h`dZddlZ ddlZdZddlmZGddeZdZ y#e$rdZYwxYw) z9Support for automatic client-side field level encryption.NTF)ConfigurationErrorc$eZdZdZ ddZy)AutoEncryptionOptszBOptions to configure automatic client-side field level encryption.Nc ts td||_||_||_||_||_||_||_||_ tj| xsdg|_ t|jts tdtd|jDs|jj!dyy)a$Options to configure automatic client-side field level encryption. Automatic client-side field level encryption requires MongoDB 4.2 enterprise or a MongoDB 4.2 Atlas cluster. Automatic encryption is not supported for operations on a database or view and will result in error. Although automatic encryption requires MongoDB 4.2 enterprise or a MongoDB 4.2 Atlas cluster, automatic *decryption* is supported for all users. To configure automatic *decryption* without automatic *encryption* set ``bypass_auto_encryption=True``. Explicit encryption and explicit decryption is also supported for all users with the :class:`~pymongo.encryption.ClientEncryption` class. See :ref:`automatic-client-side-encryption` for an example. :Parameters: - `kms_providers`: Map of KMS provider options. Two KMS providers are supported: "aws" and "local". The kmsProviders map values differ by provider: - `aws`: Map with "accessKeyId" and "secretAccessKey" as strings. These are the AWS access key ID and AWS secret access key used to generate KMS messages. - `azure`: Map with "tenantId", "clientId", and "clientSecret" as strings. Additionally, "identityPlatformEndpoint" may also be specified as a string (defaults to 'login.microsoftonline.com'). These are the Azure Active Directory credentials used to generate Azure Key Vault messages. - `gcp`: Map with "email" as a string and "privateKey" as `bytes` or a base64 encoded string (unicode on Python 2). Additionally, "endpoint" may also be specified as a string (defaults to 'oauth2.googleapis.com'). These are the credentials used to generate Google Cloud KMS messages. - `local`: Map with "key" as `bytes` (96 bytes in length) or a base64 encoded string (unicode on Python 2) which decodes to 96 bytes. "key" is the master key used to encrypt/decrypt data keys. This key should be generated and stored as securely as possible. - `key_vault_namespace`: The namespace for the key vault collection. The key vault collection contains all data keys used for encryption and decryption. Data keys are stored as documents in this MongoDB collection. Data keys are protected with encryption by a KMS provider. - `key_vault_client` (optional): By default the key vault collection is assumed to reside in the same MongoDB cluster as the encrypted MongoClient. Use this option to route data key queries to a separate MongoDB cluster. - `schema_map` (optional): Map of collection namespace ("db.coll") to JSON Schema. By default, a collection's JSONSchema is periodically polled with the listCollections command. But a JSONSchema may be specified locally with the schemaMap option. **Supplying a `schema_map` provides more security than relying on JSON Schemas obtained from the server. It protects against a malicious server advertising a false JSON Schema, which could trick the client into sending unencrypted data that should be encrypted.** Schemas supplied in the schemaMap only apply to configuring automatic encryption for client side encryption. Other validation rules in the JSON schema will not be enforced by the driver and will result in an error. - `bypass_auto_encryption` (optional): If ``True``, automatic encryption will be disabled but automatic decryption will still be enabled. Defaults to ``False``. - `mongocryptd_uri` (optional): The MongoDB URI used to connect to the *local* mongocryptd process. Defaults to ``'mongodb://localhost:27020'``. - `mongocryptd_bypass_spawn` (optional): If ``True``, the encrypted MongoClient will not attempt to spawn the mongocryptd process. Defaults to ``False``. - `mongocryptd_spawn_path` (optional): Used for spawning the mongocryptd process. Defaults to ``'mongocryptd'`` and spawns mongocryptd from the system path. - `mongocryptd_spawn_args` (optional): A list of string arguments to use when spawning the mongocryptd process. Defaults to ``['--idleShutdownTimeoutSecs=60']``. If the list does not include the ``idleShutdownTimeoutSecs`` option then ``'--idleShutdownTimeoutSecs=60'`` will be added. .. versionadded:: 3.9 zclient side encryption requires the pymongocrypt library: install a compatible version with: python -m pip install 'pymongo[encryption]'z--idleShutdownTimeoutSecs=60z%mongocryptd_spawn_args must be a listc3$K|]}d|v yw)idleShutdownTimeoutSecsN).0ss ]/var/www/html/ranktracker/api/venv/lib/python3.12/site-packages/pymongo/encryption_options.py z.AutoEncryptionOpts.__init__..s:-1:sN)_HAVE_PYMONGOCRYPTr_kms_providers_key_vault_namespace_key_vault_client _schema_map_bypass_auto_encryption_mongocryptd_uri_mongocryptd_bypass_spawn_mongocryptd_spawn_pathcopy_mongocryptd_spawn_args isinstancelist TypeErroranyappend) self kms_providerskey_vault_namespacekey_vault_client schema_mapbypass_auto_encryptionmongocryptd_urimongocryptd_bypass_spawnmongocryptd_spawn_pathmongocryptd_spawn_argss r __init__zAutoEncryptionOpts.__init__sv"$>? ? ,$7!!1%'=$ /)A&'=$(, 2H(I)I)G(H $$66=CD D: 88::  ( ( / /0N O:)NNFzmongodb://localhost:27020F mongocryptdN)__name__ __module__ __qualname____doc__r(r r)r rrs L48(-!<*/(5(, oPr)rcJ||St|tst|d|S)z Validate the driver keyword arg.z* must be an instance of AutoEncryptionOpts)rrr)optionvalues r %validate_auto_encryption_opts_or_noner2s3 } e/ 0   Lr)) r.r pymongocryptr ImportErrorpymongo.errorsrobjectrr2r r)r r7sO@ .rPrPjws #--