MongoDB Client-Side Encryption Module

import { MongoClient, Binary } from 'mongodb';
import { ClientEncryption } from 'mongodb-client-encryption';
import * as crypto from 'crypto';

async function runEncryptionExample() {
  // Ensure these environment variables are set or provide default values
  const connectionString = process.env.MONGO_URI ?? 'mongodb://localhost:27017/';
  const kmsProviderType = process.env.KMS_PROVIDER_TYPE ?? 'local'; // e.g., 'aws', 'azure', 'gcp', 'kmip', 'local'
  const keyVaultNamespace = process.env.KEY_VAULT_NAMESPACE ?? 'encryption.__keyVault';

  let kmsProviders: any;

  // For a 'local' KMS provider, a 32-byte master key is required.
  // In a production environment, this key should be securely managed and never hardcoded.
  if (kmsProviderType === 'local') {
    const localMasterKey = process.env.LOCAL_MASTER_KEY || crypto.randomBytes(96).toString('base64'); // 96 bytes for CSFLE, per MongoDB documentation
    kmsProviders = {
      local: { key: Buffer.from(localMasterKey, 'base64').subarray(0, 32) } // Ensure it's 32 bytes for the ClientEncryptionSettings
    };
  } else if (kmsProviderType === 'aws') {
    // Example for AWS KMS. Replace with actual credentials/configuration.
    kmsProviders = {
      aws: {
        accessKeyId: process.env.AWS_ACCESS_KEY_ID ?? 'YOUR_AWS_ACCESS_KEY_ID',
        secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY ?? 'YOUR_AWS_SECRET_ACCESS_KEY',
        region: process.env.AWS_REGION ?? 'us-east-1'
      }
    };
  } else {
      console.error(`KMS Provider ${kmsProviderType} not supported in this example.`);
      return;
  }

  const client = new MongoClient(connectionString);

  try {
    await client.connect();

    const encryption = new ClientEncryption(client,
      {
        keyVaultNamespace,
        kmsProviders
      }
    );

    // IMPORTANT: In a real application, you would typically create or retrieve a Data Key ID
    // from your key vault (e.g., using `encryption.createDataKey()`).
    // For this quickstart, we'll use a placeholder UUID string for demonstration.
    // Make sure this is a valid UUID (BSON Binary subtype 0x04) of an actual data key in your vault.
    const dataKeyUuidString = process.env.DATA_KEY_UUID ?? '12345678123456781234567812345678'; // Example 16-byte hex representation for UUID
    const dataKeyId = new Binary(Buffer.from(dataKeyUuidString.padEnd(32, '0'), 'hex'), Binary.SUBTYPE_UUID);

    const dataToEncrypt = 'my highly sensitive information';

    console.log('Original Data:', dataToEncrypt);

    // Explicitly encrypt a field
    const encryptedData = await encryption.encrypt(dataToEncrypt, {
      keyId: dataKeyId,
      algorithm: 'AEAD_AES256_CBC_HMAC_SHA512-Deterministic' // Or AEAD_AES256_CBC_HMAC_SHA512-Random
    });

    console.log('Encrypted Data (BSON Binary):', encryptedData);

    // Explicitly decrypt the field
    const decryptedData = await encryption.decrypt(encryptedData);
    console.log('Decrypted Data:', decryptedData);

  } finally {
    await client.close();
  }
}

runEncryptionExample().catch(console.error);