Class: Mongo::Crypt::KMS::Credentials Private

Inherits:
Object
  • Object
show all
Defined in:
lib/mongo/crypt/kms/credentials.rb

Overview

This class is part of a private API. You should avoid using this class if possible, as it may be removed or be changed in the future.

KMS Credentials object contains credentials for using KMS providers.

Constant Summary collapse

ON_DEMAND_PROVIDERS =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

KMS provider types that support on-demand credential retrieval.

%w[aws gcp azure].freeze

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(kms_providers) ⇒ Credentials

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Note:

There may be more than one KMS provider specified.

Creates a KMS credentials object from a parameters hash.

Parameters:

  • kms_providers (Hash) —

    A hash that contains credentials for KMS providers. Keys may be provider types (:aws, :local, etc.) or named provider identifiers ("aws:name1", "local:name2", etc.). Values are hashes of credentials for the corresponding provider type.

Raises:

  • (ArgumentError) —

    If required options are missing or incorrectly formatted.



40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
 
# File 'lib/mongo/crypt/kms/credentials.rb', line 40

def initialize(kms_providers)
  raise ArgumentError.new('KMS providers options must not be nil') if kms_providers.nil?

  @credentials_map = {}

  kms_providers.each do |identifier, opts|
    identifier_str = identifier.to_s
    provider_type = KMS.provider_base_type(identifier_str)

    creds = case provider_type
            when 'aws' then AWS::Credentials.new(opts)
            when 'azure' then Azure::Credentials.new(opts)
            when 'gcp' then GCP::Credentials.new(opts)
            when 'kmip' then KMIP::Credentials.new(opts)
            when 'local' then Local::Credentials.new(opts)
            else
              raise ArgumentError.new(
                'KMS providers options must have one of the following keys: ' \
                ':aws, :azure, :gcp, :kmip, :local'
              )
            end

    @credentials_map[identifier_str] = creds
  end

  return unless @credentials_map.empty?

  raise ArgumentError.new(
    'KMS providers options must have one of the following keys: ' \
    ':aws, :azure, :gcp, :kmip, :local'
  )
end

Instance Attribute Details

#credentials_map ⇒ Object (readonly)

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future. 



27
28
29
 
# File 'lib/mongo/crypt/kms/credentials.rb', line 27

def credentials_map
  @credentials_map
end

Instance Method Details

#any_on_demand? ⇒ Boolean

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Returns true if any configured provider supports on-demand credential retrieval and has been configured with empty credentials.

Returns:

  • (Boolean) 


102
103
104
105
106
 
# File 'lib/mongo/crypt/kms/credentials.rb', line 102

def any_on_demand?
  @credentials_map.any? do |identifier, creds|
    ON_DEMAND_PROVIDERS.include?(KMS.provider_base_type(identifier)) && creds.empty?
  end
end

#aws ⇒ Credentials::AWS | nil

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Returns AWS KMS credentials (unnamed provider only).

Returns:

  • (Credentials::AWS | nil) —

    AWS KMS credentials (unnamed provider only).



74
75
76
 
# File 'lib/mongo/crypt/kms/credentials.rb', line 74

def aws
  @credentials_map['aws']
end

#azure ⇒ Credentials::Azure | nil

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Returns Azure KMS credentials (unnamed provider only).

Returns:

  • (Credentials::Azure | nil) —

    Azure KMS credentials (unnamed provider only).



79
80
81
 
# File 'lib/mongo/crypt/kms/credentials.rb', line 79

def azure
  @credentials_map['azure']
end

#gcp ⇒ Credentials::GCP | nil

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Returns GCP KMS credentials (unnamed provider only).

Returns:

  • (Credentials::GCP | nil) —

    GCP KMS credentials (unnamed provider only).



84
85
86
 
# File 'lib/mongo/crypt/kms/credentials.rb', line 84

def gcp
  @credentials_map['gcp']
end

#kmip ⇒ Credentials::KMIP | nil

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Returns KMIP KMS credentials (unnamed provider only).

Returns:

  • (Credentials::KMIP | nil) —

    KMIP KMS credentials (unnamed provider only).



89
90
91
 
# File 'lib/mongo/crypt/kms/credentials.rb', line 89

def kmip
  @credentials_map['kmip']
end

#local ⇒ Credentials::Local | nil

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Returns Local KMS credentials (unnamed provider only).

Returns:

  • (Credentials::Local | nil) —

    Local KMS credentials (unnamed provider only).



94
95
96
 
# File 'lib/mongo/crypt/kms/credentials.rb', line 94

def local
  @credentials_map['local']
end

#to_document ⇒ BSON::Document

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Convert credentials object to a BSON document in libmongocrypt format.

Returns:

  • (BSON::Document) —

    Credentials as BSON document.



111
112
113
114
115
116
117
 
# File 'lib/mongo/crypt/kms/credentials.rb', line 111

def to_document
  BSON::Document.new.tap do |bson|
    @credentials_map.each do |identifier, creds|
      bson[identifier] = creds.to_document
    end
  end
end