SERVER-50644, SERVER-50479: Add resumable index build support for ESE by using persistent key for Sorter temp file encryption

1 files changed, 21 insertions, 6 deletions

diff --git a/src/mongo/db/storage/encryption_hooks.h b/src/mongo/db/storage/encryption_hooks.h
index f5a5db60923..c2c372d6533 100644
--- a/src/mongo/db/storage/encryption_hooks.h
+++ b/src/mongo/db/storage/encryption_hooks.h
@@ -84,16 +84,31 @@ public:
     virtual boost::filesystem::path getProtectedPathSuffix();
 
     /**
-     * Transform temp data to non-readable form before writing it to disk.
+     * Transform temporary data that has been spilled to disk into non-readable form. If dbName
+     * is specified, the database key corresponding to dbName will be used to encrypt the data.
+     * This key is persistent across process restarts. Otherwise, an ephemeral key that is only
+     * consistent for the duration of the process will be generated and used for encryption.
      */
-    virtual Status protectTmpData(
-        const uint8_t* in, size_t inLen, uint8_t* out, size_t outLen, size_t* resultLen);
+    virtual Status protectTmpData(const uint8_t* in,
+                                  size_t inLen,
+                                  uint8_t* out,
+                                  size_t outLen,
+                                  size_t* resultLen,
+                                  boost::optional<std::string> dbName);
 
     /**
-     * Tranforms temp data back to readable form, after reading from disk.
+     * Transform temporary data that has been spilled to disk back into readable form. If dbName
+     * is specified, the database key corresponding to dbName will be used to decrypt the data.
+     * This key is persistent across process restarts, so decryption will be successful even if a
+     * restart had occurred after encryption. Otherwise, an ephemeral key that can only decrypt data
+     * encrypted earlier in the current process's lifetime will be used.
      */
-    virtual Status unprotectTmpData(
-        const uint8_t* in, size_t inLen, uint8_t* out, size_t outLen, size_t* resultLen);
+    virtual Status unprotectTmpData(const uint8_t* in,
+                                    size_t inLen,
+                                    uint8_t* out,
+                                    size_t outLen,
+                                    size_t* resultLen,
+                                    boost::optional<std::string> dbName);
 
     /**
      * Inform the encryption storage system to prepare its data such that its files can be copied