+ 4O|j@a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI t ^RI H t ^RI H t HtHtHtHtHtHtHtHtHtHtHt^RIHt^RIHt^RIHt^RIH t ^R I!H"t"R t#^R I&H't'H(t(H)t)^R I*H+t+H,t,H-t-^RI.H/t/^RI0H1t1^RI2H3t3H4t4H5t5^RI6H7t7^RI8H9t9^RI:H;t;^RIt>H?t?H@t@^RIAHBtBHCtCHDtDHEtEHFtFHGtG^RIHHItI^RIJHKtK^RILHMtM^RINHOtO^RIPHQtQHRtR^RISHTtT^RIUHVtVHWtW^RIXHYtYHZtZ^RI[H\t\^RI]H^t^^R I_H`t`^R!IaHbtb^R"IcHdtdHete^R#IfHgtgHhth^R$IiHjtj] 'd^R%IHktk^R&IlHmtm^R'IcHntnR toR(tp]9tqR)tr]/!]]s]3,]+R*7ttR+]uR,&]/!]4R-7tvR.R/ltw]PR0R1l4ty!R2R3]"4tz!R4R54t{!R6R74t|!R8R9]s]P4t~!R:R;]s]P4tR<R=lt!R>R?]]d,4tR# ]$d R t#]%t"ELi;i)@z8Support for explicit client-side field level encryption.) annotationsN)deepcopy) TYPE_CHECKINGAnyDict GeneratorGenericIteratorMappingMutableMappingOptionalSequenceUnioncast)MongoCryptError)MongoCryptOptions) AutoEncrypter)ExplicitEncrypter)MongoCryptCallbackTF) _dict_to_bsondecodeencode)STANDARD UUID_SUBTYPEBinary) CodecOptions) BSONError)DEFAULT_RAW_BSON_OPTIONSRawBSONDocument _inflate_bson)_csot)CONNECT_TIMEOUT) _spawn_daemon)AutoEncryptionOpts RangeOptsTextOptscheck_min_pymongocrypt)ConfigurationErrorEncryptedCollectionErrorEncryptionErrorInvalidOperationNetworkTimeoutServerSelectionTimeoutError)_get_timeout_details)sendall) UpdateOne) PoolOptions)_configured_socket_raise_connection_failure) ReadConcern)BulkWriteResult DeleteResult)BLOCKING_IO_ERRORSget_ssl_context) Collection)Cursor)Database) MongoClient) _DocumentType_DocumentTypeArg)_parse_kms_tls_options parse_host) WriteConcern)MongoCryptKmsContext)_sslConn)_Addressii')document_classuuid_representationzCodecOptions[dict[str, Any]]_DATA_KEY_OPTS)rDc$V^8dQhRRRRRR/#)addressrCoptsr0returnzUnion[socket.socket, _sslConn])formats"WC:\Users\alokc\chatbot\backend\venv\Lib\site-packages\pymongo/synchronous/encryption.py __annotate__rOvs'\\(\+\:X\cx\W4# \d"p\Y\T4R7Rp?R#Rp?ii;i))timeout_detailsN)r1 Exceptionr2r-)rIrJexcs&& rN _connect_kmsrUvs9\!'00 \!'@TUY@Z[[\s 949cV^8dQhRR/#)rHrKzIterator[None]rL)rMs"rNrOrO~s , , ,rPc#l"RxR# \dh\dp\T4ThRp?ii;i5i)z2Context manager to wrap encryption related errors.N)rrSr))rTs rN_wrap_encryption_errorsrX}s6,   ,c"+,s 4 411 ,14c]tRt^tRRltRRltRRltRRltR R ltR R lt R Rlt RRlt RRlt Rt R#) _EncryptionIOc(V^8dQhRRRRRRRR/#)rHclientz'Optional[MongoClient[_DocumentTypeArg]]key_vault_collzCollection[_DocumentTypeArg]mongocryptd_clientrJr#rL)rMs"rNrO_EncryptionIO.__annotate__s9BB7B5BD B ! BrPc  FVVe\P!V4VnMRVn\\\ ,VP \\RR7\RR7R74Vn W0n W@n RVn VP\4VnR#)z8Internal class to perform I/O on behalf of pymongocrypt.Nmajority)level)w) codec_options read_concern write_concernF)weakrefref client_refrr8r with_options_KEY_VAULT_OPTSr3r@r]r^rJ_spawned_kms_ssl_contexts_IS_SYNC)selfr\r]r^rJs&&&&&rN__init___EncryptionIO.__init__s  %kk&1DO"DOEI  '  ' '-(z:*Z8 ( F #5  !%!7!7!ArPc V^8dQhRRRR/#)rH kms_contextrArKNonerL)rMs"rNrOr_sT)T)';T)T)rPc  VPpVPpVPpVPP V4pVf\ RRRRRRR\ 4p\\P!\4R4p\VVVR7p\V\4pVPp V 'd)\V 4R, p \ P"!V 4\%W4p \'W4VP(^8dV P+\\P!\4^44\ 'dV P-VP(4p M^RIHp V !WP(4p V 'g \3R4hVP5V 4KT PG4R# \6dh\8dip\;T\<4'd\>P@!R4p\;T\24'dRpMRp\CYT\ET4R 7Rp?LRp?ii;i T PG4i;i \6dh\8dp\PH!4p\;T\J4'g Te T^8:dhTPM4Rp?R# \6d$p\7T R T 2TPN4pTThRp?ii;iRp?ii;i) z]Complete a KMS request. :param kms_context: A :class:`MongoCryptKmsContext`. :return: None NFgMbP?)connect_timeoutsocket_timeout ssl_contextg.A)receive_data_socketzKMS connection closedz timed out) msg_prefixrRz, last attempt failed with: )(endpointmessage kms_providerrmgetr7rnmaxr clamp_remaining_KMS_CONNECT_TIMEOUTr0r? _HTTPS_PORTusleepfloattimesleeprUr. bytes_needed settimeoutrecvpymongo.network_layerryOSErrorfeedrrS isinstancer6sockettimeoutr2r-close remainingr+failcode)rorsr{r|providerctxrvrJrIsleep_u sleep_secconndataryrTrzr final_errs&& rN kms_request_EncryptionIO.kms_requestss''%%++$$((2 ;" Ce334HI5Q+*  X{3$$ g,I JJy !0 ).D &!..2OOC(=(=>R(SUV$WXx#yy)A)AB 349Q9QR%&=>>$$T*3< #  c#566 ..5Cc7++!8J!%J)ZI]^bIc     ))I#~..93HYZ[^ )  """ )% k!=cUCY^^y(  ) )s I%BF-<F-H.I-H+H+AH&!H.&H++H..IIKK7KJ'' K2KKKKc$V^8dQhRRRRRR/#)rHdatabasestrfilterbytesrKzOptional[list[bytes]]rL)rMs"rNrOr_s' Q Q QU Q?T QrPc  VP4V,P\V4R7;_uu_4pVUu.uFp\VR\4NK upuuRRR4#uupi +'giR#;i)a@Get the collection info for a namespace. The returned collection info is passed to libmongocrypt which reads the JSON schema. :param database: The database on which to run listCollections. :param filter: The filter to pass to listCollections. :return: All documents from the listCollections command response as BSON. )rFN)rilist_collectionsrrrF)rorrcursordocs&&& rNcollection_info_EncryptionIO.collection_infosa__ x ( 9 9QWAX 9 Y Y]cIOP#M#un=PZ YPZ Y YsA*A%A*%A** A; cV^8dQhRR/#rHrKrtrL)rMs"rNrOr_ s  t rPc RVnVPP;'gR.pVPVPP4\ V4R#)zfSpawn mongocryptd. Note this method is thread safe; at most one mongocryptd will start successfully. T mongocryptdN)rlrJ_mongocryptd_spawn_pathextend_mongocryptd_spawn_argsr")roargss& rNspawn_EncryptionIO.spawn sC   11BB]C DII556drPc$V^8dQhRRRRRR/#)rHrrcmdrrKbytes | memoryviewrL)rMs"rNrOr_s"Su9KrPc VP'g-VPP'gVP4\ V\ 4pVP fQhVP V,PV\ R7pVP# \ddTPP'dhTP4TP T,PT\ R7pTP#i;i)zMark a command for encryption. :param database: The database on which to run this command. :param cmd: The BSON command to run. :return: The marked command response from mongocryptd. rd) rlrJ_mongocryptd_bypass_spawnrrrr^commandr,raw)rorr inflated_cmdress&&& rN mark_command_EncryptionIO.mark_commands}}}TYY%H%H%H JJL%S*BC &&222 ))(3;;,D<Cww+ yy222 JJL))(3;;,D<Cww s (B&D;9DDc V^8dQhRRRR/#)rHrrrKz#Generator[bytes | memoryview, None]rL)rMs"rNrOr_0s   +N rPc# "VPfQhVPP\V44;_uu_4pVFpVPxK RRR4R# +'giR#;i5i)zYields one or more keys from the key vault. :param filter: The filter to pass to find. :return: A generator which yields the requested keys from the key vault. N)r]findrr)rorrkeys&& rN fetch_keys_EncryptionIO.fetch_keys0sX""...  % %of&= > >&gg ? > > >s=A5A! A5! A2 , A5c V^8dQhRRRR/#)rHdata_keyrrKrrL)rMs"rNrOr_<s&rPc "\V\4pVPR4p\V\4'dVP \ 8wd\R\V4 24hVPfQhVPPV4V#)zInsert a data key into the key vault. :param data_key: The data key document to insert. :return: The _id of the inserted data key document. _idz5data_key _id must be Binary with a UUID subtype, not ) rrkr~rrsubtyper TypeErrortyper] insert_one)rorraw_doc data_key_ids&& rNinsert_data_key_EncryptionIO.insert_data_key<s"(O<kk%( +v..+2E2E2UG[HYGZ[ ""... &&w/rPc V^8dQhRRRR/#)rHrzMutableMapping[str, Any]rKrrL)rMs"rNrOr_Ns  7 E rPc \V4#)zEncode a document to BSON. A document can be any mapping type (like :class:`dict`). :param doc: mapping type representing a document :return: The encoded BSON bytes. )r)rors&&rN bson_encode_EncryptionIO.bson_encodeNsc{rPcV^8dQhRR/#rrL)rMs"rNrOr_Ys + +t +rPc RVnRVnVP'd$VPP4RVnR#R#)zZRelease resources. Note it is not safe to call this method from __del__ or any GC hooks. N)rir]r^rros&rNr_EncryptionIO.closeYs> "  " " "  # # ) ) +&*D # #rP)rmrlrir]r^rJN)__name__ __module__ __qualname____firstlineno__rprrrrrrrr__static_attributes__rLrPrNrZrZs8B6T)l Q 6 $  + +rPrZcL]tRtRtRtR RRllt]RRl4tRR ltR t R#) RewrapManyDataKeyResultiezmResult object returned by a :meth:`~ClientEncryption.rewrap_many_data_key` operation. .. versionadded:: 4.2 Nc V^8dQhRRRR/#)rHbulk_write_resultOptional[BulkWriteResult]rKrtrL)rMs"rNrO$RewrapManyDataKeyResult.__annotate__ks44*C4t4rPc WnR#N_bulk_write_result)rors&&rNrp RewrapManyDataKeyResult.__init__ks"3rPcV^8dQhRR/#)rHrKrrL)rMs"rNrOros''#<'rPc VP#)aThe result of the bulk write operation used to update the key vault collection with one or more rewrapped data keys. If :meth:`~ClientEncryption.rewrap_many_data_key` does not find any matching keys to rewrap, no bulk write operation will be executed and this field will be ``None``. rrs&rNr)RewrapManyDataKeyResult.bulk_write_resultns&&&rPcV^8dQhRR/#)rHrKrrL)rMs"rNrOrxsII#IrPc PVPP RVP: R2#)()) __class__rrrs&rN__repr__ RewrapManyDataKeyResult.__repr__xs'..))*!D,C,C+FaHHrPrr) rrrr__doc__rppropertyrrrrLrPrNrres, 4''IIrPrcV]tRtRtRtRRltRRltRRltR R ltR R lt R t R#) _Encrypteri|zEncrypts and decrypts MongoDB commands. This class is used to support automatic encryption and decryption of MongoDB commands. c V^8dQhRRRR/#)rHr\MongoClient[_DocumentTypeArg]rJr#rL)rMs"rNrO_Encrypter.__annotate__s EE<EDVErPc VPfRpM\VPR\4pVPfRpM\VPR\4pVPVnRVnVP \4RRlpVPeVPpMV!W4pVP'dRpMV!W4pVPPR^4wrWh,V ,p \VPR\R7p \VV V V4p \V \!VP"VVP$VP&VPVVP(VP*R74VnRVnR#)zCreate a _Encrypter for a client. :param client: The encrypted MongoClient. :param opts: The encrypted client's :class:`AutoEncryptionOpts`. NFc$V^8dQhRRRRRR/#)rH encrypterr mongo_clientrrKrL)rMs"rNrO)_Encrypter.__init__..__annotate__s$ # #! #1N # * #rPcVPPPfV#VPe VP#VP ^RR7pW nV#)N) minPoolSizeauto_encryption_opts)options pool_options max_pool_size_internal_client _duplicate)rrinternal_clients&& rN_get_internal_client1_Encrypter.__init__.._get_internal_clients\##00>>F##))5 111*55!Z^5_O)8 &" "rP.)connectserverSelectionTimeoutMS) kms_providers schema_mapcrypt_shared_lib_pathcrypt_shared_lib_requiredbypass_encryptionencrypted_fields_mapbypass_query_analysiskey_expiration_ms) _schema_maprrF_encrypted_fields_map_bypass_auto_encryptionrrmrn_key_vault_client_key_vault_namespacesplitr;_mongocryptd_uri_MONGOCRYPTD_TIMEOUT_MSrZr_create_mongocrypt_options_kms_providers_crypt_shared_lib_path_crypt_shared_lib_required_bypass_query_analysis_key_expiration_ms_auto_encrypter_closed) ror\rJr rrkey_vault_clientmetadata_clientdbcollr]r^ io_callbackss &&& rNrp_Encrypter.__init__sq    #J&t'7'7OJ  % % -#' #01K1KUTb#c '+'C'C$ $ x( #  ! ! -#55 3DA   ' ' '"O24@O,,223:)-d3=H  ! !5Kb> %      -  &"11%&*&A&A*.*I*I"&">">%9&*&A&A"&"9"9   rPc(V^8dQhRRRRRRRR/#) rHrrrMapping[str, Any]rdCodecOptions[_DocumentTypeArg]rKzdict[str, Any]rL)rMs"rNrOrs2JJJ"3JDbJ JrPc VP4\VRV4p\4;_uu_4VPP W4p\ V\ 4uuRRR4# +'giR#;i)zEncrypt a MongoDB command. :param database: The database for this command. :param cmd: A command document. :param codec_options: The CodecOptions to use while encoding `cmd`. :return: The encrypted command to execute. FN) _check_closedrrXr"encryptrr)rorrrd encoded_cmd encrypted_cmds&&&& rNr/_Encrypter.encryptsW #C > $ & & 0088OM 0HI' & & &s +A&& A7 c V^8dQhRRRR/#)rHresponserrKOptional[bytes]rL)rMs"rNrOrs G G 2 G GrPc VP4\4;_uu_4\\VPP V44uuRRR4# +'giR#;i)zDecrypt a MongoDB command response. :param response: A MongoDB command response as BSON. :return: The decrypted command response. N)r.rXrrr"decrypt)ror4s&&rNr7_Encrypter.decryptsC  $ & &t33;;HEF' & & &s )A A( cV^8dQhRR/#rrL)rMs"rNrOrIItIrPc @VP'd \R4hR#)z"Cannot use MongoClient after closeN)r#r*rs&rNr._Encrypter._check_closeds <<<"#GH H rPcV^8dQhRR/#rrL)rMs"rNrOrs))t)rPc RVnVPP4VP'd$VPP4RVnR#R#)zCleanup resources.TN)r#r"rrrs&rNr_Encrypter.closesF  ""$   ! ! ' ' )$(D ! !rP)r"rr#rN) rrrrrrpr/r7r.rrrLrPrNrr|s* ENJ$ GI))rPrcB]tRtRtRtRtRtRtRtRt Rt R t R t R #) Algorithmiz9An enum that defines the supported encryption algorithms.z+AEAD_AES_256_CBC_HMAC_SHA_512-Deterministicz$AEAD_AES_256_CBC_HMAC_SHA_512-RandomIndexed UnindexedRange RangePreview TextPreviewrLN) rrrrr+AEAD_AES_256_CBC_HMAC_SHA_512_Deterministic$AEAD_AES_256_CBC_HMAC_SHA_512_RandomINDEXED UNINDEXEDRANGE RANGEPREVIEW TEXTPREVIEWrrLrPrNrArAsQC2_/6+Q(/GI E"L  KrPrAc<]tRtRtRtRtRtRtRtRt Rt R t R #) QueryTypeizeAn enum that defines the supported values for explicit encryption query_type. .. versionadded:: 4.2 equalityrangerE prefixPreview suffixPreviewsubstringPreviewrLN) rrrrrEQUALITYrKrL PREFIXPREVIEW SUFFIXPREVIEWSUBSTRINGPREVIEWrrLrPrNrOrOsL H8 E "L$M $M *rPrOc V^8dQhRRRR/#)rHkwargsrrKrrL)rMs"rNrOrOBsFFF1BFrPc jVPR4fVPRR4\R/VBRR/B#)rNenable_multiple_collinfoTrL)r~popr)rZs,rNrrBs4 zz%&. &-  Ev E EErPc]tRtRtRtR)RRlltR)RRlltR*RR lltR+R R lltR,R R llt R-RRllt RRlt RRlt RRlt RRltRRltRRltRRltR)RRlltR R!ltR"R#ltR$R%ltR&R'ltR(tR#).ClientEncryptioniIz,Explicit client-side field level encryption.Nc4V^8dQhRRRRRRRRR R R R R R/#)rHr r+key_vault_namespacerr$rrdr,kms_tls_optionsOptional[Mapping[str, Any]]r Optional[int]rKrtrL)rMs"rNrOClientEncryption.__annotate__LsbEAEA(EA!EA8 EA 6 EA 5 EA)EA EArPc  \'g \R4h\4\V\4'g\ R\ V4 24h\V\4'g\;QJd/R\ V4P4F 'gK RM$ RM !R\ V4P44'g"\ R\ V4P 24hWn W n W0n W@nVPR^4wrxW7,V,p \!VVVVR7p \#V P$\&4Vn\+R V R V 4Vn\/VP,\1VR VRR 74VnVP,P4fQhVP,P4VnR #) aExplicit client-side field level encryption. The ClientEncryption class encapsulates explicit operations on a key vault collection that cannot be done directly on a MongoClient. Similar to configuring auto encryption on a MongoClient, it is constructed with a MongoClient (to a MongoDB cluster containing the key vault collection), KMS provider configuration, and keyVaultNamespace. It provides an API for explicitly encrypting and decrypting values, and creating data keys. It does not provide an API to query keys from the key vault collection, as this can be done directly on the MongoClient. See `explicit client-side encryption `_ for an example. :param kms_providers: Map of KMS provider options. The `kms_providers` map values differ by provider: - `aws`: Map with "accessKeyId" and "secretAccessKey" as strings. These are the AWS access key ID and AWS secret access key used to generate KMS messages. An optional "sessionToken" may be included to support temporary AWS credentials. - `azure`: Map with "tenantId", "clientId", and "clientSecret" as strings. Additionally, "identityPlatformEndpoint" may also be specified as a string (defaults to 'login.microsoftonline.com'). These are the Azure Active Directory credentials used to generate Azure Key Vault messages. - `gcp`: Map with "email" as a string and "privateKey" as `bytes` or a base64 encoded string. Additionally, "endpoint" may also be specified as a string (defaults to 'oauth2.googleapis.com'). These are the credentials used to generate Google Cloud KMS messages. - `kmip`: Map with "endpoint" as a host with required port. For example: ``{"endpoint": "example.com:443"}``. - `local`: Map with "key" as `bytes` (96 bytes in length) or a base64 encoded string which decodes to 96 bytes. "key" is the master key used to encrypt/decrypt data keys. This key should be generated and stored as securely as possible. KMS providers may be specified with an optional name suffix separated by a colon, for example "kmip:name" or "aws:name". Named KMS providers do not support `CSFLE on-demand credentials `_. :param key_vault_namespace: The namespace for the key vault collection. The key vault collection contains all data keys used for encryption and decryption. Data keys are stored as documents in this MongoDB collection. Data keys are protected with encryption by a KMS provider. :param key_vault_client: A MongoClient connected to a MongoDB cluster containing the `key_vault_namespace` collection. :param codec_options: An instance of :class:`~bson.codec_options.CodecOptions` to use when encoding a value for encryption and decoding the decrypted BSON value. This should be the same CodecOptions instance configured on the MongoClient, Database, or Collection used to access application data. :param kms_tls_options: A map of KMS provider names to TLS options to use when creating secure connections to KMS providers. Accepts the same TLS options as :class:`pymongo.mongo_client.MongoClient`. For example, to override the system default CA file:: kms_tls_options={'kmip': {'tlsCAFile': certifi.where()}} Or to supply a client certificate:: kms_tls_options={'kmip': {'tlsCertificateKeyFile': 'client.pem'}} :param key_expiration_ms: The cache expiration time for data encryption keys. Defaults to ``None`` which defers to libmongocrypt's default which is currently 60000. Set to 0 to disable key expiration. .. versionchanged:: 4.12 Added the `key_expiration_ms` parameter. .. versionchanged:: 4.0 Added the `kms_tls_options` parameter and the "kmip" KMS provider. .. versionadded:: 3.9 zclient-side field level encryption requires the pymongocrypt library: install a compatible version with: python -m pip install --upgrade 'pymongo[encryption]'zJcodec_options must be an instance of bson.codec_options.CodecOptions, not c3>"TFqPR8HxK R#5i)r;Nr.0clss& rN ,ClientEncryption.__init__..s_@^||}4@^TFzMongoClient required but given r )rbrN)r r rr)_HAVE_PYMONGOCRYPTr'r&rrrrr;any__mro__rrrr_codec_optionsrr#r>_kms_tls_optionsrnrmrZ _io_callbacksrr _encryptionr]_key_vault_coll) ror rar$rdrbrr&r'r]rJs &&&&&&& rNrpClientEncryption.__init__Lsj"!$H   -66\]abo]p\qr *K883_EU@V@^@^_333_EU@V@^@^___"A$GWBXBaBaAb cdd+$7!!1+&,,S!4)-d3!  +/   "88M8Mx!X6C .$7 -    &+"3"&   !!00<<<#11@@rPc4V^8dQhRRRRRRRRR R R R R R/#)rHrzDatabase[_DocumentTypeArg]namerencrypted_fieldsr+r} Optional[str] master_keyrcrZrrKz6tuple[Collection[_DocumentTypeArg], Mapping[str, Any]]rL)rMs"rNrOrescWKWK,WKWK, WK $ WK 0 WKWK @WKrPc \V\4'g\;QJd/R\V4P4F 'gK RM$ RM !R\V4P44'g"\ R\V4P 24h\V4p\VR,4FWwrx\V\4'gKVPR4eK2VPVVR7VR,V,R&KY W6R &RVR &VP!R R V/VBV3# \dp \Y4T hRp ? ii;i \dp \Y4T hRp ? ii;i) a\Create a collection with encryptedFields. .. warning:: This function does not update the encryptedFieldsMap in the client's AutoEncryptionOpts, thus the user must create a new client after calling this function with the encryptedFields returned. Normally collection creation is automatic. This method should only be used to specify options on creation. :class:`~pymongo.errors.EncryptionError` will be raised if the collection already exists. :param database: the database to create the collection :param name: the name of the collection to create :param encrypted_fields: Document that describes the encrypted fields for Queryable Encryption. The "keyId" may be set to ``None`` to auto-generate the data keys. For example: .. code-block: python { "escCollection": "enxcol_.encryptedCollection.esc", "ecocCollection": "enxcol_.encryptedCollection.ecoc", "fields": [ { "path": "firstName", "keyId": Binary.from_uuid(UUID('00000000-0000-0000-0000-000000000000')), "bsonType": "string", "queries": {"queryType": "equality"} }, { "path": "ssn", "keyId": Binary.from_uuid(UUID('04104104-1041-0410-4104-104104104104')), "bsonType": "string" } ] } :param kms_provider: the KMS provider to be used :param master_key: Identifies a KMS-specific key used to encrypt the new data key. If the kmsProvider is "local" the `master_key` is not applicable and may be omitted. :param kwargs: additional keyword arguments are the same as "create_collection". All optional `create collection command`_ parameters should be passed as keyword arguments to this method. See the documentation for :meth:`~pymongo.database.Database.create_collection` for all valid options. :raises: - :class:`~pymongo.errors.EncryptedCollectionError`: When either data-key creation or creating the collection fails. .. versionadded:: 4.4 .. _create collection command: https://mongodb.com/docs/manual/reference/command/create c3>"TFqPR8HxK R#5i)r:Nrhris& rNrl?ClientEncryption.create_encrypted_collection..sT=Sc||z1=SrnTFzDatabase required but given fieldskeyIdN)r}r|encryptedFields check_existsryrL)rr:rprrqrrr enumeratedictr~create_data_keyr)r(create_collectionrS) rorryrzr}r|rZifieldrTs &&&&&&, rNcreate_encrypted_collection,ClientEncryption.create_encrypted_collectionsT@(H--3TT(^=S=ST333TT(^=S=STTT">tH~?V?V>W XYY#$45!"28"<=HA%&&599W+=+ES=A=Q=Q%1#->R>$X.q1':>%5 !!&~ K**???   'S23IsRS K*3As J Ks0($D0E0 E ; EE  E+ E&&E+c ,V^8dQhRRRRRRRRR R /#) rHr}rr|rc key_alt_nameszOptional[Sequence[str]] key_materialr5rKrrL)rMs"rNrOre,sCYYY0Y/ Y & Y  YrPc  VP4\4;_uu_4\\VPP VVVVR74uuRRR4# +'giR#;i)a Create and insert a new data key into the key vault collection. :param kms_provider: The KMS provider to use. Supported values are "aws", "azure", "gcp", "kmip", "local", or a named provider like "kmip:name". :param master_key: Identifies a KMS-specific key used to encrypt the new data key. If the kmsProvider is "local" the `master_key` is not applicable and may be omitted. If the `kms_provider` type is "aws" it is required and has the following fields:: - `region` (string): Required. The AWS region, e.g. "us-east-1". - `key` (string): Required. The Amazon Resource Name (ARN) to the AWS customer. - `endpoint` (string): Optional. An alternate host to send KMS requests to. May include port number, e.g. "kms.us-east-1.amazonaws.com:443". If the `kms_provider` type is "azure" it is required and has the following fields:: - `keyVaultEndpoint` (string): Required. Host with optional port, e.g. "example.vault.azure.net". - `keyName` (string): Required. Key name in the key vault. - `keyVersion` (string): Optional. Version of the key to use. If the `kms_provider` type is "gcp" it is required and has the following fields:: - `projectId` (string): Required. The Google cloud project ID. - `location` (string): Required. The GCP location, e.g. "us-east1". - `keyRing` (string): Required. Name of the key ring that contains the key to use. - `keyName` (string): Required. Name of the key to use. - `keyVersion` (string): Optional. Version of the key to use. - `endpoint` (string): Optional. Host with optional port. Defaults to "cloudkms.googleapis.com". If the `kms_provider` type is "kmip" it is optional and has the following fields:: - `keyId` (string): Optional. `keyId` is the KMIP Unique Identifier to a 96 byte KMIP Secret Data managed object. If keyId is omitted, the driver creates a random 96 byte KMIP Secret Data managed object. - `endpoint` (string): Optional. Host with optional port, e.g. "example.vault.azure.net:". - `delegated` (bool): Optional. If True (recommended), the KMIP server will perform encryption and decryption. If delegated is not provided, defaults to false. :param key_alt_names: An optional list of string alternate names used to reference a key. If a key is created with alternate names, then encryption may refer to the key by the unique alternate name instead of by ``key_id``. The following example shows creating and referring to a data key by alternate name:: client_encryption.create_data_key("local", key_alt_names=["name1"]) # reference the key with the alternate name client_encryption.encrypt("457-55-5462", key_alt_name="name1", algorithm=Algorithm.AEAD_AES_256_CBC_HMAC_SHA_512_Random) :param key_material: Sets the custom key material to be used by the data key for encryption and decryption. :return: The ``_id`` of the created data key document as a :class:`~bson.binary.Binary` with subtype :data:`~bson.binary.UUID_SUBTYPE`. .. versionchanged:: 4.2 Added the `key_material` parameter. )r|rrN)r.rXrrrur)ror}r|rrs&&&&&rNr ClientEncryption.create_data_key,sY^  $ & &  00 )"/!- 1' & & &s -A A, c@V^8dQhRRRRRRRRR RR R R R RRRRRR/ #)rHvaluer algorithmrkey_id"Optional[Union[Binary, uuid.UUID]] key_alt_namer{ query_typecontention_factorrd range_optsOptional[RangeOpts] is_expressionbool text_optsOptional[TextOpts]rKrL)rMs"rNrOresn1.1.1.1.3 1. $ 1. " 1.)1.(1.1.&1. 1.rPc  VP4\V\P4'd\P !V4pVe7\V\4'dVP \8Xg \R4h\RV/VPR7p Rp V'd"\VPVPR7p Rp V 'd"\V PVPR7p \4;_uu_4VPP!R RV RVRVRVRVR VR V R V/V 'dR V /M/Bp \V 4R,uuRRR4# +'giR#;i)Nz2key_id must be a bson.binary.Binary with subtype 4vrrrrrrrrrrrL)r.ruuidUUIDr from_uuidrrrrrrdocumentrXrur/r)rorrrrrrrrrrrange_opts_bytestext_opts_bytes encrypted_docs&&&&&&&&&& rN_encrypt_helper ClientEncryption._encrypt_helpersb  fdii ( (%%f-F   vv & &6>>\+IPQ Q %L--   %##"11   $"""11O% & & ,,44  #  *  &  #4 , , 5D;0 M-(-' & & &s A E E( c<V^8dQhRRRRRRRRR RR R R R RRRR/ #)rHrrrrrrrr{rrrdrrrrrKrrL)rMs"rNrOresd< < < < 3 < $ < " < )< (< &<  < rPc  R\\VPVVVVVVVRVR7 4#)axEncrypt a BSON value with a given key and algorithm. Note that exactly one of ``key_id`` or ``key_alt_name`` must be provided. :param value: The BSON value to encrypt. :param algorithm` (string): The encryption algorithm to use. See :class:`Algorithm` for some valid options. :param key_id: Identifies a data key by ``_id`` which must be a :class:`~bson.binary.Binary` with subtype 4 ( :attr:`~bson.binary.UUID_SUBTYPE`). :param key_alt_name: Identifies a key vault document by 'keyAltName'. :param query_type` (str): The query type to execute. See :class:`QueryType` for valid options. :param contention_factor` (int): The contention factor to use when the algorithm is :attr:`Algorithm.INDEXED`. An integer value *must* be given when the :attr:`Algorithm.INDEXED` algorithm is used. :param range_opts: Index options for `range` queries. See :class:`RangeOpts` for some valid options. :param text_opts: Index options for `textPreview` queries. See :class:`TextOpts` for some valid options. :return: The encrypted value, a :class:`~bson.binary.Binary` with subtype 6. .. versionchanged:: 4.9 Added the `text_opts` parameter. .. versionchanged:: 4.9 Added the `range_opts` parameter. .. versionchanged:: 4.7 ``key_id`` can now be passed in as a :class:`uuid.UUID`. .. versionchanged:: 4.2 Added the `query_type` and `contention_factor` parameters. F) rrrrrrrrr)rrr) rorrrrrrrrs &&&&&&&&&rNr/ClientEncryption.encryptsC^   #)%"3%## !   rPc8V^8dQhRRRRRRRRR RR R R R RR/#)rH expressionr+rrrrrr{rrrdrrrKrrL)rMs"rNrOresZ5 5 %5 5 3 5 $ 5 " 5 )5 (5  5 rPc P\\VPVVVVVVVRR74#)aEncrypt a BSON expression with a given key and algorithm. Note that exactly one of ``key_id`` or ``key_alt_name`` must be provided. :param expression: The BSON aggregate or match expression to encrypt. :param algorithm` (string): The encryption algorithm to use. See :class:`Algorithm` for some valid options. :param key_id: Identifies a data key by ``_id`` which must be a :class:`~bson.binary.Binary` with subtype 4 ( :attr:`~bson.binary.UUID_SUBTYPE`). :param key_alt_name: Identifies a key vault document by 'keyAltName'. :param query_type` (str): The query type to execute. See :class:`QueryType` for valid options. :param contention_factor` (int): The contention factor to use when the algorithm is :attr:`Algorithm.INDEXED`. An integer value *must* be given when the :attr:`Algorithm.INDEXED` algorithm is used. :param range_opts: Index options for `range` queries. See :class:`RangeOpts` for some valid options. :return: The encrypted expression, a :class:`~bson.RawBSONDocument`. .. versionchanged:: 4.9 Added the `range_opts` parameter. .. versionchanged:: 4.7 ``key_id`` can now be passed in as a :class:`uuid.UUID`. .. versionadded:: 4.4 T)rrrrrrrr)rrr)rorrrrrrrs&&&&&&&&rNencrypt_expression#ClientEncryption.encrypt_expressions@R    #)%"3%" !   rPc V^8dQhRRRR/#)rHrrrKrrL)rMs"rNrOre/sQQVQQrPc rVP4\V\4'dVP^8Xg \ R4h\ 4;_uu_4\ RV/4pVPPV4p\W0PR7R,uuRRR4# +'giR#;i)zDecrypt an encrypted value. :param value` (Binary): The encrypted value, a :class:`~bson.binary.Binary` with subtype 6. :return: The decrypted BSON value. z :rPc |VP4VPfQhVPPRV/4#)zGet a data key by id. :param id` (Binary): The UUID of a key a which must be a :class:`~bson.binary.Binary` with subtype 4 ( :attr:`~bson.binary.UUID_SUBTYPE`). :return: The key document. .. versionadded:: 4.2 rr.rvfind_onerors&&rNget_keyClientEncryption.get_key@s= ##///##,,eR[99rPcV^8dQhRR/#)rHrKzCursor[RawBSONDocument]rL)rMs"rNrOreOs - -1 -rPc xVP4VPfQhVPP/4#)zGet all of the data keys. :return: An instance of :class:`~pymongo.cursor.Cursor` over the data key documents. .. versionadded:: 4.2 )r.rvrrs&rNget_keysClientEncryption.get_keysOs9 ##///##((,,rPc V^8dQhRRRR/#)rHrrrKr5rL)rMs"rNrOre[s <  ##///##,,m\-JKKrPc$V^8dQhRRRRRR/#)rHrrrrrKrrL)rMs"rNrOres'"O"Of"OC"OD]"OrPc  VP4RRRRRV../RRRRR R R V.///.///.pVPfQhVPPR V/V4#) aRemove ``key_alt_name`` from the set of keyAltNames in the key document with UUID ``id``. Also removes the ``keyAltNames`` field from the key document if it would otherwise be empty. :param id: The UUID of a key a which must be a :class:`~bson.binary.Binary` with subtype 4 ( :attr:`~bson.binary.UUID_SUBTYPE`). :param key_alt_name: The key alternate name to remove. :return: Returns the previous version of the key document. .. versionadded:: 4.2 $setrz$condz$eqz $keyAltNamesz$$REMOVEz$filterinputcondz$nez$$thisrr)rorrpipelines&&& rNremove_key_alt_name$ClientEncryption.remove_key_alt_names !"^l^$DE& )$+^$*UX|4L,M," " $   $##///##77 XNNrPc(V^8dQhRRRRRRRR/#) rHrr+rr{r|rcrKrrL)rMs"rNrOres28/8/!8/ 8/0 8/ ! 8/rPc bVeVf \R4hVP4\4;_uu_4VPP WV4pVf\ 4uuRRR4#RRR4\ X\4p.pVR,FCpRRVR,RVR,/RRR //p\R VR ,/V4p VPV 4KE V'g \ 4#VPfQhVPPV4p \ V 4# +'giL;i) agDecrypts and encrypts all matching data keys in the key vault with a possibly new `master_key` value. :param filter: A document used to filter the data keys. :param provider: The new KMS provider to use to encrypt the data keys, or ``None`` to use the current KMS provider(s). :param master_key: The master key fields corresponding to the new KMS provider when ``provider`` is not ``None``. :return: A :class:`RewrapManyDataKeyResult`. This method allows you to re-encrypt all of your data-keys with a new CMK, or master key. Note that this does *not* require re-encrypting any of the data in your encrypted collections, but rather refreshes the key that protects the keys that encrypt the data: .. code-block:: python client_encryption.rewrap_many_data_key( filter={"keyAltNames": "optional filter for which keys you want to update"}, master_key={ "provider": "azure", # replace with your cloud provider "master_key": { # put the rest of your master_key options here "key": "" }, }, ) .. versionadded:: 4.2 Nz1A provider must be given if a master_key is givenrr keyMaterial masterKeyz $currentDate updateDateTr) r'r.rXrurewrap_many_data_keyrrrr/appendrv bulk_write) rorrr| raw_resultr replacementsr update_modelopresults &&&& rNr%ClientEncryption.rewrap_many_data_keys"F  !h&6$%XY Y  $ & &))>>vQ[\J!.0' &!' "*.FG 3<&v..%' &s *D D. cV^8dQhRR/#)rHrKzClientEncryption[_DocumentType]rL)rMs"rNrOres:rPc V#rrLrs&rN __enter__ClientEncryption.__enter__s rPc(V^8dQhRRRRRRRR/#)rHexc_typerexc_valexc_tbrKrtrL)rMs"rNrOres(sCDrPc &VP4R#r)r)rorrrs&&&&rN__exit__ClientEncryption.__exit__s  rPcV^8dQhRR/#rrL)rMs"rNrOrer:rPc 8VPf \R4hR#)Nz"Cannot use closed ClientEncryption)rur*rs&rNr.ClientEncryption._check_closeds    #"#GH H $rPcV^8dQhRR/#rrL)rMs"rNrOres$$t$rPc VP'dEVPP4VPP4RVnRVnR#R#)aRelease resources. Note that using this class in a with-statement will automatically call :meth:`close`:: with ClientEncryption(...) as client_encryption: encrypted = client_encryption.encrypt(value, ...) decrypted = client_encryption.decrypt(encrypted) N)rtrrurs&rNrClientEncryption.closesI        $ $ &    " " $!%D #D  rP)rrrurtrrvrrrm)NN)NNN)NNNNNFN)NNNNNN)NNNNN)rrrrrrprrrr/rr7rrrrrrrrrr.rrrLrPrNr_r_Isv6EANWKrYv1.f< |5 nQ" : - <M" L"OH8/tI$$rPr_)__conditional_annotations__r __future__r contextlibenumrrrrgcopyrtypingrrrrrr r r r r rrpymongocrypt.errorsrpymongocrypt.mongocryptr'pymongocrypt.synchronous.auto_encrypterr+pymongocrypt.synchronous.explicit_encrypterr&pymongocrypt.synchronous.state_machinerro ImportErrorobjectbsonrrr bson.binaryrrrbson.codec_optionsr bson.errorsr bson.raw_bsonrrrpymongor pymongo.commonr!pymongo.daemonr"pymongo.encryption_optionsr#r$r%r&pymongo.errorsr'r(r)r*r+r,pymongo.helpers_sharedr-rr.pymongo.operationsr/pymongo.pool_optionsr0pymongo.pool_sharedr1r2pymongo.read_concernr3pymongo.resultsr4r5pymongo.ssl_supportr6r7pymongo.synchronous.collectionr8pymongo.synchronous.cursorr9pymongo.synchronous.databaser: pymongo.synchronous.mongo_clientr;pymongo.typingsr<r=pymongo.uri_parser_sharedr>r?pymongo.write_concernr@rApymongo.pyopenssl_contextrBrCrnrrrrrF__annotations__rkrUcontextmanagerrXrZrrEnumrArOrr_)rs@rNr$s?"       39E /.66+!RR*( 8)(,-9C5-18;H.<2(  &/;S>x0, o>\  , ,X+&X+vII.u)u)p!TYY!H'TYY'TFv $w}-v $k  s G'' G65G6