Support property-based explicit field encryption

[christophstrobl]

Extend the property based conversion feature to combine @Encrypted with @ValueConverter into a single annotation that is evaluated when mapping domain types into their store native representation and back.

@Encrypted
@ValueConverter(MongoCryptConverter.class)
@interface EncryptedField {

        @AliasFor(annotation = ValueConverter.class, value = "value")
        Class<? extends PropertyValueConverter> converter() default MongoCryptConverter.class;

	@AliasFor(annotation = Encrypted.class, value = "algorithm")
	String algorithm() default "";

	String altKeyName() default "";
}

The annotation can be applied on a per property basis covering simple values (like String, Integer) as well as complex ones (like an Address) or entire collections of values as outlined below.

@Document
public class Person {

	String id;
	String name;

	@EncryptedField(algorithm = AEAD_AES_256_CBC_HMAC_SHA_512_Deterministic) 
	String ssn;

	@EncryptedField(algorithm = AEAD_AES_256_CBC_HMAC_SHA_512_Random, altKeyName = "secret-key")
	String wallet;

	@EncryptedField(algorithm = AEAD_AES_256_CBC_HMAC_SHA_512_Random)
	Address address;

	@EncryptedField(algorithm = AEAD_AES_256_CBC_HMAC_SHA_512_Random)
	List<Address> listOfComplex;

	// use the value stored in Person.name as value for the altKeyName attribute
	@EncryptedField(algorithm = AEAD_AES_256_CBC_HMAC_SHA_512_Random, altKeyName = "/name")
	String viaAltKeyNameField;

	// ...
}

The EncryptingConverter SPI offers dedicated methods to en-/decrypt objects using an EncryptionContext that provides access to the underlying encryption engine plus all the additional information derived from the target property itself.

interface EncryptingConverter extends MongoValueConverter<Object, Object> {

	@Override
	default Object read(Object value, MongoConversionContext context) {
	    return decrypt(value, buildEncryptionContext(context));
	}	

	@Override
	default BsonBinary write(Object value, MongoConversionContext context) {
		return encrypt(value, buildEncryptionContext(context));
	}

	Object decrypt(Object value, MongoEncryptionContext context);

	BsonBinary encrypt(Object value, MongoEncryptionContext context)
	
	MongoEncryptionContext buildEncryptionContext(MongoConversionContext context);
}

The default implementation (MongoCryptConverter implements EncryptingConverter) will be using com.mongodb.client.vault.ClientEncryption for en-/decrypt operations and is set as default for @EncryptedField(converter).

To use explicit encryption in a reactive setup one can choose to use the imperative converter (still using the sync mongodb encryption library) within the reactive flow or switch the default converter to a fully reactive variant (using the drivers reactive streams API) resolving values on subscribe.

interface ReactiveEncryptingConverter extends MongoValueConverter<Object, Object> {

	@Override
	default Object read(Object value, MongoConversionContext context) {
	    return decrypt(value, buildEncryptionContext(context));
	}	

	@Override
	default BsonBinary write(Object value, MongoConversionContext context) {
		return encrypt(value, buildEncryptionContext(context));
	}

	Mono<Object> decrypt(Object value, MongoEncryptionContext context);

	Mono<BsonBinary> encrypt(Object value, MongoEncryptionContext context)

	ManualEncryptionContext buildEncryptionContext(MongoConversionContext context);
}