DATAMONGO-2306 - Add field level encryption to JSON Schema.

pom.xml

@@ -5,7 +5,7 @@
 
 	<groupId>org.springframework.data</groupId>
 	<artifactId>spring-data-mongodb-parent</artifactId>
-	<version>2.2.0.BUILD-SNAPSHOT</version>
+	<version>2.2.0.DATAMONGO-2306-SNAPSHOT</version>
 	<packaging>pom</packaging>
 
 	<name>Spring Data MongoDB</name>

spring-data-mongodb-benchmarks/pom.xml

@@ -7,7 +7,7 @@
 	<parent>
 		<groupId>org.springframework.data</groupId>
 		<artifactId>spring-data-mongodb-parent</artifactId>
-		<version>2.2.0.BUILD-SNAPSHOT</version>
+		<version>2.2.0.DATAMONGO-2306-SNAPSHOT</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 

spring-data-mongodb-distribution/pom.xml

@@ -14,7 +14,7 @@
 	<parent>
 		<groupId>org.springframework.data</groupId>
 		<artifactId>spring-data-mongodb-parent</artifactId>
-		<version>2.2.0.BUILD-SNAPSHOT</version>
+		<version>2.2.0.DATAMONGO-2306-SNAPSHOT</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 

spring-data-mongodb/pom.xml

@@ -11,7 +11,7 @@
 	<parent>
 		<groupId>org.springframework.data</groupId>
 		<artifactId>spring-data-mongodb-parent</artifactId>
-		<version>2.2.0.BUILD-SNAPSHOT</version>
+		<version>2.2.0.DATAMONGO-2306-SNAPSHOT</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 

spring-data-mongodb/src/main/java/org/springframework/data/mongodb/config/MongoParsingUtils.java

@@ -35,6 +35,7 @@
  * @author Oliver Gierke
  * @author Thomas Darimont
  * @author Christoph Strobl
+ * @author Mark Paluch
  */
 @SuppressWarnings("deprecation")
 abstract class MongoParsingUtils {
@@ -92,6 +93,7 @@ public static boolean parseMongoClientOptions(Element element, BeanDefinitionBui
 		setPropertyValue(clientOptionsDefBuilder, optionsElement, "heartbeat-socket-timeout", "heartbeatSocketTimeout");
 		setPropertyValue(clientOptionsDefBuilder, optionsElement, "ssl", "ssl");
 		setPropertyReference(clientOptionsDefBuilder, optionsElement, "ssl-socket-factory-ref", "sslSocketFactory");
+		setPropertyReference(clientOptionsDefBuilder, optionsElement, "encryption-settings-ref", "autoEncryptionSettings");
 		setPropertyValue(clientOptionsDefBuilder, optionsElement, "server-selection-timeout", "serverSelectionTimeout");
 
 		mongoClientBuilder.addPropertyValue("mongoClientOptions", clientOptionsDefBuilder.getBeanDefinition());

spring-data-mongodb/src/main/java/org/springframework/data/mongodb/core/MongoClientOptionsFactoryBean.java

@@ -22,6 +22,7 @@
 import org.springframework.data.mongodb.MongoDbFactory;
 import org.springframework.lang.Nullable;
 
+import com.mongodb.AutoEncryptionSettings;
 import com.mongodb.DBDecoderFactory;
 import com.mongodb.DBEncoderFactory;
 import com.mongodb.MongoClient;
@@ -73,6 +74,7 @@ public class MongoClientOptionsFactoryBean extends AbstractFactoryBean<MongoClie
 
 	private boolean ssl;
 	private @Nullable SSLSocketFactory sslSocketFactory;
+	private @Nullable AutoEncryptionSettings autoEncryptionSettings;
 
 	/**
 	 * Set the {@link MongoClient} description.
@@ -272,6 +274,16 @@ public void setServerSelectionTimeout(int serverSelectionTimeout) {
 		this.serverSelectionTimeout = serverSelectionTimeout;
 	}
 
+	/**
+	 * Set the {@link AutoEncryptionSettings} to be used.
+	 *
+	 * @param autoEncryptionSettings can be {@literal null}.
+	 * @since 2.2
+	 */
+	public void setAutoEncryptionSettings(@Nullable AutoEncryptionSettings autoEncryptionSettings) {
+		this.autoEncryptionSettings = autoEncryptionSettings;
+	}
+
 	/*
 	 * (non-Javadoc)
 	 * @see org.springframework.beans.factory.config.AbstractFactoryBean#createInstance()
@@ -304,7 +316,8 @@ protected MongoClientOptions createInstance() throws Exception {
 				.requiredReplicaSetName(requiredReplicaSetName) //
 				.serverSelectionTimeout(serverSelectionTimeout) //
 				.sslEnabled(ssl) //
-				.socketFactory(socketFactoryToUse) // TODO: Mongo Driver 4 - remove if not available
+				.autoEncryptionSettings(autoEncryptionSettings) //
+				.socketFactory(socketFactoryToUse) // TODO: Mongo Driver 4 -
 				.socketKeepAlive(socketKeepAlive) // TODO: Mongo Driver 4 - remove if not available
 				.socketTimeout(socketTimeout) //
 				.threadsAllowedToBlockForConnectionMultiplier(threadsAllowedToBlockForConnectionMultiplier) //

spring-data-mongodb/src/main/java/org/springframework/data/mongodb/core/MongoEncryptionSettingsFactoryBean.java

@@ -0,0 +1,120 @@
+/*
+ * Copyright 2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.data.mongodb.core;
+
+import java.util.Collections;
+import java.util.Map;
+
+import org.bson.BsonDocument;
+import org.springframework.beans.factory.FactoryBean;
+import org.springframework.lang.Nullable;
+
+import com.mongodb.AutoEncryptionSettings;
+import com.mongodb.MongoClientSettings;
+
+/**
+ * {@link FactoryBean} for creating {@link AutoEncryptionSettings} using the {@link AutoEncryptionSettings.Builder}.
+ *
+ * @author Christoph Strobl
+ * @since 2.2
+ */
+public class MongoEncryptionSettingsFactoryBean implements FactoryBean<AutoEncryptionSettings> {
+
+	private boolean bypassAutoEncryption;
+	private String keyVaultNamespace;
+	private Map<String, Object> extraOptions;
+	private MongoClientSettings keyVaultClientSettings;
+	private Map<String, Map<String, Object>> kmsProviders;
+	private Map<String, BsonDocument> schemaMap;
+
+	/**
+	 * @param bypassAutoEncryption
+	 * @see AutoEncryptionSettings.Builder#bypassAutoEncryption(boolean)
+	 */
+	public void setBypassAutoEncryption(boolean bypassAutoEncryption) {
+		this.bypassAutoEncryption = bypassAutoEncryption;
+	}
+
+	/**
+	 * @param extraOptions
+	 * @see AutoEncryptionSettings.Builder#extraOptions(Map)
+	 */
+	public void setExtraOptions(Map<String, Object> extraOptions) {
+		this.extraOptions = extraOptions;
+	}
+
+	/**
+	 * @param keyVaultNamespace
+	 * @see AutoEncryptionSettings.Builder#keyVaultNamespace(String)
+	 */
+	public void setKeyVaultNamespace(String keyVaultNamespace) {
+		this.keyVaultNamespace = keyVaultNamespace;
+	}
+
+	/**
+	 * @param keyVaultClientSettings
+	 * @see AutoEncryptionSettings.Builder#keyVaultMongoClientSettings(MongoClientSettings)
+	 */
+	public void setKeyVaultClientSettings(MongoClientSettings keyVaultClientSettings) {
+		this.keyVaultClientSettings = keyVaultClientSettings;
+	}
+
+	/**
+	 * @param kmsProviders
+	 * @see AutoEncryptionSettings.Builder#kmsProviders(Map)
+	 */
+	public void setKmsProviders(Map<String, Map<String, Object>> kmsProviders) {
+		this.kmsProviders = kmsProviders;
+	}
+
+	/**
+	 * @param schemaMap
+	 * @see AutoEncryptionSettings.Builder#schemaMap(Map)
+	 */
+	public void setSchemaMap(Map<String, BsonDocument> schemaMap) {
+		this.schemaMap = schemaMap;
+	}
+
+	/*
+	 * (non-Javadoc)
+	 * @see  org.springframework.beans.factory.FactoryBean#getObject()
+	 */
+	@Override
+	public AutoEncryptionSettings getObject() {
+
+		return AutoEncryptionSettings.builder() //
+				.bypassAutoEncryption(bypassAutoEncryption) //
+				.keyVaultNamespace(keyVaultNamespace) //
+				.keyVaultMongoClientSettings(keyVaultClientSettings) //
+				.kmsProviders(orEmpty(kmsProviders)) //
+				.extraOptions(orEmpty(extraOptions)) //
+				.schemaMap(orEmpty(schemaMap)) //
+				.build();
+	}
+
+	private <K, V> Map<K, V> orEmpty(@Nullable Map<K, V> source) {
+		return source != null ? source : Collections.emptyMap();
+	}
+
+	/*
+	 * (non-Javadoc)
+	 * @see  org.springframework.beans.factory.FactoryBean#getObjectType()
+	 */
+	@Override
+	public Class<?> getObjectType() {
+		return AutoEncryptionSettings.class;
+	}
+}

spring-data-mongodb/src/main/java/org/springframework/data/mongodb/core/schema/IdentifiableJsonSchemaProperty.java

@@ -30,7 +30,9 @@
 import org.springframework.data.mongodb.core.schema.TypedJsonSchemaObject.ObjectJsonSchemaObject;
 import org.springframework.data.mongodb.core.schema.TypedJsonSchemaObject.StringJsonSchemaObject;
 import org.springframework.data.mongodb.core.schema.TypedJsonSchemaObject.TimestampJsonSchemaObject;
+import org.springframework.lang.Nullable;
 import org.springframework.util.Assert;
+import org.springframework.util.ObjectUtils;
 
 /**
  * {@link JsonSchemaProperty} implementation.
@@ -1044,4 +1046,140 @@ public boolean isRequired() {
 			return required;
 		}
 	}
+
+	/**
+	 * {@link JsonSchemaProperty} implementation for encrypted fields.
+	 *
+	 * @author Christoph Strobl
+	 * @since 2.2
+	 */
+	public static class EncryptedJsonSchemaProperty implements JsonSchemaProperty {
+
+		private final JsonSchemaProperty targetProperty;
+		private final @Nullable String algorithm;
+		private final @Nullable String keyId;
+
+		/**
+		 * Create new instance of {@link EncryptedJsonSchemaProperty} wrapping the given {@link JsonSchemaProperty target}.
+		 *
+		 * @param target must not be {@literal null}.
+		 */
+		public EncryptedJsonSchemaProperty(JsonSchemaProperty target) {
+			this(target, null, null);
+		}
+
+		private EncryptedJsonSchemaProperty(JsonSchemaProperty target, @Nullable String algorithm, @Nullable String keyId) {
+
+			Assert.notNull(target, "Target must not be null!");
+			this.targetProperty = target;
+			this.algorithm = algorithm;
+			this.keyId = keyId;
+		}
+
+		/**
+		 * Create new instance of {@link EncryptedJsonSchemaProperty} wrapping the given {@link JsonSchemaProperty target}.
+		 *
+		 * @param target must not be {@literal null}.
+		 * @return new instance of {@link EncryptedJsonSchemaProperty}.
+		 */
+		public static EncryptedJsonSchemaProperty encrypted(JsonSchemaProperty target) {
+			return new EncryptedJsonSchemaProperty(target);
+		}
+
+		/**
+		 * Use {@literal AEAD_AES_256_CBC_HMAC_SHA_512-Random} algorithm.
+		 *
+		 * @return new instance of {@link EncryptedJsonSchemaProperty}.
+		 */
+		public EncryptedJsonSchemaProperty aead_aes_256_cbc_hmac_sha_512_random() {
+			return algorithm("AEAD_AES_256_CBC_HMAC_SHA_512-Random");
+		}
+
+		/**
+		 * Use {@literal AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic} algorithm.
+		 *
+		 * @return new instance of {@link EncryptedJsonSchemaProperty}.
+		 */
+		public EncryptedJsonSchemaProperty aead_aes_256_cbc_hmac_sha_512_deterministic() {
+			return algorithm("AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic");
+		}
+
+		/**
+		 * Use the given algorithm identified via its name.
+		 *
+		 * @return new instance of {@link EncryptedJsonSchemaProperty}.
+		 */
+		public EncryptedJsonSchemaProperty algorithm(String algorithm) {
+			return new EncryptedJsonSchemaProperty(targetProperty, algorithm, keyId);
+		}
+
+		/**
+		 * @param key
+		 * @return
+		 */
+		public EncryptedJsonSchemaProperty keyId(String keyId) {
+			return new EncryptedJsonSchemaProperty(targetProperty, algorithm, keyId);
+		}
+
+		/*
+		 * (non-Javadoc)
+		 * @see org.springframework.data.mongodb.core.schema.JsonSchemaObject#toDocument()
+		 */
+		@Override
+		public Document toDocument() {
+
+			Document doc = targetProperty.toDocument();
+			Document propertySpecification = doc.get(targetProperty.getIdentifier(), Document.class);
+
+			Document enc = new Document();
+
+			if (!ObjectUtils.isEmpty(keyId)) {
+				enc.append("keyId", keyId);
+			}
+
+			Type type = extractPropertyType(propertySpecification);
+			if (type != null) {
+
+				propertySpecification.remove(type.representation());
+				enc.append("bsonType", type.toBsonType().value()); // TODO: no samples with type -> is it bson type all the way?
+			}
+
+			enc.append("algorithm", algorithm);
+
+			propertySpecification.append("encrypt", enc);
+
+			return doc;
+		}
+
+		/*
+		 * (non-Javadoc)
+		 * @see org.springframework.data.mongodb.core.schema.JsonSchemaProperty#getIdentifier()
+		 */
+		@Override
+		public String getIdentifier() {
+			return targetProperty.getIdentifier();
+		}
+
+		/*
+		 * (non-Javadoc)
+		 * @see org.springframework.data.mongodb.core.schema.JsonSchemaObject#getTypes()
+		 */
+		@Override
+		public Set<Type> getTypes() {
+			return targetProperty.getTypes();
+		}
+
+		@Nullable
+		private Type extractPropertyType(Document source) {
+
+			if (source.containsKey("type")) {
+				return Type.of(source.get("type", String.class));
+			}
+			if (source.containsKey("bsonType")) {
+				return Type.of(source.get("bsonType", String.class));
+			}
+
+			return null;
+		}
+	}
 }