pymongocrypt_explicit_encryption_context_with_local_key_provider.py

1import os
2from bson import Binary
3from pymongocrypt.binding import MongoCrypt, MongoCryptOptions, ExplicitEncryptionContextOptions
4
5# 1. Create a 96-byte local master key
6local_key = os.urandom(96)
7kms_providers = {'local': {'key': local_key}}
8
9# 2. Configure MongoCrypt options
10opts = MongoCryptOptions(kms_providers)
11crypt = MongoCrypt(opts)
12
13# 3. Create an explicit encryption context
14# In a real application, 'key_id' would be a UUID from a key vault collection
15key_id = Binary(os.urandom(16), 4)
16ctx_opts = ExplicitEncryptionContextOptions(
17    key_id=key_id,
18    algorithm='AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
19)
20
21# Use the context to encrypt a value
22with crypt.explicit_encryption_context(Binary(b"my-secret-value", 0), ctx_opts) as ctx:
23    # This state machine would typically be driven by the driver (PyMongo)
24    # but pymongocrypt provides the low-level binding for these operations.
25    print(f"Encryption context state: {ctx.state}")