Java Meets Queryable Encryption: Developing a Secure Bank Account Application

    <dependency>
       <groupId>org.projectlombok</groupId>
       <artifactId>lombok</artifactId>
       <optional>true</optional>
    </dependency>
    <dependency>
       <groupId>org.mongodb</groupId>
       <artifactId>mongodb-driver-sync</artifactId>
       <version>5.1.3</version>
    </dependency>
    <dependency>
       <groupId>org.mongodb</groupId>
       <artifactId>mongodb-crypt</artifactId>
       <version>1.11.0</version>
    </dependency>

    app.mongodb.uri=mongodb+srv://user:password@cluster0.cluster.mongodb.net/
    app.mongodb.kmsProviderName=local
    app.mongodb.keyVaultNamespace=encryption.__keyVault
    app.mongodb.encryptedDatabaseName=digitalBank
    app.mongodb.encryptedCollectionName=accounts
    app.mongodb.cryptSharedLibPath=/<path-to-lib>/mongo_crypt_v1.dylib

    package com.mongodb.bankaccount.resources.config;

    import com.mongodb.AutoEncryptionSettings;
    import com.mongodb.ClientEncryptionSettings;
    import com.mongodb.ConnectionString;
    import com.mongodb.MongoClientSettings;
    import com.mongodb.client.MongoDatabase;
    import lombok.Data;
    import org.springframework.boot.ApplicationRunner;
    import org.springframework.boot.context.properties.ConfigurationProperties;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import java.io.File;
    import java.io.FileInputStream;
    import java.io.FileOutputStream;
    import java.io.IOException;
    import java.security.SecureRandom;
    import java.util.HashMap;
    import java.util.Map;

    @Data
    @Configuration
    @ConfigurationProperties(prefix = "app.mongodb")
    public class EncryptionConfig {

       private String uri;
       private String kmsProviderName;
       private String keyVaultNamespace;
       private String encryptedDatabaseName;
       private String encryptedCollectionName;
       private String cryptSharedLibPath;

       private static final String CUSTOMER_KEY_PATH = "src/main/resources/customer-key.txt";
       private static final int KEY_SIZE = 96;
       private final Map<String, Map<String, Object>> kmsProviderCredentials = new HashMap<>();

       @Bean
       public ApplicationRunner createEncryptedCollectionRunner(MongoDatabase db, EncryptionFieldConfig encryptionFieldConfig) {
           return args -> {
               if (!encryptionFieldConfig.collectionExists(db, encryptedCollectionName)) {
                   encryptionFieldConfig.createEncryptedCollection(db, clientEncryptionSettings());
               }
           };
       }

       private ClientEncryptionSettings clientEncryptionSettings() throws Exception {
           return ClientEncryptionSettings.builder()
                   .keyVaultMongoClientSettings(getMongoClientSettings())
                   .keyVaultNamespace(keyVaultNamespace)
                   .kmsProviders(kmsProviderCredentials)
                   .build();
       }

       protected MongoClientSettings getMongoClientSettings() throws Exception {
           kmsProviderCredentials.put("local", createLocalKmsProvider());

           AutoEncryptionSettings autoEncryptionSettings = AutoEncryptionSettings.builder()
                   .keyVaultNamespace(keyVaultNamespace)
                   .kmsProviders(kmsProviderCredentials)
                   .extraOptions(createExtraOptions())
                   .build();

           return MongoClientSettings.builder()
                   .applyConnectionString(new ConnectionString(uri))
                   .autoEncryptionSettings(autoEncryptionSettings)
                   .build();
       }

       private Map<String, Object> createLocalKmsProvider() throws IOException {
           if (!isCustomerMasterKeyFileExists()) {
               generateCustomerMasterKey();
           }

           byte[] localCustomerMasterKey = readCustomerMasterKey();
           Map<String, Object> keyMap = new HashMap<>();
           keyMap.put("key", localCustomerMasterKey);
           return keyMap;
       }

       private boolean isCustomerMasterKeyFileExists() {
           return new File(CUSTOMER_KEY_PATH).isFile();
       }

       private void generateCustomerMasterKey() throws IOException {
           byte[] localCustomerMasterKey = new byte[KEY_SIZE];
           new SecureRandom().nextBytes(localCustomerMasterKey);
           try (FileOutputStream stream = new FileOutputStream(CUSTOMER_KEY_PATH)) {
               stream.write(localCustomerMasterKey);
           } catch (IOException e) {
               throw new IOException("Unable to write Customer Master Key file: " + e.getMessage(), e);
           }
       }

       private byte[] readCustomerMasterKey() throws IOException {
           byte[] localCustomerMasterKey = new byte[KEY_SIZE];

           try (FileInputStream fis = new FileInputStream(CUSTOMER_KEY_PATH)) {
               int bytesRead = fis.read(localCustomerMasterKey);
               if (bytesRead != KEY_SIZE) {
                   throw new IOException("Expected the customer master key file to be " + KEY_SIZE + " bytes, but read " + bytesRead + " bytes.");
               }
           } catch (IOException e) {
               throw new IOException("Unable to read the Customer Master Key: " + e.getMessage(), e);
           }

           return localCustomerMasterKey;
       }

       private Map<String, Object> createExtraOptions() {
           Map<String, Object> extraOptions = new HashMap<>();
           extraOptions.put("cryptSharedLibPath", cryptSharedLibPath);
           return extraOptions;
       }
    }

    package com.mongodb.bankaccount.resources.config;

    import com.mongodb.ClientEncryptionSettings;
    import com.mongodb.client.MongoDatabase;
    import com.mongodb.client.model.CreateCollectionOptions;
    import com.mongodb.client.model.CreateEncryptedCollectionParams;
    import com.mongodb.client.vault.ClientEncryptions;
    import org.bson.*;
    import org.springframework.context.annotation.Configuration;
    import java.util.ArrayList;
    import java.util.Arrays;

    @Configuration
    public class EncryptionFieldConfig {

       protected boolean collectionExists(MongoDatabase db, String collectionName) {
           return db.listCollectionNames().into(new ArrayList<>()).contains(collectionName);
       }

       protected void createEncryptedCollection(MongoDatabase db, ClientEncryptionSettings clientEncryptionSettings) {
           var clientEncryption = ClientEncryptions.create(clientEncryptionSettings);
           var encryptedCollectionParams = new CreateEncryptedCollectionParams("local")
                   .masterKey(new BsonDocument());

           var createCollectionOptions = new CreateCollectionOptions().encryptedFields(encryptFields());
           clientEncryption.createEncryptedCollection(db, "accounts", createCollectionOptions, encryptedCollectionParams);
       }

       private BsonDocument encryptFields() {
           return new BsonDocument().append("fields",
                   new BsonArray(Arrays.asList(
                           createEncryptedField("accountNumber", "string", equalityQueryType()),
                           createEncryptedField("cardVerificationCode", "int", equalityQueryType()),
                           createEncryptedField("accountBalance", "double", rangeQueryType()
                           ))));
       }

       private BsonDocument createEncryptedField(String path, String bsonType, BsonDocument query) {
           return new BsonDocument()
                   .append("keyId", new BsonNull())
                   .append("path", new BsonString(path))
                   .append("bsonType", new BsonString(bsonType))
                   .append("queries", query);
       }

       private BsonDocument rangeQueryType() {
           return new BsonDocument()
                   .append("queryType", new BsonString("range"))
                   .append("min", new BsonDouble(0))
                   .append("max", new BsonDouble(999999999))
                   .append("precision", new BsonInt32(2));
       }

       private BsonDocument equalityQueryType() {
           return new BsonDocument().append("queryType", new BsonString("equality"));
       }
    }

    package com.mongodb.bankaccount.resources.config;

    import com.mongodb.MongoClientSettings;
    import com.mongodb.client.MongoClient;
    import com.mongodb.client.MongoClients;
    import com.mongodb.client.MongoDatabase;
    import org.bson.codecs.configuration.CodecProvider;
    import org.bson.codecs.configuration.CodecRegistry;
    import org.bson.codecs.pojo.PojoCodecProvider;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import static com.mongodb.MongoClientSettings.getDefaultCodecRegistry;
    import static org.bson.codecs.configuration.CodecRegistries.fromProviders;
    import static org.bson.codecs.configuration.CodecRegistries.fromRegistries;

    @Configuration
    public class MongoConfig {

       private final EncryptionConfig encryptionConfig;

       public MongoConfig(EncryptionConfig encryptionConfig) {
           this.encryptionConfig = encryptionConfig;
       }

       @Bean
       public MongoClient mongoClient() throws Exception {
           MongoClientSettings mongoClientSettings = encryptionConfig.getMongoClientSettings();
           return MongoClients.create(mongoClientSettings);
       }

       @Bean
       public MongoDatabase mongoDatabase(MongoClient mongoClient) {
           CodecProvider pojoCodecProvider = PojoCodecProvider.builder().automatic(true).build();
           CodecRegistry pojoCodecRegistry = fromRegistries(getDefaultCodecRegistry(), fromProviders(pojoCodecProvider));

           return mongoClient.getDatabase(encryptionConfig.getEncryptedDatabaseName()).withCodecRegistry(pojoCodecRegistry);
       }
    }

    package com.mongodb.bankaccount;

    import com.mongodb.bankaccount.resources.config.EncryptionConfig;
    import org.springframework.boot.SpringApplication;
    import org.springframework.boot.autoconfigure.SpringBootApplication;
    import org.springframework.boot.context.properties.EnableConfigurationProperties;

    @SpringBootApplication
    @EnableConfigurationProperties(EncryptionConfig.class)
    public class BankaccountApplication {

       public static void main(String[] args) {
          SpringApplication.run(BankaccountApplication.class, args);
       }
    }

    package com.mongodb.bankaccount.resources;

    import com.mongodb.bankaccount.domain.BankAccount;

    public record BankAccountEntity(
           String accountHolderName,
           String accountNumber,
           int cardVerificationCode,
           Double accountBalance) {
       public BankAccount toDomain() {
           return new BankAccount(accountHolderName, accountNumber, cardVerificationCode, accountBalance);
       }
    }

    package com.mongodb.bankaccount.resources;

    import com.mongodb.bankaccount.domain.BankAccount;
    import com.mongodb.bankaccount.domain.BankAccountPort;
    import com.mongodb.client.MongoCollection;
    import com.mongodb.client.MongoDatabase;
    import com.mongodb.client.result.InsertOneResult;
    import org.bson.types.ObjectId;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    import org.springframework.stereotype.Repository;
    import java.util.ArrayList;
    import java.util.List;
    import java.util.Objects;
    import java.util.stream.Collectors;
    import static com.mongodb.client.model.Filters.eq;
    import static com.mongodb.client.model.Filters.gt;

    @Repository
    public class BankAccountRepository implements BankAccountPort {
       private static final Logger logger = LoggerFactory.getLogger(BankAccountRepository.class);
       private static final String COLLECTION_NAME = "accounts";
       private final MongoCollection<BankAccountEntity> collection;

       BankAccountRepository(MongoDatabase mongoDatabase) {
           this.collection = mongoDatabase.getCollection(COLLECTION_NAME, BankAccountEntity.class);
       }

       @Override
       public String insert(BankAccount bankAccount) {
           try {
               InsertOneResult insertOneResult = collection.insertOne(bankAccount.toEntity());
               ObjectId result = Objects.requireNonNull(insertOneResult.getInsertedId()).asObjectId().getValue();

               logger.info("{} was created", result);

               return result.toHexString();
           } catch (Exception e) {
               logger.error(e.getMessage(), e);
               throw new RuntimeException("Error inserting bank account", e);
           }
       }

       @Override
       public List<BankAccount> find() {
           try {
               ArrayList<BankAccountEntity> bankAccounts = new ArrayList<>();
               collection.find().into(bankAccounts);

               return bankAccounts.stream()
                       .map(BankAccountEntity::toDomain)
                       .collect(Collectors.toList());

           } catch (Exception e) {
               logger.error(e.getMessage(), e);
               throw new RuntimeException("Error finding bank account", e);
           }
       }

       @Override
       public List<BankAccount> findByBalanceGreaterThan(double value) {
           try {
               ArrayList<BankAccountEntity> bankAccounts = new ArrayList<>();
               collection.find(gt("accountBalance", value)).into(bankAccounts);

               return bankAccounts.stream()
                       .map(BankAccountEntity::toDomain)
                       .collect(Collectors.toList());

           } catch (Exception e) {
               logger.error(e.getMessage(), e);
               throw new RuntimeException("Error finding bank account", e);
           }
       }

       @Override
       public BankAccount findByAccountNumber(String accountNumber) {
           try {
               BankAccountEntity result = collection.find(eq("accountNumber", accountNumber)).first();

               if (result == null) {
                   return null;
               }

               return result.toDomain();

           } catch (Exception e) {
               logger.error(e.getMessage(), e);
               throw new RuntimeException("Error finding bank account", e);
           }

       }
    }

    package com.mongodb.bankaccount.domain;

    import com.mongodb.bankaccount.application.web.BankResponse;
    import com.mongodb.bankaccount.resources.BankAccountEntity;

    public record BankAccount(
       String accountHolderName,
       String accountNumber,
       int cardVerificationCode,
       Double accountBalance) {
       public BankResponse toResponse() {
           return new BankResponse(accountHolderName, accountNumber, cardVerificationCode, accountBalance);
       }

       public BankAccountEntity toEntity() {
           return new BankAccountEntity(accountHolderName, accountNumber, cardVerificationCode, accountBalance);
       }
    }

    package com.mongodb.bankaccount.domain;

    import java.util.List;

    public interface BankAccountPort {
       String insert(BankAccount bankAccount);
       List<BankAccount> find();
       List<BankAccount> findByBalanceGreaterThan(double value);
       BankAccount findByAccountNumber(String accountNumber);
    }

    package com.mongodb.bankaccount.domain;

    import org.springframework.stereotype.Service;
    import java.util.List;
    import java.util.Objects;

    @Service
    public class BankAccountService {

       BankAccountPort bankAccountPort;

       BankAccountService(BankAccountPort bankAccountPort) {
           this.bankAccountPort = bankAccountPort;
       }

       public String insert(BankAccount bankAccount) {
           Objects.requireNonNull(bankAccount, "Bank account must not be null");    
           return bankAccountPort.insert(bankAccount);
        }

       public List<BankAccount> find() {
           return bankAccountPort.find();
       }

       public List<BankAccount> findByBalanceGreaterThan(double value) {
           return bankAccountPort.findByBalanceGreaterThan(value);
       }

       public BankAccount findByAccountNumber(String accountNumber) { 
           return bankAccountPort.findByAccountNumber(accountNumber);
       }

    }

    package com.mongodb.bankaccount.application.web;

    import com.mongodb.bankaccount.domain.BankAccount;
    import com.mongodb.bankaccount.domain.BankAccountService;
    import org.springframework.http.ResponseEntity;
    import org.springframework.web.bind.annotation.*;
    import java.util.List;

    @RestController
    @RequestMapping("/bank")
    public class BankController {

       BankAccountService bankAccountService;

       BankController(BankAccountService bankAccountService) {
           this.bankAccountService = bankAccountService;
       }

       @PostMapping
       ResponseEntity<String> create(@RequestBody BankRequest bankRequest) {
           return ResponseEntity.ok(bankAccountService.insert(bankRequest.toDomain()));
       }

       @GetMapping
       ResponseEntity<List<BankResponse>> getAllAccounts() {
           return ResponseEntity.ok(bankAccountService.find().stream().map(BankAccount::toResponse).toList());
       }

       @GetMapping("/balance/greaterThan/{value}")
       ResponseEntity<List<BankResponse>> findByBalanceGreaterThan(@PathVariable Double value) {
           return ResponseEntity.ok(bankAccountService.findByBalanceGreaterThan(value).stream().map(BankAccount::toResponse).toList());
       }

       @GetMapping("/accountNumber/{accountNumber}")
       ResponseEntity<BankResponse> getAccountByNumber(@PathVariable String accountNumber) {
           BankAccount bankAccount = bankAccountService.findByAccountNumber(accountNumber);
           if (bankAccount != null) {
               return ResponseEntity.ok(bankAccount.toResponse());
           } else {
               return ResponseEntity.notFound().build();
           }
       }
    }

    package com.mongodb.bankaccount.application.web;

    import com.mongodb.bankaccount.domain.BankAccount;

    record BankRequest(
           String accountHolderName,
           String accountNumber,
           int cardVerificationCode,
           Double accountBalance) {
       public BankAccount toDomain() {
           return new BankAccount(accountHolderName, accountNumber, cardVerificationCode, accountBalance);
       }
    }

    package com.mongodb.bankaccount.application.web;

    public record BankResponse(String accountHolderName,
                              String accountNumber,
                              int cardVerificationCode,
                              Double accountBalance) {
    }

./mvnw spring-boot:run

curl --location 'http://localhost:8080/bank' \
      --header 'Content-Type: application/json' \
      --data '{
      "accountHolderName": "Ricardo Mello",
      "accountNumber": "4527876391233218",
      "cardVerificationCode": "761",
      "accountBalance": 5000.2
      }'

curl --location 'http://localhost:8080/bank/accountNumber/{accountNumber}

curl --location 'http://localhost:8080/bank/balance/greaterThan/{value}'