service/vendor/go.mongodb.org/mongo-driver/mongo/options/datakeyoptions.go

102 lines
3.4 KiB
Go
Raw Normal View History

2023-12-21 22:17:40 +08:00
// Copyright (C) MongoDB, Inc. 2017-present.
//
// Licensed under the Apache License, Version 2.0 (the "License"); you may
// not use this file except in compliance with the License. You may obtain
// a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
package options
// DataKeyOptions represents all possible options used to create a new data key.
type DataKeyOptions struct {
MasterKey interface{}
KeyAltNames []string
// KeyMaterial is used to encrypt data. If omitted, keyMaterial is generated form a cryptographically secure random
// source. "Key Material" is used interchangeably with "dataKey" and "Data Encryption Key" (DEK).
KeyMaterial []byte
}
// DataKey creates a new DataKeyOptions instance.
func DataKey() *DataKeyOptions {
return &DataKeyOptions{}
}
// SetMasterKey specifies a KMS-specific key used to encrypt the new data key.
//
// If being used with a local KMS provider, this option is not applicable and should not be specified.
//
// For the AWS, Azure, and GCP KMS providers, this option is required and must be a document. For each, the value of the
// "endpoint" or "keyVaultEndpoint" must be a host name with an optional port number (e.g. "foo.com" or "foo.com:443").
//
// When using AWS, the document must have the format:
//
// {
// region: <string>,
// key: <string>, // The Amazon Resource Name (ARN) to the AWS customer master key (CMK).
// endpoint: Optional<string> // An alternate host identifier to send KMS requests to.
// }
//
// If unset, the "endpoint" defaults to "kms.<region>.amazonaws.com".
//
// When using Azure, the document must have the format:
//
// {
// keyVaultEndpoint: <string>, // A host identifier to send KMS requests to.
// keyName: <string>,
// keyVersion: Optional<string> // A specific version of the named key.
// }
//
// If unset, "keyVersion" defaults to the key's primary version.
//
// When using GCP, the document must have the format:
//
// {
// projectId: <string>,
// location: <string>,
// keyRing: <string>,
// keyName: <string>,
// keyVersion: Optional<string>, // A specific version of the named key.
// endpoint: Optional<string> // An alternate host identifier to send KMS requests to.
// }
//
// If unset, "keyVersion" defaults to the key's primary version and "endpoint" defaults to "cloudkms.googleapis.com".
func (dk *DataKeyOptions) SetMasterKey(masterKey interface{}) *DataKeyOptions {
dk.MasterKey = masterKey
return dk
}
// SetKeyAltNames specifies an optional list of string alternate names used to reference a key. If a key is created'
// with alternate names, encryption may refer to the key by a unique alternate name instead of by _id.
func (dk *DataKeyOptions) SetKeyAltNames(keyAltNames []string) *DataKeyOptions {
dk.KeyAltNames = keyAltNames
return dk
}
// SetKeyMaterial will set a custom keyMaterial to DataKeyOptions which can be used to encrypt data.
func (dk *DataKeyOptions) SetKeyMaterial(keyMaterial []byte) *DataKeyOptions {
dk.KeyMaterial = keyMaterial
return dk
}
// MergeDataKeyOptions combines the argued DataKeyOptions in a last-one wins fashion.
func MergeDataKeyOptions(opts ...*DataKeyOptions) *DataKeyOptions {
dko := DataKey()
for _, opt := range opts {
if opt == nil {
continue
}
if opt.MasterKey != nil {
dko.MasterKey = opt.MasterKey
}
if opt.KeyAltNames != nil {
dko.KeyAltNames = opt.KeyAltNames
}
if opt.KeyMaterial != nil {
dko.KeyMaterial = opt.KeyMaterial
}
}
return dko
}