ClientSideEncryptionTest.java

/*
 * Copyright (c) 2008 - 2013 10gen, Inc. <http://10gen.com>
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 */

import com.mongodb.AutoEncryptionSettings;
import com.mongodb.ConnectionString;
import com.mongodb.KeyVaultEncryptionSettings;
import com.mongodb.MongoClientSettings;
import com.mongodb.client.MongoClients;
import com.mongodb.client.model.vault.DataKeyOptions;
import com.mongodb.client.vault.KeyVaults;
import org.bson.BsonDocument;
import org.bson.Document;

import java.security.SecureRandom;
import java.util.Base64;
import java.util.Map;

public class ClientSideEncryptionTest {
    public static void main(String[] args) {
        // Random 64 bytes for local master key
        var localMasterKey = new byte[96];
        new SecureRandom().nextBytes(localMasterKey);

        var kmsProviders = Map.of("local",
                Map.<String, Object>of("key", localMasterKey));
        var keyVaultNamespace = "admin.datakeys";
        var dbName = "test";
        var collName = "coll";

        var keyVaultSettings = KeyVaultEncryptionSettings.builder()
                .keyVaultMongoClientSettings(MongoClientSettings.builder()
                        .applyConnectionString(new ConnectionString("mongodb://localhost"))
                        .build())
                .keyVaultNamespace(keyVaultNamespace)
                .kmsProviders(kmsProviders)
                .build();

        var keyVault = KeyVaults.create(keyVaultSettings);
        // Might need data key options, but maybe not for "local"
        var dataKeyId = keyVault.createDataKey("local", new DataKeyOptions());
        var base64DataKeyId = Base64.getEncoder().encodeToString(dataKeyId.getData());
        var autoEncryptionSettings =
                AutoEncryptionSettings.builder()
                        .keyVaultNamespace(keyVaultNamespace)
                        .kmsProviders(kmsProviders)
                        .namespaceToLocalSchemaDocumentMap(
                                Map.of(dbName + "." + collName,
                                        // Need a schema that references the new data key
                                        BsonDocument.parse("{" +
                                                "        \"properties\": {" +
                                                "            \"encryptedField\": {" +
                                                "                \"encrypt\": {" +
                                                "                    \"keyId\": [" +
                                                "                        {" +
                                                "                            \"$binary\": {" +
                                                "                                \"base64\": \"" + base64DataKeyId + "\"," +
                                                "                                \"subType\": \"04\"" +
                                                "                            }" +
                                                "                        }" +
                                                "                    ]," +
                                                "                    \"bsonType\": \"string\"," +
                                                "                    \"algorithm\": \"AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic\"" +
                                                "                }" +
                                                "            }" +
                                                "        }," +
                                                "        \"bsonType\": \"object\"" +
                                                "    }"))
                        )
                        .build();
        var clientSettings = MongoClientSettings.builder()
                .autoEncryptionSettings(autoEncryptionSettings)
                .build();

        var client = MongoClients.create(clientSettings);
        var collection = client.getDatabase(dbName).getCollection(collName);
        collection.drop();

        collection.insertOne(new Document("encryptedField", "123456789"));

        System.out.println(collection.find().first().toJson());
    }
}