Skip to content

Comments

MONGOCRYPT-432 Allow keyAltName in encryptedFieldsMap#1091

Open
mdb-ad wants to merge 42 commits intomongodb:masterfrom
mdb-ad:keyaltname
Open

MONGOCRYPT-432 Allow keyAltName in encryptedFieldsMap#1091
mdb-ad wants to merge 42 commits intomongodb:masterfrom
mdb-ad:keyaltname

Conversation

@mdb-ad
Copy link
Contributor

@mdb-ad mdb-ad commented Oct 24, 2025

Background

Adds keyAltName to keyId client-side translation to libmongocrypt that allows users to specify human-readable keyAltName strings instead of binary key IDs.

Implementation

Whenever encryptionInformation is appended to at outgoing command, libmongocrypt looks through the encrypted fields for keyAltName fields and translates them to keyId.

Testing

Tested on the C driver with spec test: https://spruce.mongodb.com/version/697803dbc0c964000764d2a4/

@mdb-ad mdb-ad marked this pull request as ready for review February 6, 2026 22:21
@mdb-ad mdb-ad requested a review from a team as a code owner February 6, 2026 22:21
@mdb-ad mdb-ad requested review from vector-of-bool and removed request for vector-of-bool February 6, 2026 22:21
@mdb-ad mdb-ad requested a review from kevinAlbs February 9, 2026 18:43
mongocrypt_status_destroy(status);
}

static void _test_qe_keyAltName(_mongocrypt_tester_t *tester) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I expect the "create" command is not translating a "keyAltName":

{
    "create": "coll",
    "encryptedFields": {
        "fields": [
            {
                "path": "secret",
                "bsonType": "string",
                "keyAltName": "keyDocumentName"
            }
        ]
    }
}

See this test to exercise this scenario.

Without support for the "create" command or ClientEncryption.createEncryptedCollection helper, I expect keyAltName may be difficult to use (creation would still require a key ID).

If this is a significant effort, consider filing a MONGOCRYPT ticket to track supporting "create", and update the scope to note this as future work.

ASSERT_OK(mongocrypt_ctx_mongo_done(ctx), ctx);
}

// MONGOCRYPT_CTX_MARKINGS is entered to send command to mongocryptd.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When mongocrypt_setopt_bypass_query_analysis is called, the MONGOCRYPT_CTX_MARKINGS state appears to be incorrectly entered. See this test.

/* If an encrypted_field_config was set, check if keys are required for
* compactionTokens. */

if (!mc_schema_broker_need_more_schemas(ectx->sb) && !_fle2_collect_keys_for_compaction(ctx)) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

_fle2_collect_keys_for_compaction requests keys by ID. I expect it will also need to request keys by keyAltName.

Suggest implementing this draft test of the compact command with keyAltname. It currently fails with:
expected UUID for key id.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants