Interface AutoEncryptionOptions

Hierarchy

  • AutoEncryptionOptions

Properties

bypassAutoEncryption? bypassQueryAnalysis? encryptedFieldsMap? extraOptions? keyVaultClient? keyVaultNamespace? kmsProviders? options? proxyOptions? schemaMap? tlsOptions?

Properties

Optional bypassAutoEncryption

bypassAutoEncryption?: boolean

Allows the user to bypass auto encryption, maintaining implicit decryption允许用户绕过自动加密，保持隐式解密

Optional bypassQueryAnalysis

bypassQueryAnalysis?: boolean

Allows users to bypass query analysis允许用户绕过查询分析

Optional encryptedFieldsMap

encryptedFieldsMap?: Document

Supply a schema for the encrypted fields in the document为文档中的加密字段提供架构

Optional extraOptions

extraOptions?: {
    cryptSharedLibPath?: string;
    cryptSharedLibRequired?: boolean;
    mongocryptdBypassSpawn?: boolean;
    mongocryptdSpawnArgs?: string[];
    mongocryptdSpawnPath?: string;
    mongocryptdURI?: string;
}

Type declaration

  • Optional cryptSharedLibPath?: string

    Full path to a MongoDB Crypt shared library to be used (instead of mongocryptd).要使用的MongoDB Crypt共享库的完整路径（而不是mongocrypted）。

    This needs to be the path to the file itself, not a directory.这需要是文件本身的路径，而不是目录。 It can be an absolute or relative path. If the path is relative and its first component is $ORIGIN, it will be replaced by the directory containing the mongodb-client-encryption native addon file. 它可以是绝对路径，也可以是相对路径。如果路径是相对的，并且它的第一个组件是$ORIGIN，那么它将被包含mongodb客户端加密本机插件文件的目录所取代。Otherwise, the path will be interpreted relative to the current working directory.否则，路径将相对于当前工作目录进行解释。

    Currently, loading different MongoDB Crypt shared library files from different MongoClients in the same process is not supported.目前，不支持在同一进程中从不同的MongoClients加载不同的MongoDB Crypt共享库文件。

    If this option is provided and no MongoDB Crypt shared library could be loaded from the specified location, creating the MongoClient will fail.如果提供了此选项，并且无法从指定位置加载MongoDB Crypt共享库，则创建MongoClient将失败。

    If this option is not provided and cryptSharedLibRequired is not specified, the AutoEncrypter will attempt to spawn and/or use mongocryptd according to the mongocryptd-specific extraOptions options.如果未提供此选项，并且未指定cryptSharedLibRequired，则AutoEncrypter将尝试根据mongocrypted特定的extraOptions选项生成和/或使用mongocrupted。

    Specifying a path prevents mongocryptd from being used as a fallback.指定路径可防止mongocrypted用作回退。

    Requires the MongoDB Crypt shared library, available in MongoDB 6.0 or higher.需要MongoDB Crypt共享库，可在MongoDB 6.0或更高版本中获得。

  • Optional cryptSharedLibRequired?: boolean

    If specified, never use mongocryptd and instead fail when the MongoDB Crypt shared library could not be loaded.如果指定，请不要使用mongocrypted，而是在无法加载MongoDB Crypt共享库时失败。

    This is always true when cryptSharedLibPath is specified.当指定cryptSharedLibPath时，此情况总是正确的。

    Requires the MongoDB Crypt shared library, available in MongoDB 6.0 or higher.需要MongoDB Crypt共享库，可在MongoDB 6.0或更高版本中获得。

  • Optional mongocryptdBypassSpawn?: boolean

    If true, autoEncryption will not attempt to spawn a mongocryptd before connecting如果为true，则autoEncryption在连接之前不会尝试生成mongocrypted

  • Optional mongocryptdSpawnArgs?: string[]

    Command line arguments to use when auto-spawning a mongocryptd自动生成mongocrypted时要使用的命令行参数

  • Optional mongocryptdSpawnPath?: string

    The path to the mongocryptd executable on the system系统上mongocrypted可执行文件的路径

  • Optional mongocryptdURI?: string

    A local process the driver communicates with to determine how to encrypt values in a command.驱动程序与之通信以确定如何加密命令中的值的本地进程。 Defaults to "mongodb://%2Fvar%2Fmongocryptd.sock" if domain sockets are available or "mongodb://localhost:27020" otherwise如果域套接字可用则为"mongodb://%2Fvar%2Fmongocryptd.sock"，否则为"mongodb://localhost:27020"

Optional keyVaultClient

keyVaultClient?: MongoClient

A MongoClient used to fetch keys from a key vault用于从键库中提取键的MongoClient

Optional keyVaultNamespace

keyVaultNamespace?: string

The namespace where keys are stored in the key vault键存储在键库中的命名空间

Optional kmsProviders

kmsProviders?: {
    aws?: Record<string, never> | {
        accessKeyId: string;
        secretAccessKey: string;
        sessionToken?: string;
    };
    azure?: Record<string, never> | {
        clientId: string;
        clientSecret: string;
        identityPlatformEndpoint?: string;
        tenantId: string;
    } | {
        accessToken: string;
    };
    gcp?: Record<string, never> | {
        email: string;
        endpoint?: string;
        privateKey: string | Buffer;
    } | {
        accessToken: string;
    };
    kmip?: {
        endpoint?: string;
    };
    local?: {
        key: string | Buffer;
    };
}

Configuration options that are used by specific KMS providers during key generation, encryption, and decryption.特定KMS提供程序在键生成、加密和解密过程中使用的配置选项。

Type declaration

  • Optional aws?: Record<string, never> | {
        accessKeyId: string;
        secretAccessKey: string;
        sessionToken?: string;
    }

    Configuration options for using 'aws' as your KMS provider使用“aws”作为KMS提供程序的配置选项

  • Optional azure?: Record<string, never> | {
        clientId: string;
        clientSecret: string;
        identityPlatformEndpoint?: string;
        tenantId: string;
    } | {
        accessToken: string;
    }

    Configuration options for using 'azure' as your KMS provider使用“azure”作为KMS提供程序的配置选项

  • Optional gcp?: Record<string, never> | {
        email: string;
        endpoint?: string;
        privateKey: string | Buffer;
    } | {
        accessToken: string;
    }

    Configuration options for using 'gcp' as your KMS provider将“gcp”用作KMS提供程序的配置选项

  • Optional kmip?: {
        endpoint?: string;
    }

    Configuration options for using 'kmip' as your KMS provider使用“kmip”作为KMS提供程序的配置选项

    • Optional endpoint?: string

      The output endpoint string.输出端点字符串。 The endpoint consists of a hostname and port separated by a colon.端点由一个主机名和一个用冒号分隔的端口组成。 E.g. "example.com:123". A port is always present.例如“example.com:123”。端口始终存在。

  • Optional local?: {
        key: string | Buffer;
    }

    Configuration options for using 'local' as your KMS provider使用“local”作为KMS提供程序的配置选项

    • key: string | Buffer

      The master key used to encrypt/decrypt data keys.用于加密/解密数据键的主键。 A 96-byte long Buffer or base64 encoded string.一个96字节长的Buffer或base64编码字符串。

Optional options

options?: {
    logger?: ((level, message) => void);
}

Type declaration

  • Optional logger?: ((level, message) => void)
      • (level, message): void

      • An optional hook to catch logging messages from the underlying encryption engine用于捕获来自底层加密引擎的日志消息的可选挂钩

        Parameters

        Returns void

Optional proxyOptions

proxyOptions?: ProxyOptions

Optional schemaMap

schemaMap?: Document

A map of namespaces to a local JSON schema for encryption用于加密的命名空间到本地JSON模式的映射

NOTE: Supplying options.schemaMap provides more security than relying on JSON Schemas obtained from the server.：与依赖从服务器获得的JSON架构相比，提供optionsschemaMap提供了更多的安全性。 It protects against a malicious server advertising a false JSON Schema, which could trick the client into sending decrypted data that should be encrypted.它可以防止恶意服务器发布虚假的JSON模式，这可能会诱使客户端发送应该加密的解密数据。 Schemas supplied in the schemaMap only apply to configuring automatic encryption for Client-Side Field Level Encryption.schemaMap中提供的架构仅适用于为客户端字段级加密配置自动加密。 Other validation rules in the JSON schema will not be enforced by the driver and will result in an error.JSON模式中的其他验证规则将不会由驱动程序强制执行，并将导致错误。

Optional tlsOptions

tlsOptions?: CSFLEKMSTlsOptions

The TLS options to use connecting to the KMS provider用于连接到KMS提供程序的TLS选项

Settings

Member Visibility

Theme

On This Page

Generated using TypeDoc