Skip to content

RUBY-3601 Wrap error when mongocrypt_kms_ctx_fail returns false#3082

Open
comandeo-mongo wants to merge 2 commits into
mongodb:masterfrom
comandeo-mongo:RUBY-3601-wrap-kms-fail-error
Open

RUBY-3601 Wrap error when mongocrypt_kms_ctx_fail returns false#3082
comandeo-mongo wants to merge 2 commits into
mongodb:masterfrom
comandeo-mongo:RUBY-3601-wrap-kms-fail-error

Conversation

@comandeo-mongo

Copy link
Copy Markdown
Contributor

When a KMS request exhausts its retries, mongocrypt_kms_ctx_fail returns
false. Previously the driver re-raised only the last network error, discarding
the status message from mongocrypt_ctx_kms_status that indicates a retry
occurred (e.g. "KMS request failed after 3 retries due to a network error").

This wraps the status message with the last attempt's error so users get
actionable information about both the retry exhaustion and the underlying
cause. Mirrors the approach suggested in MONGOCRYPT-752 and used by the Python
and C drivers.

Changes

  • lib/mongo/crypt/binding.rb: add Binding.kms_ctx_status to read the KMS
    context status into a Status without raising; check_kms_ctx_status now
    reuses it.
  • lib/mongo/crypt/context.rb: on retry exhaustion, feed_kms raises a
    KmsError combining the status message with the last error, via the new
    raise_kms_retry_error helper.
  • spec/integration/client_side_encryption/kms_retry_prose_spec.rb: assert the
    wrapped message includes "last attempt failed with:".

Test plan

  • bundle exec rubocop lib/mongo/crypt/binding.rb lib/mongo/crypt/context.rb spec/integration/client_side_encryption/kms_retry_prose_spec.rb — no offenses
  • bundle exec rspec spec/integration/client_side_encryption/kms_retry_prose_spec.rb against local cluster + KMS failpoint mock — 3 AWS examples pass (GCP/Azure pending as before)

Jira: https://jira.mongodb.org/browse/RUBY-3601

When KMS retries are exhausted, wrap the status message from
mongocrypt_kms_ctx_status (which indicates the retry occurred) with
the error from the last attempt, instead of re-raising only the last
network error. See MONGOCRYPT-752.
@comandeo-mongo comandeo-mongo marked this pull request as ready for review July 16, 2026 10:35
@comandeo-mongo comandeo-mongo requested a review from a team as a code owner July 16, 2026 10:35
@comandeo-mongo comandeo-mongo requested review from Copilot and jamis July 16, 2026 10:35

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Improves client-side encryption KMS retry error reporting by preserving the libmongocrypt KMS context status message when retries are exhausted, and wrapping it together with the last network failure message to provide more actionable diagnostics.

Changes:

  • Added Mongo::Crypt::Binding.kms_ctx_status to retrieve a KMS context Status without raising, and refactored check_kms_ctx_status to use it.
  • Updated Mongo::Crypt::Context#feed_kms to raise a wrapped Mongo::Error::KmsError on retry exhaustion via raise_kms_retry_error.
  • Tightened the KMS retry prose spec to assert the new wrapped message includes last attempt failed with:.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File Description
lib/mongo/crypt/binding.rb Exposes KMS ctx status retrieval without raising and reuses it in existing status-check helper.
lib/mongo/crypt/context.rb Wraps retry-exhaustion status message with the last network error for improved KMS failure diagnostics.
spec/integration/client_side_encryption/kms_retry_prose_spec.rb Verifies the new wrapped error message format.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

OpenSSL surfaces the missing-client-cert failure as a 'tlsv13 alert
certificate required' message (space, not underscore) rather than a
socket reset in some environments. Broaden the regex to accept it so
the test is robust to how the peer rejects the handshake.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants