Interface AutoEncryptionOptions

interface AutoEncryptionOptions {
    bypassAutoEncryption?: boolean;
    bypassQueryAnalysis?: boolean;
    encryptedFieldsMap?: Document;
    extraOptions?: {
        cryptSharedLibPath?: string;
        cryptSharedLibRequired?: boolean;
        mongocryptdBypassSpawn?: boolean;
        mongocryptdSpawnArgs?: string[];
        mongocryptdSpawnPath?: string;
        mongocryptdURI?: string;
    };
    keyVaultClient?: MongoClient;
    keyVaultNamespace?: string;
    kmsProviders?: KMSProviders;
    options?: {
        logger?: ((level: AutoEncryptionLoggerLevel, message: string) => void);
    };
    proxyOptions?: ProxyOptions;
    schemaMap?: Document;
    tlsOptions?: CSFLEKMSTlsOptions;
}

Properties

bypassAutoEncryption? bypassQueryAnalysis? encryptedFieldsMap? extraOptions? keyVaultClient? keyVaultNamespace? kmsProviders? options? proxyOptions? schemaMap? tlsOptions?

Properties

OptionalbypassAutoEncryption

bypassAutoEncryption?: boolean

Allows the user to bypass auto encryption, maintaining implicit decryption

OptionalbypassQueryAnalysis

bypassQueryAnalysis?: boolean

Allows users to bypass query analysis

OptionalencryptedFieldsMap

encryptedFieldsMap?: Document

Supply a schema for the encrypted fields in the document

OptionalextraOptions

extraOptions?: {
    cryptSharedLibPath?: string;
    cryptSharedLibRequired?: boolean;
    mongocryptdBypassSpawn?: boolean;
    mongocryptdSpawnArgs?: string[];
    mongocryptdSpawnPath?: string;
    mongocryptdURI?: string;
}

Type declaration

  • OptionalcryptSharedLibPath?: string

    Full path to a MongoDB Crypt shared library to be used (instead of mongocryptd).

    This needs to be the path to the file itself, not a directory. It can be an absolute or relative path. If the path is relative and its first component is $ORIGIN, it will be replaced by the directory containing the mongodb-client-encryption native addon file. Otherwise, the path will be interpreted relative to the current working directory.

    Currently, loading different MongoDB Crypt shared library files from different MongoClients in the same process is not supported.

    If this option is provided and no MongoDB Crypt shared library could be loaded from the specified location, creating the MongoClient will fail.

    If this option is not provided and cryptSharedLibRequired is not specified, the AutoEncrypter will attempt to spawn and/or use mongocryptd according to the mongocryptd-specific extraOptions options.

    Specifying a path prevents mongocryptd from being used as a fallback.

    Requires the MongoDB Crypt shared library, available in MongoDB 6.0 or higher.

  • OptionalcryptSharedLibRequired?: boolean

    If specified, never use mongocryptd and instead fail when the MongoDB Crypt shared library could not be loaded.

    This is always true when cryptSharedLibPath is specified.

    Requires the MongoDB Crypt shared library, available in MongoDB 6.0 or higher.

  • OptionalmongocryptdBypassSpawn?: boolean

    If true, autoEncryption will not attempt to spawn a mongocryptd before connecting

  • OptionalmongocryptdSpawnArgs?: string[]

    Command line arguments to use when auto-spawning a mongocryptd

  • OptionalmongocryptdSpawnPath?: string

    The path to the mongocryptd executable on the system

  • OptionalmongocryptdURI?: string

    A local process the driver communicates with to determine how to encrypt values in a command. Defaults to "mongodb://%2Fvar%2Fmongocryptd.sock" if domain sockets are available or "mongodb://localhost:27020" otherwise

OptionalkeyVaultClient

keyVaultClient?: MongoClient

A MongoClient used to fetch keys from a key vault

OptionalkeyVaultNamespace

keyVaultNamespace?: string

The namespace where keys are stored in the key vault

OptionalkmsProviders

kmsProviders?: KMSProviders

Configuration options that are used by specific KMS providers during key generation, encryption, and decryption.

Optionaloptions

options?: {
    logger?: ((level: AutoEncryptionLoggerLevel, message: string) => void);
}

Type declaration

  • Optionallogger?: ((level: AutoEncryptionLoggerLevel, message: string) => void)

    An optional hook to catch logging messages from the underlying encryption engine

OptionalproxyOptions

proxyOptions?: ProxyOptions

OptionalschemaMap

schemaMap?: Document

A map of namespaces to a local JSON schema for encryption

NOTE: Supplying options.schemaMap provides more security than relying on JSON Schemas obtained from the server. It protects against a malicious server advertising a false JSON Schema, which could trick the client into sending decrypted data that should be encrypted. Schemas supplied in the schemaMap only apply to configuring automatic encryption for Client-Side Field Level Encryption. Other validation rules in the JSON schema will not be enforced by the driver and will result in an error.

OptionaltlsOptions

tlsOptions?: CSFLEKMSTlsOptions

The TLS options to use connecting to the KMS provider

Settings

Member Visibility

On This Page

Properties