@@ -4,124 +4,152 @@ import { loadGCPCredentials } from './gcp';
44
55/**
66 * @public
7+ *
8+ * A data key provider. Allowed values:
9+ *
10+ * - aws, gcp, local, kmip or azure
11+ * - (`mongodb-client-encryption>=6.0.1` only) a named key, in the form of:
12+ * `aws:<name>`, `gcp:<name>`, `local:<name>`, `kmip:<name>`, `azure:<name>`
13+ * where `name` is an alphanumeric string, underscores allowed.
714 */
8- export type ClientEncryptionDataKeyProvider = 'aws' | 'azure' | 'gcp' | 'local' | 'kmip' ;
15+ export type ClientEncryptionDataKeyProvider = string ;
16+
17+ /** @public */
18+ export interface AWSKMSProviderConfiguration {
19+ /**
20+ * The access key used for the AWS KMS provider
21+ */
22+ accessKeyId : string ;
23+
24+ /**
25+ * The secret access key used for the AWS KMS provider
26+ */
27+ secretAccessKey : string ;
28+
29+ /**
30+ * An optional AWS session token that will be used as the
31+ * X-Amz-Security-Token header for AWS requests.
32+ */
33+ sessionToken ?: string ;
34+ }
35+
36+ /** @public */
37+ export interface LocalKMSProviderConfiguration {
38+ /**
39+ * The master key used to encrypt/decrypt data keys.
40+ * A 96-byte long Buffer or base64 encoded string.
41+ */
42+ key : Buffer | string ;
43+ }
44+
45+ /** @public */
46+ export interface KMIPKMSProviderConfiguration {
47+ /**
48+ * The output endpoint string.
49+ * The endpoint consists of a hostname and port separated by a colon.
50+ * E.g. "example.com:123". A port is always present.
51+ */
52+ endpoint ?: string ;
53+ }
54+
55+ /** @public */
56+ export type AzureKMSProviderConfiguration =
57+ | {
58+ /**
59+ * The tenant ID identifies the organization for the account
60+ */
61+ tenantId : string ;
62+
63+ /**
64+ * The client ID to authenticate a registered application
65+ */
66+ clientId : string ;
67+
68+ /**
69+ * The client secret to authenticate a registered application
70+ */
71+ clientSecret : string ;
72+
73+ /**
74+ * If present, a host with optional port. E.g. "example.com" or "example.com:443".
75+ * This is optional, and only needed if customer is using a non-commercial Azure instance
76+ * (e.g. a government or China account, which use different URLs).
77+ * Defaults to "login.microsoftonline.com"
78+ */
79+ identityPlatformEndpoint ?: string | undefined ;
80+ }
81+ | {
82+ /**
83+ * If present, an access token to authenticate with Azure.
84+ */
85+ accessToken : string ;
86+ } ;
87+
88+ /** @public */
89+ export type GCPKMSProviderConfiguration =
90+ | {
91+ /**
92+ * The service account email to authenticate
93+ */
94+ email : string ;
95+
96+ /**
97+ * A PKCS#8 encrypted key. This can either be a base64 string or a binary representation
98+ */
99+ privateKey : string | Buffer ;
100+
101+ /**
102+ * If present, a host with optional port. E.g. "example.com" or "example.com:443".
103+ * Defaults to "oauth2.googleapis.com"
104+ */
105+ endpoint ?: string | undefined ;
106+ }
107+ | {
108+ /**
109+ * If present, an access token to authenticate with GCP.
110+ */
111+ accessToken : string ;
112+ } ;
9113
10114/**
11115 * @public
12116 * Configuration options that are used by specific KMS providers during key generation, encryption, and decryption.
117+ *
118+ * Named KMS providers _are not supported_ for automatic KMS credential fetching.
13119 */
14120export interface KMSProviders {
15121 /**
16122 * Configuration options for using 'aws' as your KMS provider
17123 */
18- aws ?:
19- | {
20- /**
21- * The access key used for the AWS KMS provider
22- */
23- accessKeyId : string ;
24-
25- /**
26- * The secret access key used for the AWS KMS provider
27- */
28- secretAccessKey : string ;
29-
30- /**
31- * An optional AWS session token that will be used as the
32- * X-Amz-Security-Token header for AWS requests.
33- */
34- sessionToken ?: string ;
35- }
36- | Record < string , never > ;
124+ aws ?: AWSKMSProviderConfiguration | Record < string , never > ;
37125
38126 /**
39127 * Configuration options for using 'local' as your KMS provider
40128 */
41- local ?: {
42- /**
43- * The master key used to encrypt/decrypt data keys.
44- * A 96-byte long Buffer or base64 encoded string.
45- */
46- key : Buffer | string ;
47- } ;
129+ local ?: LocalKMSProviderConfiguration ;
48130
49131 /**
50132 * Configuration options for using 'kmip' as your KMS provider
51133 */
52- kmip ?: {
53- /**
54- * The output endpoint string.
55- * The endpoint consists of a hostname and port separated by a colon.
56- * E.g. "example.com:123". A port is always present.
57- */
58- endpoint ?: string ;
59- } ;
134+ kmip ?: KMIPKMSProviderConfiguration ;
60135
61136 /**
62137 * Configuration options for using 'azure' as your KMS provider
63138 */
64- azure ?:
65- | {
66- /**
67- * The tenant ID identifies the organization for the account
68- */
69- tenantId : string ;
70-
71- /**
72- * The client ID to authenticate a registered application
73- */
74- clientId : string ;
75-
76- /**
77- * The client secret to authenticate a registered application
78- */
79- clientSecret : string ;
80-
81- /**
82- * If present, a host with optional port. E.g. "example.com" or "example.com:443".
83- * This is optional, and only needed if customer is using a non-commercial Azure instance
84- * (e.g. a government or China account, which use different URLs).
85- * Defaults to "login.microsoftonline.com"
86- */
87- identityPlatformEndpoint ?: string | undefined ;
88- }
89- | {
90- /**
91- * If present, an access token to authenticate with Azure.
92- */
93- accessToken : string ;
94- }
95- | Record < string , never > ;
139+ azure ?: AzureKMSProviderConfiguration | Record < string , never > ;
96140
97141 /**
98142 * Configuration options for using 'gcp' as your KMS provider
99143 */
100- gcp ?:
101- | {
102- /**
103- * The service account email to authenticate
104- */
105- email : string ;
106-
107- /**
108- * A PKCS#8 encrypted key. This can either be a base64 string or a binary representation
109- */
110- privateKey : string | Buffer ;
111-
112- /**
113- * If present, a host with optional port. E.g. "example.com" or "example.com:443".
114- * Defaults to "oauth2.googleapis.com"
115- */
116- endpoint ?: string | undefined ;
117- }
118- | {
119- /**
120- * If present, an access token to authenticate with GCP.
121- */
122- accessToken : string ;
123- }
124- | Record < string , never > ;
144+ gcp ?: GCPKMSProviderConfiguration | Record < string , never > ;
145+
146+ [ key : string ] :
147+ | AWSKMSProviderConfiguration
148+ | LocalKMSProviderConfiguration
149+ | KMIPKMSProviderConfiguration
150+ | AzureKMSProviderConfiguration
151+ | GCPKMSProviderConfiguration
152+ | undefined ;
125153}
126154
127155/**
0 commit comments