Explicit Encryption显式加密

Create a ClientEncryption Instance创建ClientEncryption实例

To use explicit encryption, you must create a ClientEncryption instance. 若要使用显式加密，必须创建ClientEncryption实例。ClientEncryption is an abstraction used across drivers and mongosh that encapsulates the Key Vault collection and KMS operations involved in explicit encryption.是一个跨驱动程序和mongosh使用的抽象，它封装了显式加密中涉及的键库集合和KMS操作。

To create a ClientEncryption instance, you must specify the following information:要创建ClientEncryption实例，必须指定以下信息：

• A MongoClient instance with access to your Key Vault collection可以访问键库集合的MongoClient实例
• The namespace of your Key Vault collection键库集合的命名空间
• A kmsProviders object configured with access to the KMS hosting your Customer Master KeykmsProviders对象配置为可以访问托管客户主键的KMS

For more ClientEncryption options, see CSFLE-Specific MongoClient Options.有关更多ClientEncryption选项，请参阅CSFLE特定的MongoClient选项。

To view code snippets that show how to create a ClientEncryption instance, see the Example section of this guide.要查看显示如何创建ClientEncryption实例的代码片段，请参阅本指南的示例部分。

Encrypt Fields in Read and Write Operations读取和写入操作中的加密字段

You must update read and write operations throughout your application such that your application encrypts fields before performing read and write operations.您必须在整个应用程序中更新读写操作，以便应用程序在执行读写操作之前对字段进行加密。

To encrypt fields, use the encrypt method of your ClientEncryption instance.要加密字段，请使用ClientEncryption实例的加密方法。

To view code snippets that show how to use the encrypt method, see the Example section of this guide.要查看显示如何使用encrypt方法的代码片段，请参阅本指南的示例”部分。

Manual Decryption手动解密

You can decrypt your encrypted fields manually or automatically when using explicit encryption.使用显式加密时，可以手动或自动解密加密字段。

To decrypt your fields manually, use the decrypt method of your ClientEncryption instance.要手动解密字段，请使用ClientEncryption实例的decrypt(解密)方法。

To view code snippets that show how to use the decrypt method, see the Example section of this guide.要查看显示如何使用decrypt方法的代码片段，请参阅本指南的示例部分。

Automatic Decryption自动解密

To decrypt your fields automatically, configure your MongoClient instance as follows:要自动解密字段，请按如下方式配置MongoClient实例：

• Specify your Key Vault collection指定键保管库集合
• Specify a kmsProviders object指定kmsProviders对象
• If you use MongoDB Community Server, set the bypassAutoEncryption option to True如果使用MongoDB Community Server，请将bypassAutoEncryption选项设置为True

To view a code snippet demonstrating how to enable automatic decryption, select the tab corresponding to your preferred language:要查看演示如何启用自动解密的代码片段，请选择与首选语言对应的选项卡：

const client = new MongoClient(connectionString, {
  useNewUrlParser: true,
  useUnifiedTopology: true,
  monitorCommands: true,
  autoEncryption: {
    keyVaultNamespace,
    kmsProviders,
    bypassAutoEncryption: true,
  },
});