Skip to content

Commit 99203b3

Browse files
christophstroblmp911de
christophstrobl
authored and
mp911de
committed
Add support for deriving json schema for encrypted properties.
This commit introduces support for creating a MongoJsonSchema containing encrypted fields for a given type based on mapping metadata. Using the Encrypted annotation allows to derive required encryptMetadata and encrypt properties within a given (mapping)context. @document @Encrypted(keyId = "...") static class Patient { // ... @Encrypted(algorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic") private Integer ssn; } MongoJsonSchemaCreator schemaCreator = MongoJsonSchemaCreator.create(mappingContext); MongoJsonSchema patientSchema = schemaCreator .filter(MongoJsonSchemaCreator.encryptedOnly()) .createSchemaFor(Patient.class); Closes: #3800 Original pull request: #3801.
1 parent eda1c79 commit 99203b3

20 files changed

+1074
-22
lines changed

‎spring-data-mongodb/src/main/java/org/springframework/data/mongodb/core/EncryptionAlgorithms.java‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/*
2+
* Copyright 2021 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package org.springframework.data.mongodb.core;
17+
18+
/**
19+
* Encryption algorithms supported by MongoDB Client Side Field Level Encryption.
20+
*
21+
* @author Christoph Strobl
22+
* @since 3.3
23+
*/
24+
public final class EncryptionAlgorithms {
25+
26+
public static final String AEAD_AES_256_CBC_HMAC_SHA_512_Deterministic = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic";
27+
public static final String AEAD_AES_256_CBC_HMAC_SHA_512_Random = "AEAD_AES_256_CBC_HMAC_SHA_512-Random";
28+
29+
}

‎spring-data-mongodb/src/main/java/org/springframework/data/mongodb/core/MappingMongoJsonSchemaCreator.java‎

Lines changed: 102 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -20,24 +20,32 @@
2020
import java.util.Collections;
2121
import java.util.EnumSet;
2222
import java.util.List;
23+
import java.util.function.Predicate;
24+
import java.util.stream.Collectors;
2325

26+
import org.bson.Document;
2427
import org.springframework.data.mapping.PersistentProperty;
2528
import org.springframework.data.mapping.context.MappingContext;
2629
import org.springframework.data.mongodb.core.convert.MongoConverter;
30+
import org.springframework.data.mongodb.core.mapping.BasicMongoPersistentEntity;
31+
import org.springframework.data.mongodb.core.mapping.Encrypted;
2732
import org.springframework.data.mongodb.core.mapping.Field;
2833
import org.springframework.data.mongodb.core.mapping.MongoPersistentEntity;
2934
import org.springframework.data.mongodb.core.mapping.MongoPersistentProperty;
35+
import org.springframework.data.mongodb.core.schema.IdentifiableJsonSchemaProperty.EncryptedJsonSchemaProperty;
3036
import org.springframework.data.mongodb.core.schema.IdentifiableJsonSchemaProperty.ObjectJsonSchemaProperty;
3137
import org.springframework.data.mongodb.core.schema.JsonSchemaObject;
3238
import org.springframework.data.mongodb.core.schema.JsonSchemaObject.Type;
3339
import org.springframework.data.mongodb.core.schema.JsonSchemaProperty;
3440
import org.springframework.data.mongodb.core.schema.MongoJsonSchema;
3541
import org.springframework.data.mongodb.core.schema.MongoJsonSchema.MongoJsonSchemaBuilder;
3642
import org.springframework.data.mongodb.core.schema.TypedJsonSchemaObject;
43+
import org.springframework.lang.Nullable;
3744
import org.springframework.util.Assert;
3845
import org.springframework.util.ClassUtils;
3946
import org.springframework.util.CollectionUtils;
4047
import org.springframework.util.ObjectUtils;
48+
import org.springframework.util.StringUtils;
4149

4250
/**
4351
* {@link MongoJsonSchemaCreator} implementation using both {@link MongoConverter} and {@link MappingContext} to obtain
@@ -52,6 +60,7 @@ class MappingMongoJsonSchemaCreator implements MongoJsonSchemaCreator {
5260

5361
private final MongoConverter converter;
5462
private final MappingContext<MongoPersistentEntity<?>, MongoPersistentProperty> mappingContext;
63+
private final Predicate<JsonSchemaPropertyContext> filter;
5564

5665
/**
5766
* Create a new instance of {@link MappingMongoJsonSchemaCreator}.
@@ -61,10 +70,24 @@ class MappingMongoJsonSchemaCreator implements MongoJsonSchemaCreator {
6170
@SuppressWarnings("unchecked")
6271
MappingMongoJsonSchemaCreator(MongoConverter converter) {
6372

73+
this(converter, (MappingContext<MongoPersistentEntity<?>, MongoPersistentProperty>) converter.getMappingContext(),
74+
(property) -> true);
75+
}
76+
77+
@SuppressWarnings("unchecked")
78+
MappingMongoJsonSchemaCreator(MongoConverter converter,
79+
MappingContext<MongoPersistentEntity<?>, MongoPersistentProperty> mappingContext,
80+
Predicate<JsonSchemaPropertyContext> filter) {
81+
6482
Assert.notNull(converter, "Converter must not be null!");
6583
this.converter = converter;
66-
this.mappingContext = (MappingContext<MongoPersistentEntity<?>, MongoPersistentProperty>) converter
67-
.getMappingContext();
84+
this.mappingContext = mappingContext;
85+
this.filter = filter;
86+
}
87+
88+
@Override
89+
public MongoJsonSchemaCreator filter(Predicate<JsonSchemaPropertyContext> filter) {
90+
return new MappingMongoJsonSchemaCreator(converter, mappingContext, filter);
6891
}
6992

7093
/*
@@ -77,11 +100,29 @@ public MongoJsonSchema createSchemaFor(Class<?> type) {
77100
MongoPersistentEntity<?> entity = mappingContext.getRequiredPersistentEntity(type);
78101
MongoJsonSchemaBuilder schemaBuilder = MongoJsonSchema.builder();
79102

103+
{
104+
Encrypted encrypted = entity.findAnnotation(Encrypted.class);
105+
if (encrypted != null) {
106+
107+
Document encryptionMetadata = new Document();
108+
109+
Collection<Object> encryptionKeyIds = entity.getEncryptionKeyIds();
110+
if (!CollectionUtils.isEmpty(encryptionKeyIds)) {
111+
encryptionMetadata.append("keyId", encryptionKeyIds);
112+
}
113+
114+
if (StringUtils.hasText(encrypted.algorithm())) {
115+
encryptionMetadata.append("algorithm", encrypted.algorithm());
116+
}
117+
118+
schemaBuilder.encryptionMetadata(encryptionMetadata);
119+
}
120+
}
121+
80122
List<JsonSchemaProperty> schemaProperties = computePropertiesForEntity(Collections.emptyList(), entity);
81123
schemaBuilder.properties(schemaProperties.toArray(new JsonSchemaProperty[0]));
82124

83125
return schemaBuilder.build();
84-
85126
}
86127

87128
private List<JsonSchemaProperty> computePropertiesForEntity(List<MongoPersistentProperty> path,
@@ -93,6 +134,11 @@ private List<JsonSchemaProperty> computePropertiesForEntity(List<MongoPersistent
93134

94135
List<MongoPersistentProperty> currentPath = new ArrayList<>(path);
95136

137+
if (!filter.test(new PropertyContext(
138+
currentPath.stream().map(PersistentProperty::getName).collect(Collectors.joining(".")), nested))) {
139+
continue;
140+
}
141+
96142
if (path.contains(nested)) { // cycle guard
97143
schemaProperties.add(createSchemaProperty(computePropertyFieldName(CollectionUtils.lastElement(currentPath)),
98144
Object.class, false));
@@ -120,15 +166,38 @@ private JsonSchemaProperty computeSchemaForProperty(List<MongoPersistentProperty
120166

121167
String fieldName = computePropertyFieldName(property);
122168

169+
JsonSchemaProperty schemaProperty;
123170
if (property.isCollectionLike()) {
124-
return createSchemaProperty(fieldName, targetType, required);
171+
schemaProperty = createSchemaProperty(fieldName, targetType, required);
125172
} else if (property.isMap()) {
126-
return createSchemaProperty(fieldName, Type.objectType(), required);
173+
schemaProperty = createSchemaProperty(fieldName, Type.objectType(), required);
127174
} else if (ClassUtils.isAssignable(Enum.class, targetType)) {
128-
return createEnumSchemaProperty(fieldName, targetType, required);
175+
schemaProperty = createEnumSchemaProperty(fieldName, targetType, required);
176+
} else {
177+
schemaProperty = createSchemaProperty(fieldName, targetType, required);
129178
}
130179

131-
return createSchemaProperty(fieldName, targetType, required);
180+
return applyEncryptionDataIfNecessary(property, schemaProperty);
181+
}
182+
183+
@Nullable
184+
private JsonSchemaProperty applyEncryptionDataIfNecessary(MongoPersistentProperty property,
185+
JsonSchemaProperty schemaProperty) {
186+
187+
Encrypted encrypted = property.findAnnotation(Encrypted.class);
188+
if (encrypted == null) {
189+
return schemaProperty;
190+
}
191+
192+
EncryptedJsonSchemaProperty enc = new EncryptedJsonSchemaProperty(schemaProperty);
193+
if (StringUtils.hasText(encrypted.algorithm())) {
194+
enc = enc.algorithm(encrypted.algorithm());
195+
}
196+
if (!ObjectUtils.isEmpty(encrypted.keyId())) {
197+
enc = enc.keys(property.getEncryptionKeyIds());
198+
}
199+
return enc;
200+
132201
}
133202

134203
private JsonSchemaProperty createObjectSchemaPropertyForEntity(List<MongoPersistentProperty> path,
@@ -207,4 +276,30 @@ static JsonSchemaProperty createPotentiallyRequiredSchemaProperty(JsonSchemaProp
207276

208277
return JsonSchemaProperty.required(property);
209278
}
279+
280+
class PropertyContext implements JsonSchemaPropertyContext {
281+
282+
private String path;
283+
private MongoPersistentProperty property;
284+
285+
public PropertyContext(String path, MongoPersistentProperty property) {
286+
this.path = path;
287+
this.property = property;
288+
}
289+
290+
@Override
291+
public String getPath() {
292+
return path;
293+
}
294+
295+
@Override
296+
public MongoPersistentProperty getProperty() {
297+
return property;
298+
}
299+
300+
@Override
301+
public <T> MongoPersistentEntity<T> resolveEntity(MongoPersistentProperty property) {
302+
return (MongoPersistentEntity<T>) mappingContext.getPersistentEntity(property);
303+
}
304+
}
210305
}

‎spring-data-mongodb/src/main/java/org/springframework/data/mongodb/core/MongoJsonSchemaCreator.java‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,23 @@
1515
*/
1616
package org.springframework.data.mongodb.core;
1717

18+
import java.util.HashSet;
19+
import java.util.Set;
20+
import java.util.function.Predicate;
21+
22+
import org.springframework.data.mapping.PersistentProperty;
23+
import org.springframework.data.mapping.context.MappingContext;
24+
import org.springframework.data.mongodb.core.convert.MappingMongoConverter;
1825
import org.springframework.data.mongodb.core.convert.MongoConverter;
26+
import org.springframework.data.mongodb.core.convert.MongoCustomConversions;
27+
import org.springframework.data.mongodb.core.convert.NoOpDbRefResolver;
28+
import org.springframework.data.mongodb.core.mapping.Encrypted;
29+
import org.springframework.data.mongodb.core.mapping.MongoMappingContext;
30+
import org.springframework.data.mongodb.core.mapping.MongoPersistentEntity;
31+
import org.springframework.data.mongodb.core.mapping.MongoPersistentProperty;
32+
import org.springframework.data.mongodb.core.mapping.MongoSimpleTypes;
33+
import org.springframework.data.mongodb.core.mapping.Unwrapped.Nullable;
34+
import org.springframework.data.mongodb.core.schema.JsonSchemaProperty;
1935
import org.springframework.data.mongodb.core.schema.MongoJsonSchema;
2036
import org.springframework.util.Assert;
2137

@@ -46,6 +62,7 @@
4662
* {@link org.bson.types.ObjectId} like {@link String} will be mapped to {@code type : 'object'} unless there is more
4763
* specific information available via the {@link org.springframework.data.mongodb.core.mapping.MongoId} annotation.
4864
* </p>
65+
* {@link Encrypted} properties will contain {@literal encrypt} information.
4966
*
5067
* @author Christoph Strobl
5168
* @since 2.2
@@ -60,6 +77,88 @@ public interface MongoJsonSchemaCreator {
6077
*/
6178
MongoJsonSchema createSchemaFor(Class<?> type);
6279

80+
/**
81+
* Filter matching {@link JsonSchemaProperty properties}.
82+
*
83+
* @param filter the {@link Predicate} to evaluate for inclusion. Must not be {@literal null}.
84+
* @return new instance of {@link MongoJsonSchemaCreator}.
85+
* @since 3.3
86+
*/
87+
MongoJsonSchemaCreator filter(Predicate<JsonSchemaPropertyContext> filter);
88+
89+
/**
90+
* The context in which a specific {@link #getProperty()} is encountered during schema creation.
91+
*
92+
* @since 3.3
93+
*/
94+
interface JsonSchemaPropertyContext {
95+
96+
/**
97+
* The path to a given field/property in dot notation.
98+
*
99+
* @return never {@literal null}.
100+
*/
101+
String getPath();
102+
103+
/**
104+
* The current property.
105+
*
106+
* @return never {@literal null}.
107+
*/
108+
MongoPersistentProperty getProperty();
109+
110+
/**
111+
* Obtain the {@link MongoPersistentEntity} for a given property.
112+
*
113+
* @param property must not be {@literal null}.
114+
* @param <T>
115+
* @return {@literal null} if the property is not an entity. It is nevertheless recommend to check
116+
* {@link PersistentProperty#isEntity()} first.
117+
*/
118+
@Nullable
119+
<T> MongoPersistentEntity<T> resolveEntity(MongoPersistentProperty property);
120+
121+
}
122+
123+
/**
124+
* A filter {@link Predicate} that matches {@link Encrypted encrypted properties} and those having nested ones.
125+
*
126+
* @return new instance of {@link Predicate}.
127+
* @since 3.3
128+
*/
129+
static Predicate<JsonSchemaPropertyContext> encryptedOnly() {
130+
131+
return new Predicate<JsonSchemaPropertyContext>() {
132+
133+
// cycle guard
134+
private final Set<MongoPersistentProperty> seen = new HashSet<>();
135+
136+
@Override
137+
public boolean test(JsonSchemaPropertyContext context) {
138+
return extracted(context.getProperty(), context);
139+
}
140+
141+
private boolean extracted(MongoPersistentProperty property, JsonSchemaPropertyContext context) {
142+
if (property.isAnnotationPresent(Encrypted.class)) {
143+
return true;
144+
}
145+
146+
if (!property.isEntity() || seen.contains(property)) {
147+
return false;
148+
}
149+
150+
seen.add(property);
151+
152+
for (MongoPersistentProperty nested : context.resolveEntity(property)) {
153+
if (extracted(nested, context)) {
154+
return true;
155+
}
156+
}
157+
return false;
158+
}
159+
};
160+
}
161+
63162
/**
64163
* Creates a new {@link MongoJsonSchemaCreator} that is aware of conversions applied by the given
65164
* {@link MongoConverter}.
@@ -72,4 +171,41 @@ static MongoJsonSchemaCreator create(MongoConverter mongoConverter) {
72171
Assert.notNull(mongoConverter, "MongoConverter must not be null!");
73172
return new MappingMongoJsonSchemaCreator(mongoConverter);
74173
}
174+
175+
/**
176+
* Creates a new {@link MongoJsonSchemaCreator} that is aware of type mappings and potential
177+
* {@link org.springframework.data.spel.spi.EvaluationContextExtension extensions}.
178+
*
179+
* @param mappingContext must not be {@literal null}.
180+
* @return new instance of {@link MongoJsonSchemaCreator}.
181+
* @since 3.3
182+
*/
183+
static MongoJsonSchemaCreator create(MappingContext mappingContext) {
184+
185+
MappingMongoConverter converter = new MappingMongoConverter(NoOpDbRefResolver.INSTANCE, mappingContext);
186+
converter.setCustomConversions(MongoCustomConversions.create(config -> {}));
187+
converter.afterPropertiesSet();
188+
189+
return create(converter);
190+
}
191+
192+
/**
193+
* Creates a new {@link MongoJsonSchemaCreator} that does not consider potential extensions - suitable for testing. We
194+
* recommend to use {@link #create(MappingContext)}.
195+
*
196+
* @return new instance of {@link MongoJsonSchemaCreator}.
197+
* @since 3.3
198+
*/
199+
static MongoJsonSchemaCreator create() {
200+
201+
MongoMappingContext mappingContext = new MongoMappingContext();
202+
mappingContext.setSimpleTypeHolder(MongoSimpleTypes.HOLDER);
203+
mappingContext.afterPropertiesSet();
204+
205+
MappingMongoConverter converter = new MappingMongoConverter(NoOpDbRefResolver.INSTANCE, mappingContext);
206+
converter.setCustomConversions(MongoCustomConversions.create(config -> {}));
207+
converter.afterPropertiesSet();
208+
209+
return create(converter);
210+
}
75211
}

0 commit comments

Comments
 (0)