튜토리얼: Mongoose 사용한 Queryable Encryption

mkdir mongoose-qe-appcd mongoose-qe-appnpm init -ynpm pkg set main="queryable-encryption-tutorial.js"npm pkg set type="module"npm pkg set scripts.start="node queryable-encryption-tutorial.js"npm i mongoose mongodb dotenv mongodb-client-encryption

# MongoDB Connection URI and Shared Library Path
MONGODB_URI="<connection URI>"SHARED_LIB_PATH="<Automatic Encryption Shared Library path>"
# AWS Credentials
AWS_ACCESS_KEY_ID="<Your AWS access key ID>"AWS_SECRET_ACCESS_KEY="<Your AWS secret access key>"AWS_KEY_REGION="<Your AWS key region>"AWS_KEY_ARN="<Your AWS key ARN>"
# Azure Credentials
AZURE_TENANT_ID="<Your Azure tenant ID>"AZURE_CLIENT_ID="<Your Azure client ID>"AZURE_CLIENT_SECRET="<Your Azure client secret>"AZURE_KEY_NAME="<Your Azure key name>"AZURE_KEY_VERSION="<Your Azure key version>"AZURE_KEY_VAULT_ENDPOINT="<Your Azure key vault endpoint>"
# GCP Credentials
GCP_EMAIL="<Your GCP email>"GCP_PRIVATE_KEY="<Your GCP private key>"
GCP_PROJECT_ID="<Your GCP project ID>"GCP_LOCATION="<Your GCP location>"GCP_KEY_RING="<Your GCP key ring>"GCP_KEY_NAME="<Your GCP key name>"GCP_KEY_VERSION="<Your GCP key version>"
# KMIP Credentials 
KMIP_KMS_ENDPOINT="<Endpoint for your KMIP KMS>"KMIP_TLS_CA_FILE="<Full path to your KMIP certificate authority file>"KMIP_TLS_CERT_FILE="<Full path to your client certificate file>"

import 'dotenv/config';import mongoose from 'mongoose';import * as qeHelper from './queryable-encryption-helpers.js';import { MongoClient, ClientEncryption } from 'mongodb';
async function runExample() {
  // Paste initial application variables below
  // Paste credential and options variables below
  // Paste connection and client configuration below
  // Paste data key creation code below
  // Paste encryption schema below
  // Paste the model below
  // Paste connection code below
  // Paste the insertion operation below
  // Paste the encrypted query below
  await connection.close();  console.log('Connection closed.');}
runExample().catch(console.dir);

import 'dotenv/config';import { writeFileSync, readFileSync, existsSync } from 'fs';import { randomBytes } from 'crypto';
export async function dropExistingDatabase(client, databaseName) {  const database = client.db(databaseName);  await database.dropDatabase();}
// Paste helper methods below

const kmsProviderName = '<KMS provider>';
const uri = process.env.MONGODB_URI; // Your connection URI
const keyVaultDatabaseName = 'encryption';const keyVaultCollectionName = '__keyVault';const keyVaultNamespace = `${keyVaultDatabaseName}.${keyVaultCollectionName}`;const encryptedDatabaseName = 'medicalRecords';const encryptedCollectionName = 'patients';

export function getKMSProviderCredentials(kmsProviderName) {  let kmsProviders;  switch (kmsProviderName) {    case 'aws':      kmsProviders = {        aws: {          accessKeyId: process.env.AWS_ACCESS_KEY_ID, // Your AWS access key ID          secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY, // Your AWS secret access key        },      };      return kmsProviders;    case 'azure':      kmsProviders = {        azure: {          tenantId: process.env.AZURE_TENANT_ID, // Your Azure tenant ID          clientId: process.env.AZURE_CLIENT_ID, // Your Azure client ID          clientSecret: process.env.AZURE_CLIENT_SECRET, // Your Azure client secret        },      };      return kmsProviders;    case 'gcp':      kmsProviders = {        gcp: {          email: process.env.GCP_EMAIL, // Your GCP email          privateKey: process.env.GCP_PRIVATE_KEY, // Your GCP private key        },      };      return kmsProviders;    case 'kmip':      kmsProviders = {        kmip: {          endpoint: process.env.KMIP_KMS_ENDPOINT, // Your KMIP KMS endpoint        },      };      return kmsProviders;    case 'local':      (function () {        if (!existsSync('./customer-master-key.txt')) {          try {            writeFileSync('customer-master-key.txt', randomBytes(96));          } catch (err) {            throw new Error(              `Unable to write Customer Master Key to file due to the following error: ${err}`            );          }        }      })();      try {        // WARNING: Do not use a local key file in a production application        const localMasterKey = readFileSync('./customer-master-key.txt');
        if (localMasterKey.length !== 96) {          throw new Error(            'Expected the customer master key file to be 96 bytes.'          );        }
        kmsProviders = {          local: {            key: localMasterKey,          },        };      } catch (err) {        throw new Error(          `Unable to read the Customer Master Key due to the following error: ${err}`        );      }      return kmsProviders;
    default:      throw new Error(        `Unrecognized value for KMS provider name \'${kmsProviderName}\' encountered while retrieving KMS credentials.`      );  }}

export function getCustomerMasterKeyCredentials(kmsProviderName) {  let customerMasterKeyCredentials;  switch (kmsProviderName) {    case 'aws':      customerMasterKeyCredentials = {        key: process.env.AWS_KEY_ARN, // Your AWS Key ARN        region: process.env.AWS_KEY_REGION, // Your AWS Key Region      };      return customerMasterKeyCredentials;    case 'azure':      customerMasterKeyCredentials = {        keyVaultEndpoint: process.env.AZURE_KEY_VAULT_ENDPOINT, // Your Azure Key Vault Endpoint        keyName: process.env.AZURE_KEY_NAME, // Your Azure Key Name      };      return customerMasterKeyCredentials;    case 'gcp':      customerMasterKeyCredentials = {        projectId: process.env.GCP_PROJECT_ID, // Your GCP Project ID        location: process.env.GCP_LOCATION, // Your GCP Key Location        keyRing: process.env.GCP_KEY_RING, //  Your GCP Key Ring        keyName: process.env.GCP_KEY_NAME, // Your GCP Key Name      };      return customerMasterKeyCredentials;    case 'kmip':    case 'local':      customerMasterKeyCredentials = {};      return customerMasterKeyCredentials;    default:      throw new Error(        `Unrecognized value for KMS provider name \'${kmsProviderName}\' encountered while retrieving Customer Master Key credentials.`      );  }}

export async function getAutoEncryptionOptions(  kmsProviderName,  keyVaultNamespace,  kmsProviders) {  if (kmsProviderName === 'kmip') {    const tlsOptions = {      kmip: {        tlsCAFile: process.env.KMIP_TLS_CA_FILE, // Path to your TLS CA file        tlsCertificateKeyFile: process.env.KMIP_TLS_CERT_FILE, // Path to your TLS certificate key file      },    };    const extraOptions = {      cryptSharedLibPath: process.env.SHARED_LIB_PATH, // Path to your Automatic Encryption Shared Library    };
    const autoEncryptionOptions = {      keyVaultNamespace,      kmsProviders,      extraOptions,      tlsOptions,    };    return autoEncryptionOptions;  } else {    const extraOptions = {      cryptSharedLibPath: process.env.SHARED_LIB_PATH, // Path to your Automatic Encryption Shared Library    };
    const autoEncryptionOptions = {      keyVaultNamespace,      kmsProviders,      extraOptions,    };    return autoEncryptionOptions;  }}

const kmsProviderCredentials =  qeHelper.getKMSProviderCredentials(kmsProviderName);const customerMasterKeyCredentials =  qeHelper.getCustomerMasterKeyCredentials(kmsProviderName);
const autoEncryptionOptions = await qeHelper.getAutoEncryptionOptions(  kmsProviderName,  keyVaultNamespace,  kmsProviderCredentials);

const connection = mongoose.createConnection();
const client = new MongoClient(uri);const clientEncryption = new ClientEncryption(  client,  autoEncryptionOptions);
await qeHelper.dropExistingDatabase(client, encryptedDatabaseName);await qeHelper.dropExistingDatabase(client, keyVaultDatabaseName);

const keyId1 = await clientEncryption.createDataKey(    kmsProviderName, {    masterKey: customerMasterKeyCredentials,});const keyId2 = await clientEncryption.createDataKey(    kmsProviderName, {    masterKey: customerMasterKeyCredentials,});const keyId3 = await clientEncryption.createDataKey(    kmsProviderName, {    masterKey: customerMasterKeyCredentials,});

const patientSchema = new mongoose.Schema({  patientName: {    type: String,    required: true  },  patientId: {    type: Number,    required: true  },  patientRecord: {    ssn: {      type: String,      encrypt: {        keyId: keyId1,        queries: { queryType: 'equality' }       }    },    billing: {      type: {        type: String,        encrypt: {          keyId: keyId2,        }      },      number: {        type: String,        encrypt: {          keyId: keyId3        }      }    },    billAmount: Number  }}, {   encryptionType: 'queryableEncryption',  collection: encryptedCollectionName });

const Patient = connection.model('Patient', patientSchema);

await connection.openUri(uri, {   autoEncryption: autoEncryptionOptions,  dbName: encryptedDatabaseName});

const patientDocument = {  patientName: 'Jon Doe',  patientId: 12345678,  patientRecord: {    ssn: '987-65-4320',    billing: {      type: 'Visa',      number: '4111111111111111',    },    billAmount: 1500,  },};
const result = await Patient.create(patientDocument);
if (result) {  console.log('Successfully inserted the patient document.');  console.log('Document ID:', result._id);}

const findResult = await Patient.findOne({  'patientRecord.ssn': '987-65-4320',});console.log('Found patient:');console.log(findResult);

npm start

Successfully inserted the patient document.Document ID: new ObjectId('...')Found patient:{   patientRecord: {      billing: { type: 'Visa', number: '4111111111111111' },      ssn: '987-65-4320',      billAmount: 1500   },   _id: new ObjectId('...'),   patientName: 'Jon Doe',   patientId: 12345678,   __v: 0,   __safeContent__: [      Binary.createFromBase64('EGzhQwBpf1B6W9udskSxJ8kwEEnF5P+SJPZ6ygQ9Ft8=', 0)   ]}Connection closed.