307
</programlisting>
33233308
</entry>
3324-
</row>
33253309
'>
33263310
<!ENTITY mongodb.option.maxCommitTimeMS '
33273311
<row xmlns="http://docbook.org/ns/docbook">

‎reference/mongodb/mongodb/driver/manager/construct.xml

Lines changed: 121 additions & 123 deletions
Original file line numberDiff line numberDiff line change
@@ -659,129 +659,6 @@ mongodb://[username:password@]host1[:port1][,host2[:port2],...[,hostN[:portN]]][
659659
<literal>bypassAutoEncryption</literal> is &true;.
660660
</para>
661661
</note>
662-
<para>
663-
The following options are supported:
664-
665-
<table>
666-
<title>Options for automatic encryption</title>
667-
<tgroup cols="3">
668-
<thead>
669-
<row>
670-
<entry>Option</entry>
671-
<entry>Type</entry>
672-
<entry>Description</entry>
673-
</row>
674-
</thead>
675-
<tbody>
676-
&mongodb.option.encryption.keyVaultClient;
677-
&mongodb.option.encryption.keyVaultNamespace;
678-
&mongodb.option.encryption.kmsProviders;
679-
&mongodb.option.encryption.tlsOptions;
680-
<row>
681-
<entry>schemaMap</entry>
682-
<entry><type class="union"><type>array</type><type>object</type></type></entry>
683-
<entry>
684-
<para>
685-
Map of collection namespaces to a local JSON schema. This is
686-
used to configure automatic encryption. See
687-
<link xlink:href="&url.mongodb.docs;reference/security-client-side-automatic-json-schema/">Automatic Encryption Rules</link>
688-
in the MongoDB manual for more information. It is an error to
689-
specify a collection in both <literal>schemaMap</literal> and
690-
<literal>encryptedFieldsMap</literal>.
691-
</para>
692-
<note>
693-
<simpara>
694-
Supplying a <literal>schemaMap</literal> provides more
695-
security than relying on JSON schemas obtained from the
696-
server. It protects against a malicious server advertising a
697-
false JSON schema, which could trick the client into sending
698-
unencrypted data that should be encrypted.
699-
</simpara>
700-
</note>
701-
<note>
702-
<simpara>
703-
Schemas supplied in the <literal>schemaMap</literal> only
704-
apply to configuring automatic encryption for client side
705-
encryption. Other validation rules in the JSON schema will
706-
not be enforced by the driver and will result in an error.
707-
</simpara>
708-
</note>
709-
</entry>
710-
</row>
711-
<row>
712-
<entry>bypassAutoEncryption</entry>
713-
<entry><type>bool</type></entry>
714-
<entry>
715-
If &true;, <literal>mongocryptd</literal> will not be spawned
716-
automatically. This is used to disable automatic encryption.
717-
Defaults to &false;.
718-
</entry>
719-
</row>
720-
<row>
721-
<entry>bypassQueryAnalysis</entry>
722-
<entry><type>bool</type></entry>
723-
<entry>
724-
<para>
725-
If &true;, automatic analysis of outgoing commands will be
726-
disabled and <literal>mongocryptd</literal> will not be
727-
spawned automatically. This enables the use case of explicit
728-
encryption for querying indexed fields without requiring the
729-
enterprise licensed <literal>crypt_shared</literal> library or
730-
<literal>mongocryptd</literal> process. Defaults to &false;.
731-
</para>
732-
</entry>
733-
</row>
734-
<row>
735-
<entry>encryptedFieldsMap</entry>
736-
<entry><type class="union"><type>array</type><type>object</type></type></entry>
737-
<entry>
738-
<para>
739-
Map of collection namespaces to an
740-
<literal>encryptedFields</literal> document. This is used to
741-
configure queryable encryption. See
742-
<link xlink:href="&url.mongodb.docs;core/queryable-encryption/fundamentals/encrypt-and-query/">Field Encryption and Queryability</link>
743-
in the MongoDB manual for more information. It is an error to
744-
specify a collection in both
745-
<literal>encryptedFieldsMap</literal> and
746-
<literal>schemaMap</literal>.
747-
</para>
748-
<note>
749-
<simpara>
750-
Supplying an <literal>encryptedFieldsMap</literal> provides
751-
more security than relying on an
752-
<literal>encryptedFields</literal> obtained from the server.
753-
It protects against a malicious server advertising a false
754-
<literal>encryptedFields</literal>.
755-
</simpara>
756-
</note>
757-
</entry>
758-
</row>
759-
<row>
760-
<entry>extraOptions</entry>
761-
<entry><type>array</type></entry>
762-
<entry>
763-
<para>
764-
The <literal>extraOptions</literal> relate to the
765-
<literal>mongocryptd</literal> process. The following options
766-
are supported:
767-
</para>
768-
<simplelist>
769-
<member><literal>mongocryptdURI</literal> (<type>string</type>): URI to connect to an existing <literal>mongocryptd</literal> process. Defaults to <literal>"mongodb://localhost:27020"</literal>.</member>
770-
<member><literal>mongocryptdBypassSpawn</literal> (<type>bool</type>): If &true;, prevent the driver from spawning <literal>mongocryptd</literal>. Defaults to &false;.</member>
771-
<member><literal>mongocryptdSpawnPath</literal> (<type>string</type>): Absolute path to search for <literal>mongocryptd</literal> binary. Defaults to empty string and consults system paths.</member>
772-
<member><literal>mongocryptdSpawnArgs</literal> (<type>array</type>): Array of string arguments to pass to <literal>mongocryptd</literal> when spawning. Defaults to <literal>["--idleShutdownTimeoutSecs=60"]</literal>.</member>
773-
<member><literal>cryptSharedLibPath</literal> (<type>string</type>): Absolute path to <literal>crypt_shared</literal> shared library. Defaults to empty string and consults system paths.</member>
774-
<member><literal>cryptSharedLibRequired</literal> (<type>bool</type>): If &true;, require the driver to load <literal>crypt_shared</literal>. Defaults to &false;.</member>
775-
</simplelist>
776-
<para>
777-
See the <link xlink:href="&url.mongodb.specs;/blob/master/source/client-side-encryption/client-side-encryption.rst#extraoptions">Client-Side Encryption Specification</link> for more information.
778-
</para>
779-
</entry>
780-
</row>
781-
</tbody>
782-
</tgroup>
783-
</table>
784-
</para>
785662

786663
<note>
787664
<simpara>
@@ -797,6 +674,127 @@ mongodb://[username:password@]host1[:port1][,host2[:port2],...[,hostN[:portN]]][
797674
</note>
798675
</entry>
799676
</row>
677+
<row>
678+
<entry>autoEncryption.keyVaultClient</entry>
679+
<entry><classname>MongoDB\Driver\Manager</classname></entry>
680+
&mongodb.option.encryption.keyVaultClient;
681+
</row>
682+
<row>
683+
<entry>autoEncryption.keyVaultNamespace</entry>
684+
<entry><type>string</type></entry>
685+
&mongodb.option.encryption.keyVaultNamespace;
686+
</row>
687+
<row>
688+
<entry>autoEncryption.kmsProviders</entry>
689+
<entry><type>array</type></entry>
690+
&mongodb.option.encryption.kmsProviders;
691+
</row>
692+
<row>
693+
<entry>autoEncryption.tlsOptions</entry>
694+
<entry><type>array</type></entry>
695+
&mongodb.option.encryption.tlsOptions;
696+
</row>
697+
<row>
698+
<entry>autoEncryption.schemaMap</entry>
699+
<entry><type class="union"><type>array</type><type>object</type></type></entry>
700+
<entry>
701+
<para>
702+
Map of collection namespaces to a local JSON schema. This is
703+
used to configure automatic encryption. See
704+
<link xlink:href="&url.mongodb.docs;reference/security-client-side-automatic-json-schema/">Automatic Encryption Rules</link>
705+
in the MongoDB manual for more information. It is an error to
706+
specify a collection in both <literal>schemaMap</literal> and
707+
<literal>encryptedFieldsMap</literal>.
708+
</para>
709+
<note>
710+
<simpara>
711+
Supplying a <literal>schemaMap</literal> provides more
712+
security than relying on JSON schemas obtained from the
713+
server. It protects against a malicious server advertising a
714+
false JSON schema, which could trick the client into sending
715+
unencrypted data that should be encrypted.
716+
</simpara>
717+
</note>
718+
<note>
719+
<simpara>
720+
Schemas supplied in the <literal>schemaMap</literal> only
721+
apply to configuring automatic encryption for client side
722+
encryption. Other validation rules in the JSON schema will
723+
not be enforced by the driver and will result in an error.
724+
</simpara>
725+
</note>
726+
</entry>
727+
</row>
728+
<row>
729+
<entry>autoEncryption.bypassAutoEncryption</entry>
730+
<entry><type>bool</type></entry>
731+
<entry>
732+
If &true;, <literal>mongocryptd</literal> will not be spawned
733+
automatically. This is used to disable automatic encryption.
734+
Defaults to &false;.
735+
</entry>
736+
</row>
737+
<row>
738+
<entry>autoEncryption.bypassQueryAnalysis</entry>
739+
<entry><type>bool</type></entry>
740+
<entry>
741+
<para>
742+
If &true;, automatic analysis of outgoing commands will be
743+
disabled and <literal>mongocryptd</literal> will not be
744+
spawned automatically. This enables the use case of explicit
745+
encryption for querying indexed fields without requiring the
746+
enterprise licensed <literal>crypt_shared</literal> library or
747+
<literal>mongocryptd</literal> process. Defaults to &false;.
748+
</para>
749+
</entry>
750+
</row>
751+
<row>
752+
<entry>autoEncryption.encryptedFieldsMap</entry>
753+
<entry><type class="union"><type>array</type><type>object</type></type></entry>
754+
<entry>
755+
<para>
756+
Map of collection namespaces to an
757+
<literal>encryptedFields</literal> document. This is used to
758+
configure queryable encryption. See
759+
<link xlink:href="&url.mongodb.docs;core/queryable-encryption/fundamentals/encrypt-and-query/">Field Encryption and Queryability</link>
760+
in the MongoDB manual for more information. It is an error to
761+
specify a collection in both
762+
<literal>encryptedFieldsMap</literal> and
763+
<literal>schemaMap</literal>.
764+
</para>
765+
<note>
766+
<simpara>
767+
Supplying an <literal>encryptedFieldsMap</literal> provides
768+
more security than relying on an
769+
<literal>encryptedFields</literal> obtained from the server.
770+
It protects against a malicious server advertising a false
771+
<literal>encryptedFields</literal>.
772+
</simpara>
773+
</note>
774+
</entry>
775+
</row>
776+
<row>
777+
<entry>autoEncryption.extraOptions</entry>
778+
<entry><type>array</type></entry>
779+
<entry>
780+
<para>
781+
The <literal>extraOptions</literal> relate to the
782+
<literal>mongocryptd</literal> process. The following options
783+
are supported:
784+
</para>
785+
<simplelist>
786+
<member><literal>mongocryptdURI</literal> (<type>string</type>): URI to connect to an existing <literal>mongocryptd</literal> process. Defaults to <literal>"mongodb://localhost:27020"</literal>.</member>
787+
<member><literal>mongocryptdBypassSpawn</literal> (<type>bool</type>): If &true;, prevent the driver from spawning <literal>mongocryptd</literal>. Defaults to &false;.</member>
788+
<member><literal>mongocryptdSpawnPath</literal> (<type>string</type>): Absolute path to search for <literal>mongocryptd</literal> binary. Defaults to empty string and consults system paths.</member>
789+
<member><literal>mongocryptdSpawnArgs</literal> (<type>array</type>): Array of string arguments to pass to <literal>mongocryptd</literal> when spawning. Defaults to <literal>["--idleShutdownTimeoutSecs=60"]</literal>.</member>
790+
<member><literal>cryptSharedLibPath</literal> (<type>string</type>): Absolute path to <literal>crypt_shared</literal> shared library. Defaults to empty string and consults system paths.</member>
791+
<member><literal>cryptSharedLibRequired</literal> (<type>bool</type>): If &true;, require the driver to load <literal>crypt_shared</literal>. Defaults to &false;.</member>
792+
</simplelist>
793+
<para>
794+
See the <link xlink:href="&url.mongodb.specs;/blob/master/source/client-side-encryption/client-side-encryption.rst#extraoptions">Client-Side Encryption Specification</link> for more information.
795+
</para>
796+
</entry>
797+
</row>
800798
<row>
801799
<entry>ca_dir</entry>
802800
<entry><type>string</type></entry>

‎reference/mongodb/mongodb/driver/manager/createclientencryption.xml

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,26 @@
3636
</row>
3737
</thead>
3838
<tbody>
39-
&mongodb.option.encryption.keyVaultClient;
40-
&mongodb.option.encryption.keyVaultNamespace;
41-
&mongodb.option.encryption.kmsProviders;
42-
&mongodb.option.encryption.tlsOptions;
39+
<row>
40+
<entry>keyVaultClient</entry>
41+
<entry><classname>MongoDB\Driver\Manager</classname></entry>
42+
&mongodb.option.encryption.keyVaultClient;
43+
</row>
44+
<row>
45+
<entry>keyVaultNamespace</entry>
46+
<entry><type>string</type></entry>
47+
&mongodb.option.encryption.keyVaultNamespace;
48+
</row>
49+
<row>
50+
<entry>kmsProviders</entry>
51+
<entry><type>array</type></entry>
52+
&mongodb.option.encryption.kmsProviders;
53+
</row>
54+
<row>
55+
<entry>tlsOptions</entry>
56+
<entry><type>array</type></entry>
57+
&mongodb.option.encryption.tlsOptions;
58+
</row>
4359
</tbody>
4460
</tgroup>
4561
</table>

0 commit comments

Comments
 (0)