test(NODE-4296): add csfle decryption events prose tests (#3295)

durran · web-flow · commit 4a9144400643 · 2022-06-23T15:47:45.000-04:00
diff --git a/test/integration/client-side-encryption/client_side_encryption.prose.test.js b/test/integration/client-side-encryption/client_side_encryption.prose.test.js
@@ -7,8 +7,9 @@ const path = require('path');
 const { deadlockTests } = require('./client_side_encryption.prose.deadlock');
 const { dropCollection, APMEventCollector } = require('../shared');
 
-const { EJSON } = BSON;
+const { EJSON, Binary } = BSON;
 const { LEGACY_HELLO_COMMAND } = require('../../../src/constants');
+const { MongoNetworkError } = require('../../../src/error');
 
 const getKmsProviders = (localKey, kmipEndpoint, azureEndpoint, gcpEndpoint) => {
   const result = BSON.EJSON.parse(process.env.CSFLE_KMS_PROVIDERS || '{}');
@@ -1424,4 +1425,224 @@ describe('Client Side Encryption Prose Tests', metadata, function () {
       });
     });
   });
+
+  context('14. Decryption Events', metadata, function () {
+    let setupClient;
+    let clientEncryption;
+    let keyId;
+    let cipherText;
+    let malformedCiphertext;
+    let encryptedClient;
+    let aggregateSucceeded;
+    let aggregateFailed;
+
+    beforeEach(async function () {
+      const mongodbClientEncryption = this.configuration.mongodbClientEncryption;
+      // Create a MongoClient named ``setupClient``.
+      setupClient = this.configuration.newClient();
+      // Drop and create the collection ``db.decryption_events``.
+      const db = setupClient.db('db');
+      await dropCollection(db, 'decryption_events');
+      await db.createCollection('decryption_events');
+      // Create a ClientEncryption object named ``clientEncryption`` with these options:
+      //   ClientEncryptionOpts {
+      //     keyVaultClient: <setupClient>,
+      //     keyVaultNamespace: "keyvault.datakeys",
+      //     kmsProviders: { "local": { "key": <base64 decoding of LOCAL_MASTERKEY> } }
+      //   }
+      clientEncryption = new mongodbClientEncryption.ClientEncryption(setupClient, {
+        keyVaultNamespace: 'keyvault.datakeys',
+        kmsProviders: getKmsProviders(LOCAL_KEY),
+        bson: BSON
+      });
+      // Create a data key with the "local" KMS provider.
+      // Storing the result in a variable named ``keyID``.
+      keyId = await clientEncryption.createDataKey('local');
+      // Use ``clientEncryption`` to encrypt the string "hello" with the following ``EncryptOpts``:
+      //   EncryptOpts {
+      //     keyId: <keyID>,
+      //     algorithm: "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
+      //   }
+      // Store the result in a variable named ``ciphertext``.
+      cipherText = await clientEncryption.encrypt('hello', {
+        keyId: keyId,
+        algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
+      });
+      // Copy ``ciphertext`` into a variable named ``malformedCiphertext``.
+      // Change the last byte to 0. This will produce an invalid HMAC tag.
+      const buffer = Buffer.from(cipherText.buffer);
+      buffer.writeInt8(0, buffer.length - 1);
+      malformedCiphertext = new Binary(buffer, 6);
+      // Create a MongoClient named ``encryptedClient`` with these ``AutoEncryptionOpts``:
+      //   AutoEncryptionOpts {
+      //     keyVaultNamespace: "keyvault.datakeys";
+      //     kmsProviders: { "local": { "key": <base64 decoding of LOCAL_MASTERKEY> } }
+      //   }
+      // Configure ``encryptedClient`` with "retryReads=false".
+      encryptedClient = this.configuration.newClient(
+        {},
+        {
+          retryReads: false,
+          monitorCommands: true,
+          autoEncryption: {
+            keyVaultNamespace: 'keyvault.datakeys',
+            kmsProviders: getKmsProviders(LOCAL_KEY)
+          }
+        }
+      );
+      // Register a listener for CommandSucceeded events on ``encryptedClient``.
+      encryptedClient.on('commandSucceeded', event => {
+        if (event.commandName === 'aggregate') {
+          aggregateSucceeded = event;
+        }
+      });
+      // The listener must store the most recent CommandFailedEvent error for the "aggregate" command.
+      encryptedClient.on('commandFailed', event => {
+        if (event.commandName === 'aggregate') {
+          aggregateFailed = event;
+        }
+      });
+    });
+
+    afterEach(async function () {
+      aggregateSucceeded = undefined;
+      aggregateFailed = undefined;
+      await setupClient.close();
+      await encryptedClient.close();
+    });
+
+    context('Case 1: Command Error', metadata, function () {
+      beforeEach(async function () {
+        // Use ``setupClient`` to configure the following failpoint:
+        //    {
+        //         "configureFailPoint": "failCommand",
+        //         "mode": {
+        //             "times": 1
+        //         },
+        //         "data": {
+        //             "errorCode": 123,
+        //             "failCommands": [
+        //                 "aggregate"
+        //             ]
+        //         }
+        //     }
+        await setupClient
+          .db()
+          .admin()
+          .command({
+            configureFailPoint: 'failCommand',
+            mode: {
+              times: 1
+            },
+            data: {
+              errorCode: 123,
+              failCommands: ['aggregate']
+            }
+          });
+      });
+
+      it('expects an error and a command failed event', async function () {
+        // Use ``encryptedClient`` to run an aggregate on ``db.decryption_events``.
+        // Expect an exception to be thrown from the command error. Expect a CommandFailedEvent.
+        const collection = encryptedClient.db('db').collection('decryption_events');
+        try {
+          await collection.aggregate([]).toArray();
+          expect.fail('aggregate must fail with error');
+        } catch (error) {
+          expect(error.code).to.equal(123);
+        }
+        expect(aggregateFailed.failure.code).to.equal(123);
+      });
+    });
+
+    context('Case 2: Network Error', metadata, function () {
+      beforeEach(async function () {
+        // Use ``setupClient`` to configure the following failpoint:
+        //    {
+        //         "configureFailPoint": "failCommand",
+        //         "mode": {
+        //             "times": 1
+        //         },
+        //         "data": {
+        //             "errorCode": 123,
+        //             "closeConnection": true,
+        //             "failCommands": [
+        //                 "aggregate"
+        //             ]
+        //         }
+        //     }
+        await setupClient
+          .db()
+          .admin()
+          .command({
+            configureFailPoint: 'failCommand',
+            mode: {
+              times: 1
+            },
+            data: {
+              errorCode: 123,
+              closeConnection: true,
+              failCommands: ['aggregate']
+            }
+          });
+      });
+
+      it('expects an error and a command failed event', async function () {
+        // Use ``encryptedClient`` to run an aggregate on ``db.decryption_events``.
+        // Expect an exception to be thrown from the network error. Expect a CommandFailedEvent.
+        const collection = encryptedClient.db('db').collection('decryption_events');
+        try {
+          await collection.aggregate([]).toArray();
+          expect.fail('aggregate must fail with error');
+        } catch (error) {
+          expect(error).to.be.instanceOf(MongoNetworkError);
+        }
+        expect(aggregateFailed.failure.message).to.include('closed');
+      });
+    });
+
+    context('Case 3: Decrypt Error', metadata, function () {
+      it('errors on decryption but command succeeds', async function () {
+        // Use ``encryptedClient`` to insert the document ``{ "encrypted": <malformedCiphertext> }``
+        // into ``db.decryption_events``.
+        // Use ``encryptedClient`` to run an aggregate on ``db.decryption_events``.
+        // Expect an exception to be thrown from the decryption error.
+        // Expect a CommandSucceededEvent. Expect the CommandSucceededEvent.reply
+        // to contain BSON binary for the field
+        // ``cursor.firstBatch.encrypted``.
+        const collection = encryptedClient.db('db').collection('decryption_events');
+        await collection.insertOne({ encrypted: malformedCiphertext });
+        try {
+          await collection.aggregate([]).toArray();
+          expect.fail('aggregate must fail with error');
+        } catch (error) {
+          expect(error.message).to.include('HMAC validation failure');
+        }
+        const doc = aggregateSucceeded.reply.cursor.firstBatch[0];
+        expect(doc.encrypted).to.be.instanceOf(Binary);
+      });
+    });
+
+    context('Case 4: Decrypt Success', metadata, function () {
+      it('succeeds on decryption and command succeeds', async function () {
+        // Use ``encryptedClient`` to insert the document ``{ "encrypted": <ciphertext> }``
+        // into ``db.decryption_events``.
+        // Use ``encryptedClient`` to run an aggregate on ``db.decryption_events``.
+        // Expect no exception.
+        // Expect a CommandSucceededEvent. Expect the CommandSucceededEvent.reply
+        // to contain BSON binary for the field ``cursor.firstBatch.encrypted``.
+        const collection = encryptedClient.db('db').collection('decryption_events');
+        await collection.insertOne({ encrypted: cipherText });
+        let result;
+        try {
+          result = await collection.aggregate([]).toArray();
+        } catch (error) {
+          expect.fail(`aggregate must not fail, got ${error.message}`);
+        }
+        expect(result[0].encrypted).to.equal('hello');
+        const doc = aggregateSucceeded.reply.cursor.firstBatch[0];
+        expect(doc.encrypted).to.be.instanceOf(Binary);
+      });
+    });
+  });
 });
