Query failed with error csfle \"analyze_query\" failed: Access to variable ROOT disallowed [Error 2, code 31127]

Working with Data Drivers
, , ,
1

Hi, I get this error on the following query:
Note: punches collection is NOT encrypted nor has any encrypted CSLFE,
I have another collection with CSLFE Query encryption fields

query:


punches.aggregate([ { '$match': { '$and': [ { profileId: { '$in': [ new ObjectId('65a824c94528792470c0edf6'), new ObjectId('65a824cb4528792470c0ee5a'), new ObjectId('65a824d24528792470c0f01d'), new ObjectId('65a824d34528792470c0f053'), new ObjectId('65a824d44528792470c0f073'), new ObjectId('65a824d54528792470c0f0a2') ] } } ] } }, { '$match': { organizationId: new ObjectId('6507ae62881ea4139434fe9c'), punchDateTime: { '$gte': 2023-01-30T00:00:00.000Z, '$lte': 2024-01-30T00:00:00.000Z } } }, { '$skip': 0 }, { '$limit': 4000 }, { '$group': { _id: '$deviceCode', latestDocument: { '$first': '$$ROOT' } } }, { '$replaceRoot': { newRoot: '$latestDocument' } }, { '$sort': { deviceCode: 1, 'name.text': 1 } }], { allowDiskUse: true })

error:

MongoCryptError: csfle "analyze_query" failed: Access to variable ROOT disallowed [Error 2, code 31127]
    at StateMachine.execute (D:\backend\node_modules\mongodb\src\client-side-encryption\state_machine.ts:271:13)
    at processTicksAndRejections (node:internal/process/task_queues:95:5) {stack: 'MongoCryptError: csfle "analyze_query" failed…ions (node:internal/process/task_queues:95:5)', message: 'csfle "analyze_query" failed: Access to variable ROOT disallowed [Error 2, code 31127]', Symbol(errorLabels): Set(0)}

to get a simpler look at the pipeline:

pipelines [
  {
    '$match': {
      organizationId: new ObjectId('6507ae62881ea4139434fe9c'),
      punchDateTime: {
        '$gte': 2023-01-30T00:00:00.000Z,
        '$lte': 2024-01-30T00:00:00.000Z
      }
    }
  },
  { '$skip': 0 },
  { '$limit': 4000 },
  {
    '$group': { _id: '$deviceCode', latestDocument: { '$first': '$$ROOT' } }
  },
  { '$replaceRoot': { newRoot: '$latestDocument' } },
  { '$sort': { deviceCode: 1, 'name.text': 1 } }
]
2

Just for your info, I am using NodeJS driver and if I add the stages manually in Compass, it is working

3

Hi @Mehran_Ishanian2,

Welcome to the MongoDB Community :sparkles:

Could you please double-check that you are running this query on the encrypted collection? Because looking at the error it seems you are running on the encrypted field.

While executing the above aggregation query {'$group': { _id: '$deviceCode', latestDocument: { '$first': '$$ROOT' } } }, you are receiving the error because the $$ROOT and $$CURENT are both currently unavailable when using field-level encryption. This is because the encrypted field mappings would have the effect of projecting encrypted values into new field paths that are inconsistent with the existing key mappings, due to which you will not be able to decrypt the field in the new document shape.

I hope it helps. Please let us know if you have any additional questions or concerns regarding the above details.

Best regards,
Kushagra

4

Dear @Kushagra_Kesav ,
Thanks for your response, I confirm that punches in not encrypted and does not have any encrypted fields and that’s why was very strange. I think analyze_query, check all of the queries, despite of if it is related to the encryption or not if “the connection to the db is encrypted”