Class ClientEncryption

Create a new encryption instance创建新的加密实例

Example

new ClientEncryption(mongoClient, {
  keyVaultNamespace: 'client.encryption',
  kmsProviders: {
    local: {
      key: masterKey // The master key used for encryption/decryption. A 96-byte long Buffer
    }
  }
});
Copy

Example

new ClientEncryption(mongoClient, {
  keyVaultNamespace: 'client.encryption',
  kmsProviders: {
    aws: {
      accessKeyId: AWS_ACCESS_KEY,
      secretAccessKey: AWS_SECRET_KEY
    }
  }
});
Copy

Adds a keyAltName to a key identified by the provided _id.将keyAltName添加到由提供的_id标识的键中。

This method resolves to/returns the old key value (prior to adding the new altKeyName).此方法解析为/返回旧键值（在添加新的altKeyName之前）。

Example

// adding an keyAltName to a data key
const id = new Binary();  // id is a bson binary subtype 4 object
const keyAltName = 'keyAltName';
const oldKey = await clientEncryption.addKeyAltName(id, keyAltName);
if (!oldKey) {
 // null is returned if there is no matching document with an id matching the supplied id如果没有id与提供的id匹配的匹配文档，则返回null
}
Copy

Creates a data key used for explicit encryption and inserts it into the key vault namespace创建用于显式加密的数据键，并将其插入键保管库命名空间

Example

// Using async/await to create a local key使用async/await创建本地键
const dataKeyId = await clientEncryption.createDataKey('local');
Copy

Example

// Using async/await to create an aws key使用async/await创建aws键
const dataKeyId = await clientEncryption.createDataKey('aws', {
  masterKey: {
    region: 'us-east-1',
    key: 'xxxxxxxxxxxxxx' // CMK ARN here
  }
});
Copy

Example

// Using async/await to create an aws key with a keyAltName使用async/await创建具有keyAltName的aws键
const dataKeyId = await clientEncryption.createDataKey('aws', {
  masterKey: {
    region: 'us-east-1',
    key: 'xxxxxxxxxxxxxx' // CMK ARN here
  },
  keyAltNames: [ 'mySpecialKey' ]
});
Copy

A convenience method for creating an encrypted collection.一种创建加密集合的方便方法。This method will create data keys for any encryptedFields that do not have a keyId defined and then create a new collection with the full set of encryptedFields.此方法将为任何未定义keyId的encryptedFields创建数据键，然后使用完整的encryptidFields集创建新集合。

Throws

MongoCryptCreateDataKeyError - If part way through the process a createDataKey invocation fails, an error will be rejected that has the partial encryptedFields that were created.如果在过程的中途，createDataKey调用失败，则会拒绝一个包含已创建的部分encryptedFields的错误。

Throws

MongoCryptCreateEncryptedCollectionError - If creating the collection fails, an error will be rejected that has the entire encryptedFields that were created.如果创建集合失败，则会拒绝包含创建的整个encryptedFields的错误。

Explicitly decrypt a provided encrypted value显式解密提供的加密值

Example

// Decrypting value with async/await API
async function decryptMyValue(value) {
  return clientEncryption.decrypt(value);
}
Copy

Deletes the key with the provided id from the keyvault, if it exists.从键保管库中删除具有提供id的键（如果存在）。

Example

// delete a key by _id按_id删除键
const id = new Binary(); // id is a bson binary subtype 4 object
const { deletedCount } = await clientEncryption.deleteKey(id);

if (deletedCount != null && deletedCount > 0) {
  // successful deletion
}
Copy

Explicitly encrypt a provided value. 显式加密提供的值。Note that either options.keyId or options.keyAltName must be specified. 请注意，必须指定options.keyId或options.keyAltName。Specifying both options.keyId and options.keyAltName is considered an error.同时指定options.keyId和options.keyAltName被认为是一个错误。

Example

// Encryption with async/await api
async function encryptMyData(value) {
  const keyId = await clientEncryption.createDataKey('local');
  return clientEncryption.encrypt(value, { keyId, algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' });
}
Copy

Example

// Encryption using a keyAltName
async function encryptMyData(value) {
  await clientEncryption.createDataKey('local', { keyAltNames: 'mySpecialKey' });
  return clientEncryption.encrypt(value, { keyAltName: 'mySpecialKey', algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic' });
}
Copy

Encrypts a Match Expression or Aggregate Expression to query a range index.加密匹配表达式或聚合表达式以查询范围索引。

Only supported when queryType is "rangePreview" and algorithm is "RangePreview".仅当queryType为“rangePreview”且算法为“rangePreview“时才受支持。

The Range algorithm is experimental only. It is not intended for production use. It is subject to breaking changes.Range算法只是实验性的。它不用于生产用途。它可能会发生突破性的变化。