1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
// Test restrictions on createIndexes if indexing on encrypted fields
/**
* @tags: [
* assumes_unsharded_collection
* ]
*/
load("jstests/fle2/libs/encrypted_client_util.js");
(function() {
'use strict';
let dbTest = db.getSiblingDB('create_encrypted_indexes_db');
dbTest.basic.drop();
const sampleEncryptedFields = {
"fields": [
{
"path": "firstName",
"keyId": UUID("11d58b8a-0c6c-4d69-a0bd-70c6d9befae9"),
"bsonType": "string",
"queries": {"queryType": "equality"} // allow single object or array
},
{
"path": "paymentMethods.creditCards.number",
"keyId": UUID("12341234-1234-1234-1234-123412341234"),
"bsonType": "string",
"queries": {"queryType": "equality"}
},
]
};
let res = null;
res = dbTest.createCollection("basic", {encryptedFields: sampleEncryptedFields});
assert.commandWorked(res);
// Test create TTL index fails on encrypted collection
res = dbTest.basic.createIndex({"firstName": 1}, {expireAfterSeconds: 10});
assert.commandFailedWithCode(res, 6346501, "Create TTL index on encrypted collection passed");
// Test create unique index fails on encrypted field
res = dbTest.basic.createIndex({"firstName": 1}, {unique: true});
assert.commandFailedWithCode(res, 6346502, "Create unique index on encrypted field passed");
// Test create unique index fails on a prefix of an encrypted field
res = dbTest.basic.createIndex({"paymentMethods.creditCards": 1}, {unique: true});
assert.commandFailedWithCode(
res, 6346502, "Create unique index on prefix of encrypted field passed");
// Test create unique index fails if prefix is an encrypted field
res = dbTest.basic.createIndex({"paymentMethods.creditCards.number.lastFour": 1}, {unique: true});
assert.commandFailedWithCode(
res, 6346502, "Create unique index on key with encrypted field prefix passed");
// Test create single-field index on an encrypted field or prefix of an encrypted field fails.
res = dbTest.basic.createIndex({"firstName": 1});
assert.commandFailedWithCode(res, 6346502, "Create index on prefix of encrypted field passed");
res = dbTest.basic.createIndex({"paymentMethods.creditCards": 1});
assert.commandFailedWithCode(res, 6346502, "Create index on prefix of encrypted field passed");
res = dbTest.basic.createIndex({"firstName.$**": 1});
assert.commandFailedWithCode(
res, 6346502, "Create wildcard index on prefix of encrypted field passed");
// Test that a compound index cannot contain an encrypted field.
res = dbTest.basic.createIndex({"notEncrypted": 1, "paymentMethods.creditCards": 1});
assert.commandFailedWithCode(res, 6346502, "Create compound index on encrypted field passed");
// The index key may share a prefix with an encrypted field.
assert.commandWorked(dbTest.basic.createIndex({"paymentMethods.creditCards.notNumber": 1}));
// A wildcard index on the entire document is allowed.
assert.commandWorked(dbTest.basic.createIndex({"$**": 1}));
}());
|
