-
Notifications
You must be signed in to change notification settings - Fork 208
Parse options for automatic encryption using libmongocrypt #1071
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
538ccaa
to
ffcbe9d
Compare
cc64973
to
9112d57
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Some small comments on test files. Everything else LGTM, so feel free to implement test changes and merge if you agree with my suggestions.
<?php exit(0); ?> | ||
--EXPECTF-- | ||
OK: Got MongoDB\Driver\Exception\RuntimeException | ||
Key vault namespace option required |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I assume these error messages originate from libmongocrypt or libmongoc, as I don't see them in this PR. It's unfortunate that they don't actually tell users what option key is missing, but I suppose there's no way around that. I'm not going to propose that we parse out these error messages and rewrite them 😛
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, those are errors from libmongoc. If we want to make those error messages more meaningful, we need to start checking error codes or something, which is a bigger undertaking.
?> | ||
===DONE=== | ||
<?php exit(0); ?> | ||
--EXPECTF-- |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No patterns are used so this can just be --EXPECT--
.
|
||
foreach ($tests as $driverOptions) { | ||
$manager = new MongoDB\Driver\Manager(null, [], ['autoEncryption' => $driverOptions + $baseOptions]); | ||
var_dump($manager); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'd propose we remove this and change the expected output block to:
--EXPECT--
===DONE===
Looking at the current var_dump()
output, there's nothing relevant to the autoEncryption
actually being applied, so I think all we're testing for here is that an exception hasn't been thrown. We do have other tests that do the same (i.e. no output expected to demonstrate the code runs successfully).
['extraOptions' => ['mongocryptdBypassSpawn' => true]], | ||
]; | ||
|
||
foreach ($tests as $driverOptions) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think $autoEncryptionOptions
would be a better name, as the values in $tests
above are all options that go within the autoEncryption
key.
$driverOptions
would be the third argument to the Manager constructor, so that name would make more sense if each value in $tests
started with an autoEncryption
key.
@@ -0,0 +1,83 @@ | |||
--TEST-- | |||
MongoDB\Driver\Manager::__construct(): auto encryption options | |||
--FILE-- |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If MONGOC_ENABLE_CLIENT_SIDE_ENCRYPTION
is undefined, phongo_manager_set_auto_encryption_opts()
throws the following if it finds a autoEncryption
key in a non-null driverOptions
:
phongo_throw_exception(PHONGO_ERROR_INVALID_ARGUMENT TSRMLS_CC, "Cannot enable automatic field-level encryption. Please recompile with support for libmongocrypt using the with-mongodb-client-side-encryption configure switch.");
This test will fail when FLE is not enabled. I propose you create a skip_if_not_libmongocrypt()
function based on skip_if_not_libmongoc_crypto()
and skip_if_not_libmongoc_ssl()
in tests/utils/skipif.php
. It will be simpler than those, as you won't need logic to check for specific libs.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Added the function, also added the counterpart and an additional test for when compiling without FLE as mentioned in the comment below.
@@ -0,0 +1,29 @@ | |||
--TEST-- | |||
MongoDB\Driver\Manager::__construct(): incomplete auto encryption options |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This would also benefit from a --SKIPIF--
that calls skip_if_not_libmongocrypt()
.
I'll defer to you if you'd like to create a separate test for the phongo_manager_set_auto_encryption_opts()
exception message when FLE is not available. If so, that would warrant creating another function: skip_if_libmongocrypt()
.
@jmikola just FYI, the session/bug1274-002 test failed on the SHARDED_CLUSTER_RS deployment but passed on a subsequent run. We may want to keep an eye on this one. Diff:
|
Opened PHPC-1526 to deal with intermittent test failures. Thanks for catching that! |
This PR covers PHPC-1498 and PHPC-1500. For now, it includes the commit of #1065 (PHPC-1496).
The test for
autoEncryption
driver options is a dummy that ensures that the settings can be parsed. It does not include any skips since we don't have tests set up where we compile without client-side encryption support. Since we don't expose any encryption settings yet, we just ensure that the manager can be created successfully.