badQueries.yml

runOn:
  - minServerVersion: "4.1.10"
database_name: &database_name "default"
collection_name: &collection_name "default"

data:
  - &doc0_encrypted { _id: 1, encrypted_string: {'$binary': {'base64': 'AQAAAAAAAAAAAAAAAAAAAAACwj+3zkv2VM+aTfk60RqhXq6a/77WlLwu/BxXFkL7EppGsju/m8f0x5kBDD3EZTtGALGXlym5jnpZAoSIkswHoA==', 'subType': '06'}} }
  - &doc1_encrypted { _id: 2, encrypted_string: {'$binary': {'base64': 'AQAAAAAAAAAAAAAAAAAAAAACDdw4KFz3ZLquhsbt7RmDjD0N67n0uSXx7IGnQNCLeIKvot6s/ouI21Eo84IOtb6lhwUNPlSEBNY0/hbszWAKJg==', 'subType': '06'}} }
json_schema: {'properties': {'encrypted_w_altname': {'encrypt': {'keyId': '/altname', 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Random'}}, 'encrypted_string': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'random': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Random'}}, 'encrypted_string_equivalent': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}}, 'bsonType': 'object'}
key_vault_data: [{'status': 1, '_id': {'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}, 'masterKey': {'provider': 'aws', 'key': 'arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0', 'region': 'us-east-1'}, 'updateDate': {'$date': {'$numberLong': '1552949630483'}}, 'keyMaterial': {'$binary': {'base64': 'AQICAHhQNmWG2CzOm1dq3kWLM+iDUZhEqnhJwH9wZVpuZ94A8gEqnsxXlR51T5EbEVezUqqKAAAAwjCBvwYJKoZIhvcNAQcGoIGxMIGuAgEAMIGoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDHa4jo6yp0Z18KgbUgIBEIB74sKxWtV8/YHje5lv5THTl0HIbhSwM6EqRlmBiFFatmEWaeMk4tO4xBX65eq670I5TWPSLMzpp8ncGHMmvHqRajNBnmFtbYxN3E3/WjxmdbOOe+OXpnGJPcGsftc7cB2shRfA4lICPnE26+oVNXT6p0Lo20nY5XC7jyCO', 'subType': '00'}}, 'creationDate': {'$date': {'$numberLong': '1552949630483'}}, 'keyAltNames': ['altname', 'another_altname']}]

# TODO: I could see an argument against having these tests of mongocryptd as part
# of driver tests. When mongocryptd introduces support for these operators, these
# tests will fail. But it's also easy enough to remove these tests when that happens.

tests:
  - description: "$text unconditionally fails"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: find
        arguments:
          filter:
            { $text: { $search: "search text" } }
        result:
          errorContains: "Unsupported match expression operator for encryption"
  - description: "$where unconditionally fails"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: find
        arguments:
          filter:
            { $where: { $code: "function() { return true }" } }
        result:
          errorContains: "Unsupported match expression operator for encryption"
  - description: "$bit operators succeed on unencrypted, error on encrypted"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: find
        arguments:
          filter: { unencrypted: { $bitsAllClear: 35 }}
        result: []
      - name: find
        arguments:
          filter: { encrypted_string: { $bitsAllClear: 35 }}
        result:
          errorContains: "Invalid match expression operator on encrypted field"
      - name: find
        arguments:
          filter: { unencrypted: { $bitsAllSet: 35 }}
        result: []
      - name: find
        arguments:
          filter: { encrypted_string: { $bitsAllSet: 35 }}
        result:
          errorContains: "Invalid match expression operator on encrypted field"
      - name: find
        arguments:
          filter: { unencrypted: { $bitsAnyClear: 35 }}
        result: []
      - name: find
        arguments:
          filter: { encrypted_string: { $bitsAnyClear: 35 }}
        result:
          errorContains: "Invalid match expression operator on encrypted field"
      - name: find
        arguments:
          filter: { unencrypted: { $bitsAnySet: 35 }}
        result: []
      - name: find
        arguments:
          filter: { encrypted_string: { $bitsAnySet: 35 }}
        result:
          errorContains: "Invalid match expression operator on encrypted field"
  - description: "geo operators succeed on unencrypted, error on encrypted"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: find
        arguments:
          filter: { unencrypted: { $near: [0,0] }}
        result:
          # Still an error because no geo index, but from mongod - not mongocryptd.
          errorContains: "unable to find index"
      - name: find
        arguments:
          filter: { encrypted_string: { $near: [0,0] }}
        result:
          errorContains: "Invalid match expression operator on encrypted field"
      - name: find
        arguments:
          filter: { unencrypted: { $nearSphere: [0,0] }}
        result:
          # Still an error because no geo index, but from mongod - not mongocryptd.
          errorContains: "unable to find index"
      - name: find
        arguments:
          filter: { encrypted_string: { $nearSphere: [0,0] }}
        result:
          errorContains: "Invalid match expression operator on encrypted field"
      - name: find
        arguments:
          filter: { unencrypted: { $geoIntersects: { $geometry: { type: "Polygon", coordinates: [[ [0,0], [1,0], [1,1], [0,0] ]] }} }}
        result: []
      - name: find
        arguments:
          filter: { encrypted_string: { $geoIntersects: { $geometry: { type: "Polygon", coordinates: [[ [0,0], [1,0], [1,1], [0,0] ]] }} }}
        result:
          errorContains: "Invalid match expression operator on encrypted field"
      - name: find
        arguments:
          filter: { unencrypted: { $geoWithin: { $geometry: { type: "Polygon", coordinates: [[ [0,0], [1,0], [1,1], [0,0] ]] }} }}
        result: []
      - name: find
        arguments:
          filter: { encrypted_string: { $geoWithin: { $geometry: { type: "Polygon", coordinates: [[ [0,0], [1,0], [1,1], [0,0] ]] }} }}
        result:
          errorContains: "Invalid match expression operator on encrypted field"
  - description: "inequality operators succeed on unencrypted, error on encrypted"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: find
        arguments:
          filter: { unencrypted: { $gt: 1 }}
        result: []
      - name: find
        arguments:
          filter: { encrypted_string: { $gt: 1 }}
        result:
          errorContains: "Invalid match expression operator on encrypted field"
      - name: find
        arguments:
          filter: { unencrypted: { $lt: 1 }}
        result: []
      - name: find
        arguments:
          filter: { encrypted_string: { $lt: 1 }}
        result:
          errorContains: "Invalid match expression operator on encrypted field"
      - name: find
        arguments:
          filter: { unencrypted: { $gte: 1 }}
        result: []
      - name: find
        arguments:
          filter: { encrypted_string: { $gte: 1 }}
        result:
          errorContains: "Invalid match expression operator on encrypted field"
      - name: find
        arguments:
          filter: { unencrypted: { $lte: 1 }}
        result: []
      - name: find
        arguments:
          filter: { encrypted_string: { $lte: 1 }}
        result:
          errorContains: "Invalid match expression operator on encrypted field"
  - description: "other misc operators succeed on unencrypted, error on encrypted"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: find
        arguments:
          filter: { unencrypted: { $mod: [3, 1] }}
        result: []
      - name: find
        arguments:
          filter: { encrypted_string: { $mod: [3, 1] }}
        result:
          errorContains: "Invalid match expression operator on encrypted field"
      - name: find
        arguments:
          filter: { unencrypted: { $regex: "pattern", $options: "" }}
        result: []
      - name: find
        arguments:
          filter: { encrypted_string: { $regex: "pattern", $options: "" }}
        result:
          errorContains: "Invalid match expression operator on encrypted field"
      - name: find
        arguments:
          filter: { unencrypted: { $size: 2 }}
        result: []
      - name: find
        arguments:
          filter: { encrypted_string: { $size: 2 }}
        result:
          errorContains: "Invalid match expression operator on encrypted field"
      - name: find
        arguments:
          filter: { unencrypted: { $type: 2 }}
        result: []
      - name: find
        arguments:
          filter: { encrypted_string: { $type: 2 }}
        result:
          errorContains: "Invalid match expression operator on encrypted field"
      - name: find
        arguments:
          filter: { unencrypted: { $eq: null }}
        result:
          - &doc0 { _id: 1, encrypted_string: "string0" }
          - &doc1 { _id: 2, encrypted_string: "string1" }
      - name: find
        arguments:
          filter: { encrypted_string: { $eq: null }}
        result:
          errorContains: "Illegal equality to null predicate for encrypted field"
      - name: find
        arguments:
          filter: { unencrypted: { $in: [null] }}
        result:
          - *doc0
          - *doc1
      - name: find
        arguments:
          filter: { encrypted_string: { $in: [null] }}
        result:
          errorContains: "Illegal equality to null inside $in against an encrypted field"
  - description: "$addToSet succeeds on unencrypted, error on encrypted"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: updateOne
        arguments:
          filter: { }
          update: { $addToSet: { "unencrypted": ["a"]}}
        result:
          matchedCount: 1
          modifiedCount: 1
          upsertedCount: 0
      - name: updateOne
        arguments:
          filter: { }
          update: { $addToSet: { "encrypted_string": ["a"]}}
        result:
          errorContains: "$addToSet not allowed on encrypted values"
  - description: "$inc succeeds on unencrypted, error on encrypted"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: updateOne
        arguments:
          filter: { }
          update: { $inc: { "unencrypted": 1}}
        result:
          matchedCount: 1
          modifiedCount: 1
          upsertedCount: 0
      - name: updateOne
        arguments:
          filter: { }
          update: { $inc: { "encrypted_string": 1}}
        result:
          errorContains: "$inc and $mul not allowed on encrypted values"
  - description: "$mul succeeds on unencrypted, error on encrypted"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: updateOne
        arguments:
          filter: { }
          update: { $mul: { "unencrypted": 1}}
        result:
          matchedCount: 1
          modifiedCount: 1
          upsertedCount: 0
      - name: updateOne
        arguments:
          filter: { }
          update: { $mul: { "encrypted_string": 1}}
        result:
          errorContains: "$inc and $mul not allowed on encrypted values"
  - description: "$max succeeds on unencrypted, error on encrypted"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: updateOne
        arguments:
          filter: { }
          update: { $max: { "unencrypted": 1}}
        result:
          matchedCount: 1
          modifiedCount: 1
          upsertedCount: 0
      - name: updateOne
        arguments:
          filter: { }
          update: { $max: { "encrypted_string": 1}}
        result:
          errorContains: "$max and $min not allowed on encrypted values"
  - description: "$min succeeds on unencrypted, error on encrypted"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: updateOne
        arguments:
          filter: { }
          update: { $min: { "unencrypted": 1}}
        result:
          matchedCount: 1
          modifiedCount: 1
          upsertedCount: 0
      - name: updateOne
        arguments:
          filter: { }
          update: { $min: { "encrypted_string": 1}}
        result:
          errorContains: "$max and $min not allowed on encrypted values"
  - description: "$currentDate succeeds on unencrypted, error on encrypted"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: updateOne
        arguments:
          filter: { }
          update: { $currentDate: { "unencrypted": true}}
        result:
          matchedCount: 1
          modifiedCount: 1
          upsertedCount: 0
      - name: updateOne
        arguments:
          filter: { }
          update: { $currentDate: { "encrypted_string": true }}
        result:
          errorContains: "$currentDate not allowed on encrypted values"
  - description: "$pop succeeds on unencrypted, error on encrypted"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: updateOne
        arguments:
          filter: { }
          update: { $pop: { "unencrypted": 1}}
        result:
          matchedCount: 1
          modifiedCount: 0
          upsertedCount: 0
      - name: updateOne
        arguments:
          filter: { }
          update: { $pop: { "encrypted_string": 1 }}
        result:
          errorContains: "$pop not allowed on encrypted values"
  - description: "$pull succeeds on unencrypted, error on encrypted"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: updateOne
        arguments:
          filter: { }
          update: { $pull: { "unencrypted": 1}}
        result:
          matchedCount: 1
          modifiedCount: 0
          upsertedCount: 0
      - name: updateOne
        arguments:
          filter: { }
          update: { $pull: { "encrypted_string": 1 }}
        result:
          errorContains: "$pull not allowed on encrypted values"
  - description: "$pullAll succeeds on unencrypted, error on encrypted"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: updateOne
        arguments:
          filter: { }
          update: { $pullAll: { "unencrypted": [1] }}
        result:
          matchedCount: 1
          modifiedCount: 0
          upsertedCount: 0
      - name: updateOne
        arguments:
          filter: { }
          update: { $pullAll: { "encrypted_string": [1] }}
        result:
          errorContains: "$pullAll not allowed on encrypted values"
  - description: "$push succeeds on unencrypted, error on encrypted"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: updateOne
        arguments:
          filter: { }
          update: { $push: { "unencrypted": 1}}
        result:
          matchedCount: 1
          modifiedCount: 1
          upsertedCount: 0
      - name: updateOne
        arguments:
          filter: { }
          update: { $push: { "encrypted_string": 1 }}
        result:
          errorContains: "$push not allowed on encrypted values"
  - description: "array filters on encrypted fields does not error in mongocryptd, but errors in mongod"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: updateOne
        arguments:
          filter: { }
          update: { $set : { "encrypted_string.$[i].x": 1 }}
          arrayFilters: [{ i.x: 1 }]
        result:
          errorContains: "Array update operations not allowed on encrypted values"
  - description: "positional operator succeeds on unencrypted, errors on encrypted"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: updateOne
        arguments:
          filter: { "unencrypted": 1 }
          update: { $set : { "unencrypted.$": 1 }}
        result:
          matchedCount: 0
          modifiedCount: 0
          upsertedCount: 0
      - name: updateOne
        arguments:
          filter: { "encrypted_string": "abc" }
          update: { $set : { "encrypted_string.$": "abc" }}
        result:
          errorContains: "Cannot encrypt fields below '$' positional update operator"
  - description: "an update that would produce an array on an encrypted field errors"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: updateOne
        arguments:
          filter: { }
          update: { $set : { "encrypted_string": [1,2] }}
        result:
          # The expected error message changed in mongocryptd 6.0. Before it was:
          # "Cannot encrypt element of type array because schema requires that type is one of: [ string ]"
          # After it is:
          # "Cannot encrypt element of type: array"
          # Only check for the common prefix.
          errorContains: "Cannot encrypt element of type"
  - description: "an insert with encrypted field on _id errors"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
        schemaMap:
          "default.default": {'properties': {'_id': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}}}
    operations:
      - name: insertOne
        arguments:
          document: { _id: 1 }
        result:
          errorContains: "Invalid schema containing the 'encrypt' keyword."
  - description: "an insert with an array value for an encrypted field fails"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: insertOne
        arguments:
          document: { encrypted_string: [ "123", "456"] }
        result:
          # The expected error message changed in mongocryptd 6.0. Before it was:
          # "Cannot encrypt element of type array because schema requires that type is one of: [ string ]"
          # After it is:
          # "Cannot encrypt element of type: array"
          # Only check for the common prefix.
          errorContains: "Cannot encrypt element of type"
  - description: "an insert with a Timestamp(0,0) value in the top-level fails"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: insertOne
        arguments:
          document: { random: {"$timestamp": {"t": 0, "i": 0 }} }
        result:
          errorContains: "A command that inserts cannot supply Timestamp(0, 0) for an encrypted"
  - description: "distinct with the key referring to a field where the keyID is a JSON Pointer errors"
    clientOptions:
      autoEncryptOpts:
        kmsProviders:
          aws: {} # Credentials filled in from environment.
    operations:
      - name: distinct
        arguments:
          filter: {}
          fieldName: "encrypted_w_altname"
        result:
          errorContains: "The distinct key is not allowed to be marked for encryption with a non-UUID keyId"