Skip to content

Commit 6701879

Browse files
GromNaNalcaeus
GromNaN
and
alcaeus
authored
Enable auto encryption from mongodb-odm 12 (#897)
--------- Co-authored-by: Andreas Braun <[email protected]>
1 parent c160539 commit 6701879

24 files changed

+2034
-74
lines changed

‎.github/workflows/coding-standards.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ on:
44
pull_request:
55
branches:
66
- "*.x"
7+
- "feature/*"
78
push:
89
branches:
910
- "*.x"

‎.github/workflows/composer-lint.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,13 @@ on:
44
pull_request:
55
branches:
66
- "*.x"
7+
- "feature/*"
78
paths:
89
- "composer.json"
910
push:
1011
branches:
1112
- "*.x"
13+
- "feature/*"
1214
paths:
1315
- "composer.json"
1416

‎.github/workflows/continuous-integration.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ on:
44
pull_request:
55
branches:
66
- "*.x"
7-
- "master"
7+
- "feature/*"
88
push:
99

1010
env:
@@ -41,7 +41,7 @@ jobs:
4141
- dependencies: "lowest"
4242
os: "ubuntu-24.04"
4343
php-version: "8.1"
44-
driver-version: "1.16.0"
44+
driver-version: "1.21.0"
4545
stability: "stable"
4646
symfony-version: "6.4.*"
4747
- dependencies: "highest"

‎.github/workflows/static-analysis.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ on:
44
pull_request:
55
branches:
66
- "*.x"
7+
- "feature/*"
78
paths:
89
- .github/workflows/static-analysis.yml
910
- composer.*

‎composer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
"homepage": "http://www.doctrine-project.org",
2626
"require": {
2727
"php": "^8.1",
28-
"ext-mongodb": "^1.16 || ^2",
28+
"ext-mongodb": "^1.21 || ^2",
2929
"composer-runtime-api": "^2.0",
3030
"doctrine/mongodb-odm": "^2.6",
3131
"doctrine/persistence": "^3.0 || ^4.0",

‎config/command.php‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
use Doctrine\Bundle\MongoDBBundle\Command\ClearMetadataCacheDoctrineODMCommand;
66
use Doctrine\Bundle\MongoDBBundle\Command\CreateSchemaDoctrineODMCommand;
77
use Doctrine\Bundle\MongoDBBundle\Command\DropSchemaDoctrineODMCommand;
8+
use Doctrine\Bundle\MongoDBBundle\Command\Encryption\DiagnosticCommand;
9+
use Doctrine\Bundle\MongoDBBundle\Command\Encryption\DumpFieldsMapCommand;
810
use Doctrine\Bundle\MongoDBBundle\Command\GenerateHydratorsDoctrineODMCommand;
911
use Doctrine\Bundle\MongoDBBundle\Command\GenerateProxiesDoctrineODMCommand;
1012
use Doctrine\Bundle\MongoDBBundle\Command\InfoDoctrineODMCommand;
@@ -15,12 +17,21 @@
1517
use Symfony\Component\DependencyInjection\Loader\Configurator\ContainerConfigurator;
1618

1719
use function Symfony\Component\DependencyInjection\Loader\Configurator\service;
20+
use function Symfony\Component\DependencyInjection\Loader\Configurator\tagged_locator;
1821

1922
return static function (ContainerConfigurator $containerConfigurator): void {
2023
$containerConfigurator->services()
2124
->set('doctrine_mongodb.odm.command.clear_metadata_cache', ClearMetadataCacheDoctrineODMCommand::class)
2225
->tag('console.command', ['command' => 'doctrine:mongodb:cache:clear-metadata'])
2326

27+
->set('doctrine_mongodb.odm.command.encryption_diagnostic', DiagnosticCommand::class)
28+
->tag('console.command', ['command' => 'doctrine:mongodb:encryption:diagnostic'])
29+
->args([tagged_locator('doctrine_mongodb.connection_diagnostic', 'name')])
30+
31+
->set('doctrine_mongodb.odm.command.encryption_dump_fields_map', DumpFieldsMapCommand::class)
32+
->tag('console.command', ['command' => 'doctrine:mongodb:encryption:dump-fields-map'])
33+
->args([tagged_locator('doctrine_mongodb.odm.document_manager', 'name')])
34+
2435
->set('doctrine_mongodb.odm.command.create_schema', CreateSchemaDoctrineODMCommand::class)
2536
->tag('console.command', ['command' => 'doctrine:mongodb:schema:create'])
2637

‎config/schema/mongodb-1.0.xsd‎

Lines changed: 110 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
<xsd:complexType name="config">
1111
<xsd:sequence>
12-
<xsd:element name="default-commit-options" type="default-commit-options" minOccurs="0" maxOccurs="1" />
12+
<xsd:element name="default-commit-options" type="default-commit-options" minOccurs="0" />
1313
<xsd:element name="connection" type="connection" minOccurs="0" maxOccurs="unbounded" />
1414
<xsd:element name="document-manager" type="document-manager" minOccurs="0" maxOccurs="unbounded" />
1515
<xsd:element name="resolve-target-document" type="resolve_target_document" minOccurs="0" maxOccurs="unbounded" />
@@ -46,8 +46,9 @@
4646

4747
<xsd:complexType name="connection">
4848
<xsd:sequence>
49-
<xsd:element name="options" type="connection-options" minOccurs="0" maxOccurs="1" />
50-
<xsd:element name="driver-options" type="connection-driver-options" minOccurs="0" maxOccurs="1" />
49+
<xsd:element name="options" type="connection-options" minOccurs="0" />
50+
<xsd:element name="driver-options" type="connection-driver-options" minOccurs="0" />
51+
<xsd:element name="autoEncryption" type="auto-encryption" minOccurs="0" />
5152
</xsd:sequence>
5253
<xsd:attribute name="id" type="xsd:string" use="required" />
5354
<xsd:attribute name="server" type="xsd:string" />
@@ -84,6 +85,9 @@
8485
</xsd:complexType>
8586

8687
<xsd:complexType name="connection-driver-options">
88+
<xsd:all>
89+
<xsd:element name="autoEncryption" type="auto-encryption" minOccurs="0"/>
90+
</xsd:all>
8791
<xsd:attribute name="context" type="xsd:string" />
8892
</xsd:complexType>
8993

@@ -119,12 +123,109 @@
119123
<xsd:attribute name="value" type="xsd:string" use="required" />
120124
</xsd:complexType>
121125

126+
<xsd:complexType name="auto-encryption">
127+
<xsd:sequence>
128+
<xsd:element name="kmsProvider" type="kms-provider" />
129+
<xsd:element name="masterKey" type="master-key" minOccurs="0" />
130+
<xsd:element name="keyVaultClient" type="xsd:string" minOccurs="0" />
131+
<xsd:element name="keyVaultNamespace" type="xsd:string" minOccurs="0" />
132+
<xsd:element name="tlsOptions" type="tls-options" minOccurs="0" />
133+
<xsd:element name="encryptedFieldsMap" type="encrypted-fields-map" minOccurs="0" />
134+
<xsd:element name="extraOptions" type="extra-options" minOccurs="0" />
135+
</xsd:sequence>
136+
<xsd:attribute name="bypassAutoEncryption" type="xsd:boolean" />
137+
<xsd:attribute name="bypassQueryAnalysis" type="xsd:boolean" />
138+
</xsd:complexType>
139+
140+
<xsd:complexType name="kms-provider">
141+
<xsd:attribute name="type" type="xsd:string" use="required" />
142+
<!-- AWS -->
143+
<xsd:attribute name="accessKeyId" type="xsd:string" />
144+
<xsd:attribute name="secretAccessKey" type="xsd:string" />
145+
<xsd:attribute name="sessionToken" type="xsd:string" />
146+
<!-- Azure -->
147+
<xsd:attribute name="tenantId" type="xsd:string" />
148+
<xsd:attribute name="clientId" type="xsd:string" />
149+
<xsd:attribute name="clientSecret" type="xsd:string" />
150+
<xsd:attribute name="keyVaultEndpoint" type="xsd:string" />
151+
<xsd:attribute name="identityPlatformEndpoint" type="xsd:string" />
152+
<xsd:attribute name="keyName" type="xsd:string" />
153+
<xsd:attribute name="keyVersion" type="xsd:string" />
154+
<!-- GCP -->
155+
<xsd:attribute name="email" type="xsd:string" />
156+
<xsd:attribute name="privateKey" type="xsd:string" />
157+
<xsd:attribute name="endpoint" type="xsd:string" />
158+
<xsd:attribute name="projectId" type="xsd:string" />
159+
<xsd:attribute name="location" type="xsd:string" />
160+
<xsd:attribute name="keyRing" type="xsd:string" />
161+
<!-- Attribute already present for another KMS type -->
162+
<!-- <xsd:attribute name="keyName" type="xsd:string" /> -->
163+
<!-- <xsd:attribute name="keyVersion" type="xsd:string" /> -->
164+
<!-- KMIP -->
165+
<!-- <xsd:attribute name="endpoint" type="xsd:string" /> -->
166+
<!-- Local -->
167+
<xsd:attribute name="key" type="xsd:string" />
168+
</xsd:complexType>
169+
170+
<xsd:complexType name="master-key">
171+
<!-- AWS -->
172+
<xsd:attribute name="region" type="xsd:string" />
173+
<xsd:attribute name="key" type="xsd:string" />
174+
<xsd:attribute name="endpoint" type="xsd:string" />
175+
<!-- Azure -->
176+
<xsd:attribute name="keyVaultEndpoint" type="xsd:string" />
177+
<xsd:attribute name="keyName" type="xsd:string" />
178+
<xsd:attribute name="keyVersion" type="xsd:string" />
179+
<!-- GCP -->
180+
<xsd:attribute name="projectId" type="xsd:string" />
181+
<xsd:attribute name="location" type="xsd:string" />
182+
<xsd:attribute name="keyRing" type="xsd:string" />
183+
<!-- Attribute already present for another master key type -->
184+
<!-- <xsd:attribute name="keyName" type="xsd:string" /> -->
185+
<!-- <xsd:attribute name="keyVersion" type="xsd:string" /> -->
186+
<!-- <xsd:attribute name="endpoint" type="xsd:string" /> -->
187+
<!-- KMIP -->
188+
<xsd:attribute name="keyId" type="xsd:string" />
189+
<!-- <xsd:attribute name="endpoint" type="xsd:string" /> -->
190+
<xsd:attribute name="delegated" type="xsd:boolean" />
191+
</xsd:complexType>
192+
193+
<xsd:complexType name="tls-options">
194+
<xsd:attribute name="tlsCAFile" type="xsd:string" />
195+
<xsd:attribute name="tlsCertificateKeyFile" type="xsd:string" />
196+
<xsd:attribute name="tlsCertificateKeyFilePassword" type="xsd:string" />
197+
<xsd:attribute name="tlsDisableOCSPEndpointCheck" type="xsd:boolean" />
198+
</xsd:complexType>
199+
200+
<xsd:simpleType name="encrypted-fields-map">
201+
<xsd:restriction base="xsd:string"/>
202+
</xsd:simpleType>
203+
204+
<xsd:complexType name="encrypted-queries">
205+
<xsd:attribute name="queryType" type="xsd:string" use="required" />
206+
<xsd:attribute name="min" type="xsd:string" />
207+
<xsd:attribute name="max" type="xsd:string" />
208+
<xsd:attribute name="sparsity" type="xsd:string" />
209+
<xsd:attribute name="trimFactor" type="xsd:string" />
210+
</xsd:complexType>
211+
212+
<xsd:complexType name="extra-options">
213+
<xsd:sequence>
214+
<xsd:element name="mongocryptdSpawnArgs" type="xsd:string" minOccurs="0" maxOccurs="unbounded" />
215+
</xsd:sequence>
216+
<xsd:attribute name="mongocryptdURI" type="xsd:string" />
217+
<xsd:attribute name="mongocryptdBypassSpawn" type="xsd:boolean" />
218+
<xsd:attribute name="mongocryptdSpawnPath" type="xsd:string" />
219+
<xsd:attribute name="cryptSharedLibPath" type="xsd:string" />
220+
<xsd:attribute name="cryptSharedLibRequired" type="xsd:boolean" />
221+
</xsd:complexType>
222+
122223
<xsd:complexType name="document-manager">
123224
<xsd:choice maxOccurs="unbounded">
124225
<xsd:element name="filter" type="filter" minOccurs="0" maxOccurs="unbounded" />
125226
<xsd:element name="mapping" type="mapping" minOccurs="0" maxOccurs="unbounded" />
126-
<xsd:element name="metadata-cache-driver" type="metadata-cache-driver" minOccurs="0" maxOccurs="1" />
127-
<xsd:element name="profiler" type="profiler" minOccurs="0" maxOccurs="1" />
227+
<xsd:element name="metadata-cache-driver" type="metadata-cache-driver" minOccurs="0" />
228+
<xsd:element name="profiler" type="profiler" minOccurs="0" />
128229
</xsd:choice>
129230
<xsd:attribute name="id" type="xsd:string" use="required" />
130231
<xsd:attribute name="auto-mapping" type="xsd:boolean" />
@@ -167,10 +268,10 @@
167268

168269
<xsd:complexType name="metadata-cache-driver">
169270
<xsd:all>
170-
<xsd:element name="class" type="xsd:string" minOccurs="0" maxOccurs="1" />
171-
<xsd:element name="host" type="xsd:string" minOccurs="0" maxOccurs="1" />
172-
<xsd:element name="instance-class" type="xsd:string" minOccurs="0" maxOccurs="1" />
173-
<xsd:element name="port" type="xsd:integer" minOccurs="0" maxOccurs="1" />
271+
<xsd:element name="class" type="xsd:string" minOccurs="0" />
272+
<xsd:element name="host" type="xsd:string" minOccurs="0" />
273+
<xsd:element name="instance-class" type="xsd:string" minOccurs="0" />
274+
<xsd:element name="port" type="xsd:integer" minOccurs="0" />
174275
</xsd:all>
175276
<xsd:attribute name="id" type="xsd:string" />
176277
<xsd:attribute name="type" type="xsd:string" />

‎docs/config.rst‎

Lines changed: 48 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -624,6 +624,10 @@ Otherwise you will get a *auth failed* exception.
624624
]);
625625
};
626626
627+
Using Queryable Encryption
628+
--------------------------
629+
630+
For details on configuring Queryable Encryption (QE) and Client-Side Field-Level Encryption (CSFLE), see :doc:`encryption`.
627631

628632
Full Default Configuration
629633
--------------------------
@@ -699,6 +703,29 @@ Full Default Configuration
699703
wTimeoutMS: ~
700704
driver_options:
701705
context: ~ # stream context to use for connection
706+
autoEncryption: # Options for client-side field-level encryption
707+
keyVaultClient: null # Service ID of a MongoDB\Driver\Manager for the key vault
708+
keyVaultNamespace: null # The namespace for the key vault collection (e.g., "encryption.__keyVault")
709+
kmsProvider: {} # Configuration for Key Management System provider (see specific examples above)
710+
# e.g., { type: "local", key: "YOUR_BASE64_KEY" }
711+
# e.g., { type: "aws", accessKeyId: "...", secretAccessKey: "..." }
712+
masterKey: ~ # Default master key to use when creating a new encrypted collection
713+
schemaMap: [] # Document schemas for explicit encryption
714+
encryptedFieldsMap: [] # Map of collections to their encrypted fields configuration
715+
extraOptions: [] # Extra options for mongocryptd
716+
# mongocryptdURI: "mongodb://localhost:27020"
717+
# mongocryptdBypassSpawn: false
718+
# mongocryptdSpawnPath: "/usr/local/bin/mongocryptd"
719+
# mongocryptdSpawnArgs: ["--idleShutdownTimeoutSecs=60"]
720+
# cryptSharedLibPath: null # Path to the crypt_shared library
721+
# cryptSharedLibRequired: false # If true, fails if the crypt_shared library cannot be loaded
722+
bypassQueryAnalysis: false # Disables automatic analysis of read and write operations for encryption
723+
bypassAutoEncryption: false # Disables auto-encryption
724+
tlsOptions: # TLS options for the Key Vault client (if keyVaultClient is not specified)
725+
tlsCAFile: null # Path to CA file, e.g., /path/to/key-vault-ca.pem
726+
tlsCertificateKeyFile: null # Path to client cert/key file, e.g., /path/to/key-vault-client.pem
727+
tlsCertificateKeyFilePassword: null # Password for client cert/key file
728+
tlsDisableOCSPEndpointCheck: false # Disable OCSP checks
702729
703730
proxy_namespace: MongoDBODMProxies
704731
proxy_dir: "%kernel.cache_dir%/doctrine/odm/mongodb/Proxies"
@@ -825,8 +852,27 @@ Full Default Configuration
825852
826853
$config->connection('id')
827854
->server('mongodb://localhost')
828-
->driverOptions([
829-
'context' => null, // stream context to use for connection
855+
->autoEncryption([ // Options for client-side field-level encryption
856+
'bypassAutoEncryption' => false, // Disables auto-encryption
857+
'keyVaultClient' => null, // Service ID of a MongoDB\Driver\Manager for the key vault
858+
'keyVaultNamespace' => null, // The namespace for the key vault collection (e.g., "encryption.__keyVault")
859+
'kmsProvider' => [ // Configuration for Key Management System provider
860+
// e.g., ['type' => 'local', 'key' => 'YOUR_BASE64_KEY']
861+
// e.g., ['type' => 'aws', 'accessKeyId' => '...', 'secretAccessKey' => '...']
862+
],
863+
'schemaMap' => [], // Document schemas for explicit encryption
864+
'encryptedFieldsMap' => [], // Map of collections to their encrypted fields configuration
865+
'extraOptions' => [ // Extra options for mongocryptd
866+
// 'cryptSharedLibPath' => null, // Path to the crypt_shared library
867+
// 'cryptSharedLibRequired' => false, // If true, fails if the crypt_shared library cannot be loaded
868+
],
869+
'bypassQueryAnalysis' => false, // Disables automatic analysis of read and write operations for encryption
870+
'tlsOptions' => [ // TLS options for the Key Vault client (if keyVaultClient is not specified)
871+
// 'tlsCAFile' => null, // Path to CA file, e.g., /path/to/key-vault-ca.pem
872+
// 'tlsCertificateKeyFile' => null, // Path to client cert/key file, e.g., /path/to/key-vault-client.pem
873+
// 'tlsCertificateKeyFilePassword' => null, // Password for client cert/key file
874+
// 'tlsDisableOCSPEndpointCheck' => false, // Disable OCSP checks
875+
],
830876
])
831877
->options([
832878
'authMechanism' => null,

0 commit comments

Comments
 (0)