How to use MongoDB Client-Side Field Level Encryption (CSFLE) with Node.js

1
brew install mongodb/brew/libmongocrypt

1
export BUILD_TYPE=dynamic

1
touch clients.js helpers.js make-data-key.js

1
npm init --yes

1
npm install -S mongodb mongodb-client-encryption node-gyp

1
// clients.js
2
3
const fs = require("fs")
4
const mongodb = require("mongodb")
5
const { ClientEncryption } = require("mongodb-client-encryption")
6
const { MongoClient, Binary } = mongodb
7
8
module.exports = {
9
readMasterKey: function (path = "./master-key.txt") {
10
   return fs.readFileSync(path)
11
},
12
CsfleHelper: class {
13
   constructor({
14
      kmsProviders = null,
15
      keyAltNames = "demo-data-key",
16
      keyDB = "encryption",
17
      keyColl = "__keyVault",
18
      schema = null,
19
      connectionString = "mongodb://localhost:27017",
20
      mongocryptdBypassSpawn = false,
21
      mongocryptdSpawnPath = "mongocryptd"
22
   } = {}) {
23
      if (kmsProviders === null) {
24
      throw new Error("kmsProviders is required")
25
      }
26
      this.kmsProviders = kmsProviders
27
      this.keyAltNames = keyAltNames
28
      this.keyDB = keyDB
29
      this.keyColl = keyColl
30
      this.keyVaultNamespace = `${keyDB}.${keyColl}`
31
      this.schema = schema
32
      this.connectionString = connectionString
33
      this.mongocryptdBypassSpawn = mongocryptdBypassSpawn
34
      this.mongocryptdSpawnPath = mongocryptdSpawnPath
35
      this.regularClient = null
36
      this.csfleClient = null
37
   }
38
39
   /**
40
   * In the guide, https://mongodb.prakticum-team.ru/proxy/docs.mongodb.com/ecosystem/use-cases/client-side-field-level-encryption-guide/,
41
   * we create the data key and then show that it is created by
42
   * retreiving it using a findOne query. Here, in implementation, we only
43
   * create the key if it doesn't already exist, ensuring we only have one
44
   * local data key.
45
   *
46
   * @param {MongoClient} client
47
   */
48
   async findOrCreateDataKey(client) {
49
      const encryption = new ClientEncryption(client, {
50
      keyVaultNamespace: this.keyVaultNamespace,
51
      kmsProviders: this.kmsProviders
52
      })
53
54
      await this.ensureUniqueIndexOnKeyVault(client)
55
56
      let dataKey = await client
57
      .db(this.keyDB)
58
      .collection(this.keyColl)
59
      .findOne({ keyAltNames: { $in: [this.keyAltNames] } })
60
61
      if (dataKey === null) {
62
      dataKey = await encryption.createDataKey("local", {
63
         keyAltNames: [this.keyAltNames]
64
      })
65
      return dataKey.toString("base64")
66
      }
67
68
      return dataKey["_id"].toString("base64")
69
   }
70
}

1
// make-data-key.js
2
3
const { readMasterKey, CsfleHelper } = require("./helpers");
4
const { connectionString } = require("./config");
5
6
async function main() {
7
const localMasterKey = readMasterKey()
8
9
const csfleHelper = new CsfleHelper({
10
   kmsProviders: {
11
      local: {
12
      key: localMasterKey
13
      }
14
   },
15
   connectionString: "PASTE YOUR MONGODB ATLAS URI HERE"
16
})
17
18
const client = await csfleHelper.getRegularClient()
19
20
const dataKey = await csfleHelper.findOrCreateDataKey(client)
21
console.log("Base64 data key. Copy and paste this into clients.js\t", dataKey)
22
23
client.close()
24
}
25
26
main().catch(console.dir)

1
node make-data-key.js

1
{
2
   "_id": "UUID('27a51d69-809f-4cb9-ae15-d63f7eab1585')",
3
   "keyAltNames": ["demo-data-key"],
4
   "keyMaterial": "Binary('oJ6lEzjIEskH...', 0)",
5
   "creationDate": "2020-11-05T23:32:26.466+00:00",
6
   "updateDate": "2020-11-05T23:32:26.466+00:00",
7
   "status": "0",
8
   "masterKey": {
9
      "provider": "local"
10
   }
11
}

1
if (dataKey === null) {
2
   throw new Error(
3
      "dataKey is a required argument. Ensure you've defined it in clients.js"
4
   )
5
}
6
return {
7
   "medicalRecords.patients": {
8
      bsonType: "object",
9
      // specify the encryptMetadata key at the root level of the JSON Schema.
10
      // As a result, all encrypted fields defined in the properties field of the
11
      // schema will inherit this encryption key unless specifically overwritten.
12
      encryptMetadata: {
13
      keyId: [new Binary(Buffer.from(dataKey, "base64"), 4)]
14
      },
15
      properties: {
16
      insurance: {
17
         bsonType: "object",
18
         properties: {
19
            // The insurance.policyNumber field is embedded inside the insurance
20
            // field and represents the patient's policy number.
21
            // This policy number is a distinct and sensitive field. 
22
            policyNumber: {
23
            encrypt: {
24
               bsonType: "int",
25
               algorithm: "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
26
            }
27
            }
28
         }
29
      },
30
      // The medicalRecords field is an array that contains a set of medical record documents. 
31
      // Each medical record document represents a separate visit and specifies information
32
      // about the patient at that that time, such as their blood pressure, weight, and heart rate.
33
      // This field is sensitive and should be encrypted.
34
      medicalRecords: {
35
         encrypt: {
36
            bsonType: "array",
37
            algorithm: "AEAD_AES_256_CBC_HMAC_SHA_512-Random"
38
         }
39
      },
40
      // The bloodType field represents the patient's blood type.
41
      // This field is sensitive and should be encrypted. 
42
      bloodType: {
43
         encrypt: {
44
            bsonType: "string",
45
            algorithm: "AEAD_AES_256_CBC_HMAC_SHA_512-Random"
46
         }
47
      },
48
      // The ssn field represents the patient's 
49
      // social security number. This field is 
50
      // sensitive and should be encrypted.
51
      ssn: {
52
         encrypt: {
53
            bsonType: "int",
54
            algorithm: "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
55
         }
56
      }
57
   }
58
}

1
async getCsfleEnabledClient(schemaMap = null) {
2
   if (schemaMap === null) { 
3
      throw new Error(
4
         "schemaMap is a required argument. Build it using the CsfleHelper.createJsonSchemaMap method"
5
      )
6
   }
7
   const client = new MongoClient(this.connectionString, {
8
      useNewUrlParser: true,
9
      useUnifiedTopology: true,
10
      monitorCommands: true,
11
      autoEncryption: {
12
         // The key vault collection contains the data key that the client uses to encrypt and decrypt fields.
13
         keyVaultNamespace: this.keyVaultNamespace,
14
         // The client expects a key management system to store and provide the application's master encryption key.
15
         // For now, we will use a local master key, so they use the local KMS provider.
16
         kmsProviders: this.kmsProviders,
17
         // The JSON Schema that we have defined doesn't explicitly specify the collection to which it applies.
18
         // To assign the schema, they map it to the medicalRecords.patients collection namespace
19
         schemaMap
20
      }
21
   })
22
   return await client.connect()
23
}

1
const { readMasterKey, CsfleHelper } = require("./helpers");
2
const { connectionString, dataKey } = require("./config");
3
4
const localMasterKey = readMasterKey()
5
6
const csfleHelper = new CsfleHelper({
7
   // The client expects a key management system to store and provide the application's master encryption key. For now, we will use a local master key, so they use the local KMS provider.
8
   kmsProviders: {
9
      local: {
10
         key: localMasterKey
11
      }
12
   },
13
   connectionString,
14
})
15
16
async function main() {
17
let regularClient = await csfleHelper.getRegularClient()
18
let schemeMap = csfleHelper.createJsonSchemaMap(dataKey)
19
let csfleClient = await csfleHelper.getCsfleEnabledClient(schemeMap)
20
21
let exampleDocument = {
22
   name: "Jon Doe",
23
   ssn: 241014209,
24
   bloodType: "AB+",
25
   medicalRecords: [
26
      {
27
      weight: 180,
28
      bloodPressure: "120/80"
29
      }
30
   ],
31
   insurance: {
32
      provider: "MaestCare",
33
      policyNumber: 123142
34
   }
35
}
36
37
const regularClientPatientsColl = regularClient
38
   .db("medicalRecords")
39
   .collection("patients")
40
const csfleClientPatientsColl = csfleClient
41
   .db("medicalRecords")
42
   .collection("patients")
43
44
// Performs the insert operation with the csfle-enabled client
45
// We're using an update with an upsert so that subsequent runs of this script
46
// don't insert new documents
47
await csfleClientPatientsColl.updateOne(
48
   { ssn: exampleDocument["ssn"] },
49
   { $set: exampleDocument },
50
   { upsert: true }
51
)
52
53
// Performs a read using the encrypted client, querying on an encrypted field
54
const csfleFindResult = await csfleClientPatientsColl.findOne({
55
   ssn: exampleDocument["ssn"]
56
})
57
console.log(
58
   "Document retreived with csfle enabled client:\n",
59
   csfleFindResult
60
)
61
62
// Performs a read using the regular client. We must query on a field that is
63
// not encrypted.
64
// Try - query on the ssn field. What is returned?
65
const regularFindResult = await regularClientPatientsColl.findOne({
66
   name: "Jon Doe"
67
})
68
console.log("Document retreived with regular client:\n", regularFindResult)
69
70
await regularClient.close()
71
await csfleClient.close()
72
}
73
74
main().catch(console.dir)

1
{
2
   "_id": "5d6ecdce70401f03b27448fc",
3
   "name": "Jon Doe",
4
   "ssn": 241014209,
5
   "bloodType": "AB+",
6
   "medicalRecords": [
7
      {
8
      "weight": 180,
9
      "bloodPressure": "120/80"
10
      }
11
   ],
12
   "insurance": {
13
      "provider": "MaestCare",
14
      "policyNumber": 123142
15
   }
16
}