Support text indexes with encryption #1797

rozza · 2025-09-01T09:58:38Z

Added TextPreview support for Prefix/Suffix/Substring Indexes

rozza · 2025-09-03T11:38:36Z

driver-core/src/test/functional/com/mongodb/client/test/CollectionHelper.java

        drop(namespace, writeConcern);
    }

+    public void dropAndCreate(final BsonDocument createOptions) {


This is now part of the Spec and ensures that fresh encryption collections are made. This ensures __safeContent__ values are predictable and testable.

rozza · 2025-09-03T11:39:30Z

driver-sync/src/test/functional/com/mongodb/client/unified/Entities.java

-            for (Map.Entry<String, BsonValue> entry : entity.getDocument("autoEncryptOpts").entrySet()) {
+            BsonDocument autoEncryptOpts = entity.getDocument("autoEncryptOpts");
+
+            String cryptSharedLibPath = getEnv("CRYPT_SHARED_LIB_PATH", "");


Allows the crypt shared library to be set in the env.

rozza · 2025-09-03T11:40:55Z

driver-sync/src/test/functional/com/mongodb/client/unified/RunOnRequirementsMatcher.java

                            requirementMet = false;
                            break requirementLoop;
                        }
+                        if (curRequirement.getValue().isDocument()) {


This is a change in the schema - csfle can be either: true or a document setting the minLibmongocryptVersion.

rozza · 2025-09-03T11:42:33Z

driver-sync/src/test/functional/com/mongodb/client/unified/UnifiedClientEncryptionHelper.java

                case "aws:name1":
-                    setKmsProviderProperty(kmsProviderMap, kmsProviderOptions, "accessKeyId", "AWS_ACCESS_KEY_ID");
-                    setKmsProviderProperty(kmsProviderMap, kmsProviderOptions, "secretAccessKey", "AWS_SECRET_ACCESS_KEY");
+                    // awsTemporary uses `aws` and includes a `sessionToken`.


This is a bit awkward as previously the awsTemporary was used when a session token was provided. So I'll check and see if this should be preferred in the unified version of awsTemporary.yml

rozza · 2025-09-03T11:43:03Z

driver-sync/src/test/functional/com/mongodb/client/unified/UnifiedClientEncryptionHelper.java


            BsonValue kmsValue = kmsProviderOptions.get(key);
-            if (kmsValue.isString()) {
+            if (kmsValue.isString() && !key.equals("sessionToken")) {


sessionToken values should be left as a string and not converted to bytes[]

rozza · 2025-09-03T11:46:55Z

mongodb-crypt/src/main/com/mongodb/internal/crypt/capi/MongoCryptContextImpl.java

    public State getState() {
        isTrue("open", !closed);
-        return State.fromIndex(mongocrypt_ctx_state(wrapped));
+        State state = State.fromIndex(mongocrypt_ctx_state(wrapped));


Although this hasn't been needed so far. It makes sense to check for an error state and handle if its ever flagged.

I noticed other language implementations do this check.

rozza · 2025-09-03T11:48:34Z

mongodb-crypt/src/main/com/mongodb/internal/crypt/capi/MongoCryptImpl.java

+ *   <li>Provides context creation for encryption, decryption, key management, and explicit operations.</li>
+ *   <li>Manages native resource lifecycle and error handling.</li>
+ * </ul>
+ */


The changes here are 99% refactorings, to dry up the code. This was done with the help of copilot when trying to debug some errors. I also added documentation to aid us devs when coming back to this code after a long time.

The real addition / change is the use of the mongocrypt_ctx_setopt_algorithm_text step for textPreview.

rozza · 2025-09-03T11:50:27Z

mongodb-crypt/src/main/com/mongodb/internal/crypt/capi/MongoCryptImpl.java

+            withBinaryHolder(options.getRangeOptions(),
+                    binary -> configureContext(context, () -> mongocrypt_ctx_setopt_algorithm_range(context, binary)));
+        }
+        if (options.getTextOptions() != null) {


This is the behavioral change - adds text options when using textPreview.

rozza · 2025-09-03T11:51:23Z

mongodb-crypt/src/main/com/mongodb/internal/crypt/capi/MongoExplicitEncryptOptions.java

        this.contentionFactor = builder.contentionFactor;
        this.queryType = builder.queryType;
        this.rangeOptions = builder.rangeOptions;
-        if (!(Objects.equals(algorithm, "Indexed") || Objects.equals(algorithm, "Range"))) {


The spec expects libmongocrypt to report errors. So this removes our custom error reporting. A test was updated to reflect this.

rozza · 2025-09-03T11:52:25Z

mongodb-crypt/src/test/java/com/mongodb/crypt/capi/MongoCryptTest.java


-        assertEquals("Invalid configuration, contentionFactor can only be set if algorithm is 'Indexed' or 'Range'",
-                illegalStateException.getMessage());
+        MongoCryptException exp = assertThrows(MongoCryptException.class, () -> mongoCrypt.createEncryptExpressionContext(valueToEncrypt, options));


Now this test actually reflects the test name: testRangePreviewAlgorithmIsNotSupported

Copilot

Pull Request Overview

This PR adds support for text indexes with encryption by implementing the TextPreview algorithm for queryable encryption. It includes comprehensive changes to support prefix, suffix, and substring search operations on encrypted text fields.

Added TextOptions class to define text search parameters (case sensitivity, diacritic sensitivity, and query length limits)
Extended MongoExplicitEncryptOptions to support text-specific configuration
Updated encryption validation logic and native library version requirements

Reviewed Changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
driver-core/src/main/com/mongodb/client/model/vault/TextOptions.java	New TextOptions class for configuring text encryption parameters
driver-core/src/main/com/mongodb/client/model/vault/EncryptOptions.java	Added textOptions field and updated documentation for TextPreview algorithm
mongodb-crypt/src/main/com/mongodb/internal/crypt/capi/MongoExplicitEncryptOptions.java	Added textOptions support and removed validation restrictions
mongodb-crypt/src/main/com/mongodb/internal/crypt/capi/MongoCryptImpl.java	Refactored binary handling and added text algorithm configuration
driver-sync/src/test/functional/com/mongodb/client/AbstractClientEncryptionTextExplicitEncryptionTest.java	Comprehensive test suite for text encryption functionality
mongodb-crypt/build.gradle.kts	Updated libmongocrypt version to 1.15.1
driver-core/src/test/resources/specifications	Updated specifications submodule

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

mongodb-crypt/src/main/com/mongodb/internal/crypt/capi/MongoExplicitEncryptOptions.java

mongodb-crypt/src/main/com/mongodb/internal/crypt/capi/MongoCryptImpl.java

nhachicha

LGTM, minor stuff 👍

...c/test/functional/com/mongodb/client/AbstractClientEncryptionTextExplicitEncryptionTest.java

JAVA-5851 JAVA-5903 JAVA-5924

…yptImpl.java Co-authored-by: Copilot <[email protected]>

rozza force-pushed the JAVA-5851 branch 6 times, most recently from 13f5c5d to 7832e76 Compare September 3, 2025 10:20

rozza commented Sep 3, 2025

View reviewed changes

rozza marked this pull request as ready for review September 3, 2025 11:53

rozza requested a review from a team as a code owner September 3, 2025 11:53

rozza requested review from katcharov and nhachicha and removed request for a team September 3, 2025 11:53

rozza mentioned this pull request Sep 4, 2025

build(deps): bump driver-core/src/test/resources/specifications from 5ef7b1b to 49ade88 #1798

Closed

nhachicha requested a review from Copilot September 8, 2025 09:10

Copilot AI reviewed Sep 8, 2025

View reviewed changes

nhachicha approved these changes Sep 8, 2025

View reviewed changes

rozza requested a review from nhachicha September 9, 2025 08:11

rozza and others added 4 commits September 9, 2025 13:44

Support text indexes with encryption

6234722

JAVA-5851 JAVA-5903 JAVA-5924

Update mongodb-crypt/src/main/com/mongodb/internal/crypt/capi/MongoCr…

ca31d7a

…yptImpl.java Co-authored-by: Copilot <[email protected]>

Update mongodb-crypt/src/main/com/mongodb/internal/crypt/capi/MongoCr…

19bfebe

…yptImpl.java Co-authored-by: Copilot <[email protected]>

PR updates

5764462

rozza force-pushed the JAVA-5851 branch from beaa57b to 5764462 Compare September 9, 2025 12:46

rozza merged commit 94103af into mongodb:main Sep 10, 2025
48 of 55 checks passed

Support text indexes with encryption #1797

Support text indexes with encryption #1797

Uh oh!

Conversation

rozza commented Sep 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rozza Sep 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nhachicha left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rozza commented Sep 1, 2025 •

edited

Loading

rozza Sep 3, 2025 •

edited

Loading