@@ -4,8 +4,112 @@ import { loadGCPCredentials } from './gcp';
44
55/**
66 * @public
7+ *
8+ * A data key provider. Allowed values:
9+ *
10+ * - aws, gcp, local, kmip or azure
11+ * - (`mongodb-client-encryption>=6.0.1` only) a named key, in the form of:
12+ * `aws:<name>`, `gcp:<name>`, `local:<name>`, `kmip:<name>`, `azure:<name>`
13+ * where `name` is an alphanumeric string, underscores allowed.
714 */
8- export type ClientEncryptionDataKeyProvider = 'aws' | 'azure' | 'gcp' | 'local' | 'kmip' ;
15+ export type ClientEncryptionDataKeyProvider = string ;
16+
17+ /** @public */
18+ export interface AWSKMSProviderConfiguration {
19+ /**
20+ * The access key used for the AWS KMS provider
21+ */
22+ accessKeyId : string ;
23+
24+ /**
25+ * The secret access key used for the AWS KMS provider
26+ */
27+ secretAccessKey : string ;
28+
29+ /**
30+ * An optional AWS session token that will be used as the
31+ * X-Amz-Security-Token header for AWS requests.
32+ */
33+ sessionToken ?: string ;
34+ }
35+
36+ /** @public */
37+ export interface LocalKMSProviderConfiguration {
38+ /**
39+ * The master key used to encrypt/decrypt data keys.
40+ * A 96-byte long Buffer or base64 encoded string.
41+ */
42+ key : Buffer | string ;
43+ }
44+
45+ /** @public */
46+ export interface KMIPKMSProviderConfiguration {
47+ /**
48+ * The output endpoint string.
49+ * The endpoint consists of a hostname and port separated by a colon.
50+ * E.g. "example.com:123". A port is always present.
51+ */
52+ endpoint ?: string ;
53+ }
54+
55+ /** @public */
56+ export type AzureKMSProviderConfiguration =
57+ | {
58+ /**
59+ * The tenant ID identifies the organization for the account
60+ */
61+ tenantId : string ;
62+
63+ /**
64+ * The client ID to authenticate a registered application
65+ */
66+ clientId : string ;
67+
68+ /**
69+ * The client secret to authenticate a registered application
70+ */
71+ clientSecret : string ;
72+
73+ /**
74+ * If present, a host with optional port. E.g. "example.com" or "example.com:443".
75+ * This is optional, and only needed if customer is using a non-commercial Azure instance
76+ * (e.g. a government or China account, which use different URLs).
77+ * Defaults to "login.microsoftonline.com"
78+ */
79+ identityPlatformEndpoint ?: string | undefined ;
80+ }
81+ | {
82+ /**
83+ * If present, an access token to authenticate with Azure.
84+ */
85+ accessToken : string ;
86+ } ;
87+
88+ /** @public */
89+ export type GCPKMSProviderConfiguration =
90+ | {
91+ /**
92+ * The service account email to authenticate
93+ */
94+ email : string ;
95+
96+ /**
97+ * A PKCS#8 encrypted key. This can either be a base64 string or a binary representation
98+ */
99+ privateKey : string | Buffer ;
100+
101+ /**
102+ * If present, a host with optional port. E.g. "example.com" or "example.com:443".
103+ * Defaults to "oauth2.googleapis.com"
104+ */
105+ endpoint ?: string | undefined ;
106+ }
107+ | {
108+ /**
109+ * If present, an access token to authenticate with GCP.
110+ */
111+ accessToken : string ;
112+ } ;
9113
10114/**
11115 * @public
@@ -15,113 +119,35 @@ export interface KMSProviders {
15119 /**
16120 * Configuration options for using 'aws' as your KMS provider
17121 */
18- aws ?:
19- | {
20- /**
21- * The access key used for the AWS KMS provider
22- */
23- accessKeyId : string ;
24-
25- /**
26- * The secret access key used for the AWS KMS provider
27- */
28- secretAccessKey : string ;
29-
30- /**
31- * An optional AWS session token that will be used as the
32- * X-Amz-Security-Token header for AWS requests.
33- */
34- sessionToken ?: string ;
35- }
36- | Record < string , never > ;
122+ aws ?: AWSKMSProviderConfiguration | Record < string , never > ;
37123
38124 /**
39125 * Configuration options for using 'local' as your KMS provider
40126 */
41- local ?: {
42- /**
43- * The master key used to encrypt/decrypt data keys.
44- * A 96-byte long Buffer or base64 encoded string.
45- */
46- key : Buffer | string ;
47- } ;
127+ local ?: LocalKMSProviderConfiguration ;
48128
49129 /**
50130 * Configuration options for using 'kmip' as your KMS provider
51131 */
52- kmip ?: {
53- /**
54- * The output endpoint string.
55- * The endpoint consists of a hostname and port separated by a colon.
56- * E.g. "example.com:123". A port is always present.
57- */
58- endpoint ?: string ;
59- } ;
132+ kmip ?: KMIPKMSProviderConfiguration ;
60133
61134 /**
62135 * Configuration options for using 'azure' as your KMS provider
63136 */
64- azure ?:
65- | {
66- /**
67- * The tenant ID identifies the organization for the account
68- */
69- tenantId : string ;
70-
71- /**
72- * The client ID to authenticate a registered application
73- */
74- clientId : string ;
75-
76- /**
77- * The client secret to authenticate a registered application
78- */
79- clientSecret : string ;
80-
81- /**
82- * If present, a host with optional port. E.g. "example.com" or "example.com:443".
83- * This is optional, and only needed if customer is using a non-commercial Azure instance
84- * (e.g. a government or China account, which use different URLs).
85- * Defaults to "login.microsoftonline.com"
86- */
87- identityPlatformEndpoint ?: string | undefined ;
88- }
89- | {
90- /**
91- * If present, an access token to authenticate with Azure.
92- */
93- accessToken : string ;
94- }
95- | Record < string , never > ;
137+ azure ?: AzureKMSProviderConfiguration | Record < string , never > ;
96138
97139 /**
98140 * Configuration options for using 'gcp' as your KMS provider
99141 */
100- gcp ?:
101- | {
102- /**
103- * The service account email to authenticate
104- */
105- email : string ;
106-
107- /**
108- * A PKCS#8 encrypted key. This can either be a base64 string or a binary representation
109- */
110- privateKey : string | Buffer ;
111-
112- /**
113- * If present, a host with optional port. E.g. "example.com" or "example.com:443".
114- * Defaults to "oauth2.googleapis.com"
115- */
116- endpoint ?: string | undefined ;
117- }
118- | {
119- /**
120- * If present, an access token to authenticate with GCP.
121- */
122- accessToken : string ;
123- }
124- | Record < string , never > ;
142+ gcp ?: GCPKMSProviderConfiguration | Record < string , never > ;
143+
144+ [ key : string ] :
145+ | AWSKMSProviderConfiguration
146+ | LocalKMSProviderConfiguration
147+ | KMIPKMSProviderConfiguration
148+ | AzureKMSProviderConfiguration
149+ | GCPKMSProviderConfiguration
150+ | undefined ;
125151}
126152
127153/**
0 commit comments