Skip to content

Conversation

kevinAlbs
Copy link
Contributor

Summary

Do not warn if local schema does not require encryption

Verified by this patch build: https://spruce.mongodb.com/version/679f718a7f3b450007729cee

Background & Motivation

libmongocrypt currently logs a warning if a response from query analysis (mongocryptd/crypt_shared) indicates a local schema does not require encryption. However, this log is generated even for an empty local schema. I do not expect configuring an empty local schema to be discouraged. Quoting the spec:

Drivers MUST document that a local schema is more secure

I expect this warning was intended to inform users that non-encryption JSON schema validation does not apply. However, mongocryptd already errors if a local schema is sent with JSON schema keywords that do not apply. Example:

client = MongoClient(auto_encryption_opts=opts)
client.drop_database("db")
client["db"]["coll"].insert_one({}) # Exception: JSON schema keyword 'required' is only allowed with a remote schema

Query analysis 8.1 supports a new field csfleEncryptionSchemas to accept multiple JSON Schemas. The replied schemaRequiresEncryption only indiciates if any of the sent schemas require encryption. Multiple schemas further complicates this warning check (E.g. should libmongocrypt warn if "schemaRequiresEncryption": false and all schemas are local and non-empty?).

Since the warning seems flawed and redundant with checks done in query analysis, this PR proposes removing.

Copy link
Contributor

@rcsanchez97 rcsanchez97 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@kevinAlbs kevinAlbs merged commit 6b00083 into mongodb:master Feb 4, 2025
53 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants