mongodb / specifications

Specifications related to MongoDB
http://specifications.readthedocs.io/en/latest
Other
389 stars 242 forks source link

DRIVERS-2441 add prose test Rewrap Case 2 #1413

Closed kevinAlbs closed 1 year ago

kevinAlbs commented 1 year ago

Summary

Background & Motivation

The specified API for rewrapManyDataKey does not permit calling with a set masterKey without a provider.

class ClientEncryption {
    rewrapManyDataKey(filter: Document, opts: RewrapManyDataKeyOpts | null): RewrapManyDataKeyResult;
}
class RewrapManyDataKeyOpts {
    provider: String
    masterKey: Optional<Document>
}

Some driver implementations do not represent RewrapManyDataKeyOpts as a separate type. Instead, the provider and masterKey are both optional arguments to RewrapManyDataKey.

The C driver API permits setting masterKey without provider:

MONGOC_EXPORT (bool)
mongoc_client_encryption_rewrap_many_datakey (
   mongoc_client_encryption_t *client_encryption,
   const bson_t *filter,
   const char *provider,
   const bson_t *master_key,
   mongoc_client_encryption_rewrap_many_datakey_result_t *result,
   bson_error_t *error);

The current behavior of mongoc_client_encryption_rewrap_many_datakey silently ignores the master_key option if provider is NULL.

This may result in unexpected behavior. A user may be attempting to rewrap keys with a new master_key and mistakenly passed a NULL provider. A NULL provider results in rewrapping with the same master_key.

The Java driver had similar behavior, which was fixed in JAVA-4717.

Please complete the following before merging: