mongodb-client-encryption

import { MongoClient, Binary } from 'mongodb'; import { ClientEncryption } from 'mongodb-client-encryption'; import * as crypto from 'crypto'; async function runEncryptionExample() { // Ensure these environment variables are set or provide default values const connectionString = process.env.MONGO_URI ?? 'mongodb://localhost:27017/'; const kmsProviderType = process.env.KMS_PROVIDER_TYPE ?? 'local'; // e.g., 'aws', 'azure', 'gcp', 'kmip', 'local' const keyVaultNamespace = process.env.KEY_VAULT_NAMESPACE ?? 'encryption.__keyVault'; let kmsProviders: any; // For a 'local' KMS provider, a 32-byte master key is required. // In a production environment, this key should be securely managed and never hardcoded. if (kmsProviderType === 'local') { const localMasterKey = process.env.LOCAL_MASTER_KEY || crypto.randomBytes(96).toString('base64'); // 96 bytes for CSFLE, per MongoDB documentation kmsProviders = { local: { key: Buffer.from(localMasterKey, 'base64').subarray(0, 32) } // Ensure it's 32 bytes for the ClientEncryptionSettings }; } else if (kmsProviderType === 'aws') { // Example for AWS KMS. Replace with actual credentials/configuration. kmsProviders = { aws: { accessKeyId: process.env.AWS_ACCESS_KEY_ID ?? 'YOUR_AWS_ACCESS_KEY_ID', secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY ?? 'YOUR_AWS_SECRET_ACCESS_KEY', region: process.env.AWS_REGION ?? 'us-east-1' } }; } else { console.error(`KMS Provider ${kmsProviderType} not supported in this example.`); return; } const client = new MongoClient(connectionString); try { await client.connect(); const encryption = new ClientEncryption(client, { keyVaultNamespace, kmsProviders } ); // IMPORTANT: In a real application, you would typically create or retrieve a Data Key ID // from your key vault (e.g., using `encryption.createDataKey()`). // For this quickstart, we'll use a placeholder UUID string for demonstration. // Make sure this is a valid UUID (BSON Binary subtype 0x04) of an actual data key in your vault. const dataKeyUuidString = process.env.DATA_KEY_UUID ?? '12345678123456781234567812345678'; // Example 16-byte hex representation for UUID const dataKeyId = new Binary(Buffer.from(dataKeyUuidString.padEnd(32, '0'), 'hex'), Binary.SUBTYPE_UUID); const dataToEncrypt = 'my highly sensitive information'; console.log('Original Data:', dataToEncrypt); // Explicitly encrypt a field const encryptedData = await encryption.encrypt(dataToEncrypt, { keyId: dataKeyId, algorithm: 'AEAD_AES256_CBC_HMAC_SHA512-Deterministic' // Or AEAD_AES256_CBC_HMAC_SHA512-Random }); console.log('Encrypted Data (BSON Binary):', encryptedData); // Explicitly decrypt the field const decryptedData = await encryption.decrypt(encryptedData); console.log('Decrypted Data:', decryptedData); } finally { await client.close(); } } runEncryptionExample().catch(console.error);