Queryable Encryption

Fields encrypted on the client that you can query without the server seeing the values.

TeselaDB implements the server side of MongoDB's Queryable Encryption and Client-Side Field Level Encryption (CSFLE). Your driver encrypts and decrypts the fields on the client; the server stores the encrypted values and answers equality or range queries and text searches on them without ever seeing the plaintext.

Requirements

A MongoDB driver with Queryable Encryption and a key provider (KMS).

How to use it

As with MongoDB: you configure the driver with autoEncryption, your key provider (KMS) and the map of encrypted fields. Nothing changes on the server.

JavaScript

const client = new MongoClient(uri, {
  autoEncryption: {
    keyVaultNamespace: "encryption.__keyVault",
    kmsProviders: { local: { key: localMasterKey } },
    encryptedFieldsMap: {
      "clinic.patients": {
        fields: [{ path: "nationalId", bsonType: "string", queries: { queryType: "equality" } }],
      },
    },
  },
});

What the server does

It keeps the Queryable Encryption metadata collections, resolves queries on the encrypted tags and enforces the CSFLE schemas. The query types MongoDB 9.0 marks as deprecated (*Preview) are not implemented.

Check

A client without autoEncryption sees the encrypted fields as binary values, never in plaintext.

Common problems

A query with a *Preview type fails because those types are deprecated in MongoDB 9.0 and not implemented. Use the type without the suffix.