v1: client_encryption (CXX-3237, CXX-3238)#1577
Merged
eramongodb merged 6 commits intomongodb:masterfrom Feb 10, 2026
Merged
Conversation
kevinAlbs
approved these changes
Feb 10, 2026
Comment on lines
+97
to
+103
| case encrypt_options::encryption_algorithm::k_deterministic: | ||
| libmongoc::client_encryption_encrypt_opts_set_algorithm( | ||
| ptr, "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"); | ||
| break; | ||
| case encrypt_options::encryption_algorithm::k_random: | ||
| libmongoc::client_encryption_encrypt_opts_set_algorithm(ptr, "AEAD_AES_256_CBC_HMAC_SHA_512-Random"); | ||
| break; |
Collaborator
There was a problem hiding this comment.
Minor: can use the MONGOC_AEAD_AES_256_CBC_HMAC_SHA_512_DETERMINISTIC and MONGOC_AEAD_AES_256_CBC_HMAC_SHA_512_RANDOM macros. Similar comment applies to v_noabi.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves CXX-3237 and CXX-3238 for the
v1::client_encryptioncomponent.Similar to
v_noabi::options::auto_encryption(#1551),v_noabi::options::client_encryptiondoes not support direct v_noabi <-> v1 conversion due to the key vault client pointer field. However, similar tov_noabi::client(#1559), construction ofv_noabi::client_encryptionis still able to reuse the v1 implementation due to the pointer not being exposed post-construction. Therefore, v_noabi <-> v1 conversion is supported for theclient_encryptionclass (but not its options class).Due to the comparative lack of option classes (whose v_noabi -> v1 conversions would constitute unconditional deep-copy performance overhead), many v_noabi functions were able to be implemented in terms of v1. This also helped to better highlight discrepancies in v1 and v_noabi behavior concerning optional return values, where v1 unconditionally returns BSON documents even when empty, whereas v_noabi returns a null optional instead:
Following this PR, all former references to the
scoped_bson_valuehelper have been replaced withbsoncxx::v1::types::value::internal::get_bson_value(). This helper can therefore be removed. The CSFLE-specific workaround for not-null BSON type strings is now implemented by theensure_not_null_string()helper function.