Supported Operations for Queryable Encryption支持的可查询加密操作

Operations Using BinData使用BinData的操作

MongoDB stores Queryable Encryption encrypted fields as a BinData blob. MongoDB将可查询加密字段存储为BinData blob。Read and write operations issued against the encrypted BinData value may have unexpected or incorrect behavior as compared to issuing that same operation against the decrypted value. 与对解密值发出相同的操作相比，对加密的BinData值发出的读写操作可能具有意外或不正确的行为。Certain operations have strict BSON type support where issuing them against a BinData value returns an error.某些操作具有严格的BSON类型支持，对BinData值发出这些操作会返回错误。

Official drivers compatible with Queryable Encryption parse read and write operations for operators or expressions that don't support BinData values.与Queryable Encryption兼容的官方驱动程序解析不支持BinData值的运算符或表达式的读写操作。

Supported and Unsupported BSON Types支持和不支持的BSON类型

Queryable Encryption supports equality queries against all BSON types except for the following:可查询加密支持对所有BSON类型的相等性查询，但以下类型除外：

• double
• decimal128
• object
• array

Queryable Encryption supports range queries against the following BSON types:可查询加密支持对以下BSON类型的范围查询：

• int: 32-bit integer：32位整数
• long: 64-bit integer：64位整数
• double: Double (IEEE 754 Binary64)：双精度（IEEE 754 Binary64）
• decimal: Decimal (IEEE 754 Decimal128)：十进制（IEEE 754十进制128）
• date: UTC DateTime (Int64)：UTC日期时间（Int64）

CRUD

• Queryable Encryption doesn't support multi-document update or delete operations. 可查询加密不支持多文档更新或删除操作。db.collection.updateMany() and db.collection.bulkWrite() with more than one update or delete operation aren't supported.

• Queryable Encryption limits db.collection.findAndModify() arguments.

  • fields is not allowed
  • new must be false
• When performing an upsert operation, any encrypted fields in the filter are excluded from the insert.

Supported Read and Write Commands

Queryable Encryption compatible drivers support automatic encryption with the following commands:

• aggregate
• count
• delete
• explain
• find
• findAndModify
• insert
• update

For any supported command, the drivers return an error if the command uses an unsupported operator, aggregation stage, or aggregation expression. For a complete list of the supported operators, stages, and expressions, see the following sections:

• Supported Query Operators
• Supported Update Operators
• Supported Aggregation Stages
• Supported Aggregation Expressions

The following commands do not require automatic encryption. Official drivers configured for automatic encryption pass these commands directly to the mongod:

• getMore [1]
• authenticate
• hello
• logout
• abortTransaction
• commitTransaction
• endSessions
• startSession
• create
• createIndexes
• drop
• dropDatabase
• dropIndexes
• killCursors
• listCollections
• listDatabases
• listIndexes
• renameCollection
• ping

Issuing any other command through a compatible driver configured for automatic encryption returns an error.

Supported Query Operators支持的查询运算符

Drivers configured for automatic encryption support a limited set of query operators when issued against an encrypted queryable field.

Querying non-encrypted fields or encrypted fields with a supported query type returns encrypted data that is then decrypted at the client.

Queryable Encryption currently supports the following query types:可查询加密目前支持以下查询类型：

• none
• equality
• range
• prefix
• suffix
• substring

If the query type is unspecified, it defaults to none. If the query type is none, MongoDB encrypts the field, and clients can't query it.

{$expr: {$eq: ["$encrypted1", "plaintext_value"]}}

{$expr: {$eq: ["$encrypted1", "$encrypted2"]}}

Fields configured for queryType: "equality" support the following expressions:

• $eq
• $ne
• $in
• $nin
• $and
• $or
• $not
• $nor
• $expr
• $exists

Fields configured for queryType: "range" support the following expressions:

• $lt
• $lte
• $gt
• $gte
• $and
• $exists

Queries specifying any other query operator against an encrypted field return an error.

Supported Update Operators

Drivers configured for automatic encryption support the following update operators when issued against encrypted fields:

• $set
• $unset

Updates specifying any other update operator against an encrypted field return an error.

Update operations with the following behavior throw an error, even if using a supported operator:

• The update operation produces an array inside of an encrypted path.
• The update operation uses aggregation expression syntax.

For update operations specifying a query filter on encrypted fields, the query filter must use only supported operators on those fields.

Replacement-style Updates

Replacement-style updates are supported, however, if the replacement document contains a Timestamp(0,0) inside a top-level encrypted field, Queryable Encryption will error. The (0,0) value indicates that the mongod should generate the Timestamp. mongod cannot generate encrypted fields.

Unsupported Insert Operations

Compatible drivers configured for automatic encryption do not support insert commands with the following behavior:

• Inserting a document with Timestamp(0,0) associated to an encrypted field. The (0,0) value indicates that the mongod should generate the Timestamp. Since the mongod cannot generate encrypted fields, the resulting timestamp would be unencrypted.

Unsupported Aggregation Stages

Automatic encryption will not support aggregation stages that read from or write to additional collections. These stages are:

• $out
• $merge

Supported Aggregation Stages

Compatible drivers configured for automatic encryption support the following aggregation pipeline stages:

• $addFields
• $bucket
• $bucketAuto
• $collStats
• $count
• $geoNear
• $graphLookup (For usage requirements, see $lookup and $graphLookup Behavior)
• $group on unencrypted fields
• $indexStats
• $limit
• $lookup (For usage requirements, see $lookup and $graphLookup Behavior)
• $match
• $project
• $redact
• $replaceRoot
• $sample
• $skip
• $sort
• $sortByCount
• $unwind

Aggregation pipelines operating on collections configured for automatic encryption that specify any other stage return an error.

For each supported pipeline stage, MongoDB tracks fields that must be encrypted as they pass through the supported pipelines and marks them for encryption.

Each supported stage must specify only supported query operators and aggregation expressions.

Supported Aggregation Expressions支持的聚合表达式

Compatible drivers configured for automatic encryption support the following expressions against encrypted fields configured for equality queries:为自动加密配置的兼容驱动程序支持针对为相等查询配置的加密字段的以下表达式：

• $cond
• $eq
• $ifNull
• $in
• $let
• $literal
• $ne
• $switch

Compatible drivers configured for automatic encryption support the following expressions against encrypted fields configured for prefix, suffix, or substring queries:针对为prefix、suffix或substring查询配置的加密字段，配置为自动加密的兼容驱动程序支持以下表达式：

• $encStrStartsWith
• $encStrEndsWith
• $encStrContains
• $encStrNormalizedEq

All other aggregation expressions return an error if issued against encrypted fields.如果针对加密字段发出所有其他聚合表达式，则返回错误。

Aggregation stages with the following behavior return an error, even if using a supported aggregation expression:即使使用支持的聚合表达式，具有以下行为的聚合阶段也会返回错误：

$addFields : {
  "valueWithUnknownEncryption" : {
    $cond : {
      if : { "$encryptedField" : "value" },
      then : "$encryptedField",
      else: "unencryptedValue"
    }
  }
},
{
  $match : {
    "valueWithUnknownEncryption" : "someNewValue"
  }
}

{
  $eq : [
    {"newField" : "$encryptedField"},
    {"newField" : "value"
  ]
}

{ $eq : [ "$prefixOfEncryptedField" , "value"] }

{
  $eq : [
      "$encryptedField" ,
      { $ne : [ "field", "value" ] }
  ]
}

{
  $let: {
    "vars" : {
      "newVariable" : "$encryptedField"
    }
  }
}

{
  $in : [
    "$encryptedField" ,
    "$otherEncryptedField"
  ]
}

Unsupported Field Types不支持的字段类型

Drivers configured for automatic encryption do not support any read or write operation that requires encrypting the following value types:为自动加密配置的驱动程序不支持任何需要加密以下值类型的读取或写入操作：

• MaxKey
• MinKey
• null
• undefined

Queryable Encryption does not adequately hide the type information for these values.可查询加密不能充分隐藏这些值的类型信息。

Queryable Encryption does not support automatic encryption on fields within an array of documents.可查询加密不支持对文档数组中的字段进行自动加密。

Queryable Encryption does not support read or write operations on an encrypted field where the operation compares the encrypted field to the following value types:可查询加密不支持对加密字段进行读取或写入操作，该操作将加密字段与以下值类型进行比较：

• array
• decimal128
• double
• object