INTPYTHON-527 Add Queryable Encryption support #329

aclark4life · 2025-06-27T02:16:28Z

Previous attempts and additional context here:

INTPYTHON-527 Add Queryable Encryption config #318
- Branched from transaction support and includes only helpers
INTPYTHON-527 Add queryable encryption support #319
- In which this bug in libmongocrypt was discovered
- A fix for that bug in PyMongo is being discussed here.
INTPYTHON-527 Add Queryable Encryption support #323
- Before I understood that the shared lib for mongocrypt was included in the pymongocrypt wheel.
Add test for "Encrypted fields found" error (ensure this exception still happens)
Add check for model schema not matching encrypted fields
Document key_vault_namespace must be encrypted db
Document that fields within EmbeddedModelArrayField can't be encrypted
Document workflow:
- Develop and test local
- Deploy and run migrate
- Run showencryptedfieldsmap and set encrypted_fields_map in auto_encryption_opts
- Deploy again

tests/encryption_/tests.py

django_mongodb_backend/models.py

django_mongodb_backend/encryption.py

django_mongodb_backend/schema.py

django_mongodb_backend/base.py

django_mongodb_backend/fields/encryption.py

django_mongodb_backend/schema.py

django_mongodb_backend/features.py

django_mongodb_backend/routers.py

django_mongodb_backend/schema.py

django_mongodb_backend/fields/encryption.py

django_mongodb_backend/schema.py

tests/encryption_/tests.py

tests/encryption_/routers.py

tests/encryption_/models.py

tests/backend_/test_features.py

django_mongodb_backend/schema.py

tests/encryption_/models.py

django_mongodb_backend/schema.py

django_mongodb_backend/encryption.py

tests/encryption_/routers.py

django_mongodb_backend/schema.py

django_mongodb_backend/models.py

django_mongodb_backend/management/commands/get_encrypted_fields_map.py

docs/source/ref/encryption.rst

django_mongodb_backend/fields/encryption.py

django_mongodb_backend/management/commands/get_encrypted_fields_map.py

django_mongodb_backend/schema.py

tests/encryption_/tests.py

Via https://github.com/mongodb-labs/drivers-evergreen-tools/tree/master/.evergreen/csfle

…ove mongocryptd

… it part of the normal flow

Move crypt shared installation instructions to "Installation" section and crypt shared configuration steps to "Configuring the DATABASES setting" section.

- avoid encryption tasks on non-encrypted builds - retrieve configured provider from conn settings - fail loudly & avoid uppercased values in settings

WaVEV · 2025-12-11T01:36:50Z

django_mongodb_backend/schema.py

+                continue
+            # Populate data for encrypted field.
+            if getattr(field, "encrypted", False):


I rather if, elif instead of continue. I think in this case it applies

django_mongodb_backend/utils.py

WaVEV · 2025-12-11T03:16:58Z

django_mongodb_backend/utils.py

+            return True
+
+        # Recursively check embedded models.
+        return isinstance(field, EmbeddedModelField) and model_has_encrypted_fields(


Sorry, my bad, this is buggy, I didn't see the for before 😬 , this return is cutting the for loop in the first iteration while the other implementation wait until someone meet the this condition.

I'm fixing local, no worries!

aclark4life commented Jun 27, 2025

View reviewed changes

tests/encryption_/tests.py Outdated Show resolved Hide resolved

aclark4life commented Jun 27, 2025

View reviewed changes

django_mongodb_backend/models.py Outdated Show resolved Hide resolved

aclark4life commented Jun 27, 2025

View reviewed changes

django_mongodb_backend/encryption.py Outdated Show resolved Hide resolved

timgraham reviewed Jun 27, 2025

View reviewed changes

This comment was marked as resolved.

Sign in to view

timgraham reviewed Jun 30, 2025

View reviewed changes

django_mongodb_backend/features.py Outdated Show resolved Hide resolved

timgraham reviewed Jul 1, 2025

View reviewed changes

django_mongodb_backend/routers.py Outdated Show resolved Hide resolved

timgraham reviewed Jul 1, 2025

View reviewed changes

django_mongodb_backend/schema.py Outdated Show resolved Hide resolved

This comment was marked as resolved.

Sign in to view

timgraham reviewed Jul 4, 2025

View reviewed changes

tests/encryption_/models.py Show resolved Hide resolved

timgraham reviewed Jul 7, 2025

View reviewed changes

tests/encryption_/models.py Outdated Show resolved Hide resolved

aclark4life commented Jul 7, 2025

View reviewed changes

django_mongodb_backend/schema.py Outdated Show resolved Hide resolved

This comment was marked as resolved.

Sign in to view

timgraham reviewed Jul 9, 2025

View reviewed changes

tests/encryption_/tests.py Outdated Show resolved Hide resolved

tests/encryption_/tests.py Outdated Show resolved Hide resolved

tests/encryption_/tests.py Outdated Show resolved Hide resolved

This comment was marked as resolved.

Sign in to view

aclark4life commented Jul 11, 2025

View reviewed changes

tests/encryption_/tests.py Outdated Show resolved Hide resolved

This comment was marked as resolved.

Sign in to view

timgraham and others added 17 commits December 9, 2025 20:26

use shared library instead of mongocryptd

1f7df91

adjust message and add test for missing auto_encryption_opts error

a68fceb

polish howto

d3f1cdc

doc query limitations + docs polish + todos

a0da43e

edit "Dynamic library path configuration"

6b80a93

combine topic guide with howto

edfc04c

Remove QE from 5.2.0 beta 2 release notes

12e3ece

Add "start csfle servers" func to evergreen config

0fa502d

Via https://github.com/mongodb-labs/drivers-evergreen-tools/tree/master/.evergreen/csfle

remove support for multiple kms providers

d71e6eb

fix join tests following foreignField/localField refactor

3c899fe

Add tests-8-qe to evergreen buildvariants

00e5abd

fix less than lookup on encrypted fields

c7c6ac5

simplify "Configuring the Automatic Encryption Shared Library" to rem…

aee8cef

…ove mongocryptd

reorder "Configuring the Automatic Encryption Shared Library" to make…

eac1007

… it part of the normal flow

update docs/tests for $facet removal

85c11e3

Combine crypt shared w/installation & db setup

3bce9a6

Move crypt shared installation instructions to "Installation" section and crypt shared configuration steps to "Configuring the DATABASES setting" section.

versionadded updated from 5.2.3 to 6.0.0.

6a7aff1

aclark4life force-pushed the INTPYTHON-527 branch from 1075c9f to 59a4cd4 Compare December 10, 2025 01:26

aclark4life added 3 commits December 10, 2025 16:14

Configure AWS KMS for testing on evergreen

95f5341

doc edits

964c20c

Address review

0393c81

- avoid encryption tasks on non-encrypted builds - retrieve configured provider from conn settings - fail loudly & avoid uppercased values in settings

aclark4life force-pushed the INTPYTHON-527 branch from 38839d6 to 0393c81 Compare December 10, 2025 21:15

Address UAT feedback

a30a562

aclark4life force-pushed the INTPYTHON-527 branch from 4c8fd91 to a30a562 Compare December 10, 2025 21:59

WaVEV reviewed Dec 11, 2025

View reviewed changes

django_mongodb_backend/utils.py Outdated Show resolved Hide resolved

WaVEV reviewed Dec 11, 2025

View reviewed changes

Address review

43771ac

aclark4life force-pushed the INTPYTHON-527 branch from bac8fd2 to 43771ac Compare December 11, 2025 03:27

Update versionadded 6.0.0 -> 6.0.1

6647264

INTPYTHON-527 Add Queryable Encryption support #329

Are you sure you want to change the base?

INTPYTHON-527 Add Queryable Encryption support #329

Uh oh!

Conversation

aclark4life commented Jun 27, 2025 • edited by timgraham Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

This comment was marked as resolved.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

WaVEV Dec 11, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

WaVEV Dec 11, 2025

Choose a reason for hiding this comment

Uh oh!

aclark4life Dec 11, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

aclark4life commented Jun 27, 2025 •

edited by timgraham

Loading