feat: add MongoDB Client-Side Field Level Encryption support

.github/workflows/checks.yaml

@@ -15,8 +15,8 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
-          cache: 'npm'
+          node-version: 22
+          cache: "npm"
       - name: Install deps
         run: npm ci --include=optional
       # - name: Lint check

.github/workflows/prerelease.yaml

@@ -27,8 +27,8 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
-          cache: 'npm'
+          node-version: 22
+          cache: "npm"
           registry-url: https://registry.npmjs.org/
       - name: Install deps
         run: npm ci --include=optional

.github/workflows/release.yaml

@@ -28,8 +28,8 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
-          cache: 'npm'
+          node-version: 22
+          cache: "npm"
           registry-url: https://registry.npmjs.org/
       - name: Install deps
         run: npm ci --include=optional

eslint.config.mjs

@@ -30,5 +30,8 @@ export default tseslint.config(
         }
       ]
     }
+  },
+  {
+    ignores: ["**/dist"]
   }
 )

package.json

@@ -73,6 +73,7 @@
     "jest-environment-node": "^29.4.1",
     "markdownlint-cli2": "^0.15.0",
     "mongodb": "^6.21.0",
+    "mongodb-client-encryption": "^6.5.0",
     "nx": "19.4.1",
     "prettier": "^3.2.5",
     "rimraf": "^5.0.7",

packages/demo/packages/backend/data_sources/mongodb-atlas/flowerbase-demo/todos/encryption.json

@@ -0,0 +1,26 @@
+{
+  "database": "flowerbase-demo",
+  "collection": "todos",
+  "schema": {
+    "title": "todo",
+    "bsonType": "object",
+    "encryptMetadata": {
+      "keyAlias": "prod-data-key"
+    },
+    "properties": {
+      "title": {
+        "encrypt": {
+          "bsonType": "string",
+          "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random",
+          "keyAlias": "dev-data-key"
+        }
+      },
+      "secureNote": {
+        "encrypt": {
+          "bsonType": "string",
+          "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
+        }
+      }
+    }
+  }
+}

packages/demo/packages/backend/index.ts

@@ -1,15 +1,45 @@
-import { initialize } from '@flowerforce/flowerbase';
+import { initialize, InitializeConfig } from '@flowerforce/flowerbase';
 
 const projectId = process.env.PROJECT_ID ?? "my-project-id"
 const port = process.env.PORT ? Number(process.env.PORT) : undefined
 const mongodbUrl = process.env.DB_CONNECTION_STRING
 const jwtSecret = process.env.APP_SECRET
 const host = process.env.HOST
 
+// Pass `mongodbEncryptionConfig` to `initialize` to enable Client-Side Field Level Encryption
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+const mongodbEncryptionConfig: InitializeConfig["mongodbEncryptionConfig"] = {
+    extraOptions: {
+        cryptSharedLibPath: "__path_to_crypt_shared__",
+        cryptSharedLibRequired: true
+    },
+    kmsProviders: [
+        {
+            provider: "aws",
+            keyAlias: "prod-data-key",
+            config: {
+                accessKeyId: process.env.AWS_ACCESS_KEY_ID!,
+                secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!
+            },
+            masterKey: {
+                key: "arn:aws:kms:eu-central-1:123456789:key/123456789",
+                region: "eu-central-1"
+            }
+        },
+        {
+            provider: "local",
+            keyAlias: "dev-data-key",
+            config: {
+                key: "DE1+JeO3S2BTXar3FScBFsSnuz1TjhppXfqi9IBNA2JmVJx9lkBtcDu13/uzzL78r16iVeKKKLgzfOrXLrU+OqfjbaqzugOSbF/1I1q8pZP29vMzl625Thb2s1QEgMlF"
+            },
+        }
+    ]
+}
+
 initialize({
     projectId,
     port,
     mongodbUrl,
     jwtSecret,
-    host
+    host,
 })