PYTHON-5309 Ensure AsyncMongoClient doesn't use PyOpenSSL

pymongo/asynchronous/encryption.py

@@ -157,7 +157,7 @@ def __init__(
         self.mongocryptd_client = mongocryptd_client
         self.opts = opts
         self._spawned = False
-        self._kms_ssl_contexts = _parse_kms_tls_options(opts._kms_tls_options, _IS_SYNC)
+        self._kms_ssl_contexts = opts._kms_ssl_contexts(_IS_SYNC)
 
     async def kms_request(self, kms_context: MongoCryptKmsContext) -> None:
         """Complete a KMS request.
@@ -398,6 +398,7 @@ def __init__(self, client: AsyncMongoClient[_DocumentTypeArg], opts: AutoEncrypt
             encrypted_fields_map = _dict_to_bson(opts._encrypted_fields_map, False, _DATA_KEY_OPTS)
         self._bypass_auto_encryption = opts._bypass_auto_encryption
         self._internal_client = None
+        opts._kms_ssl_contexts(_IS_SYNC)
 
         def _get_internal_client(
             encrypter: _Encrypter, mongo_client: AsyncMongoClient[_DocumentTypeArg]

pymongo/encryption_options.py

@@ -20,6 +20,8 @@
 
 from typing import TYPE_CHECKING, Any, Mapping, Optional
 
+from pymongo.uri_parser_shared import _parse_kms_tls_options
+
 try:
     import pymongocrypt  # type:ignore[import-untyped] # noqa: F401
 
@@ -34,6 +36,7 @@
 from pymongo.errors import ConfigurationError
 
 if TYPE_CHECKING:
+    from pymongo.pyopenssl_context import SSLContext
     from pymongo.typings import _AgnosticMongoClient, _DocumentTypeArg
 
 
@@ -236,9 +239,21 @@ def __init__(
             self._mongocryptd_spawn_args.append("--idleShutdownTimeoutSecs=60")
         # Maps KMS provider name to a SSLContext.
         self._kms_tls_options = kms_tls_options
+        self._sync_kms_ssl_contexts: dict[str, SSLContext] = None  # type:ignore[assignment]
+        self._async_kms_ssl_contexts: dict[str, SSLContext] = None  # type:ignore[assignment]
         self._bypass_query_analysis = bypass_query_analysis
         self._key_expiration_ms = key_expiration_ms
 
+    def _kms_ssl_contexts(self, is_sync: bool) -> dict[str, SSLContext]:
+        if is_sync:
+            if self._sync_kms_ssl_contexts is None:
+                self._sync_kms_ssl_contexts = _parse_kms_tls_options(self._kms_tls_options, True)
+            return self._sync_kms_ssl_contexts
+        else:
+            if self._async_kms_ssl_contexts is None:
+                self._async_kms_ssl_contexts = _parse_kms_tls_options(self._kms_tls_options, False)
+            return self._async_kms_ssl_contexts
+
 
 class RangeOpts:
     """Options to configure encrypted queries using the range algorithm."""

pymongo/synchronous/encryption.py

@@ -156,7 +156,7 @@ def __init__(
         self.mongocryptd_client = mongocryptd_client
         self.opts = opts
         self._spawned = False
-        self._kms_ssl_contexts = _parse_kms_tls_options(opts._kms_tls_options, _IS_SYNC)
+        self._kms_ssl_contexts = opts._kms_ssl_contexts(_IS_SYNC)
 
     def kms_request(self, kms_context: MongoCryptKmsContext) -> None:
         """Complete a KMS request.
@@ -395,6 +395,7 @@ def __init__(self, client: MongoClient[_DocumentTypeArg], opts: AutoEncryptionOp
             encrypted_fields_map = _dict_to_bson(opts._encrypted_fields_map, False, _DATA_KEY_OPTS)
         self._bypass_auto_encryption = opts._bypass_auto_encryption
         self._internal_client = None
+        opts._kms_ssl_contexts(_IS_SYNC)
 
         def _get_internal_client(
             encrypter: _Encrypter, mongo_client: MongoClient[_DocumentTypeArg]

test/asynchronous/test_encryption.py

@@ -170,8 +170,7 @@ async def test_init_kms_tls_options(self):
         # Error cases:
         opts = AutoEncryptionOpts({}, "k.d", kms_tls_options={"kmip": 1})
         with self.assertRaisesRegex(TypeError, r'kms_tls_options\["kmip"\] must be a dict'):
-            client = await self.async_rs_or_single_client(auto_encryption_opts=opts)
-            await client.db.coll.insert_one({"encrypted": "test"})
+            AsyncMongoClient(auto_encryption_opts=opts)
 
         tls_opts: Any
         for tls_opts in [
@@ -181,14 +180,12 @@ async def test_init_kms_tls_options(self):
         ]:
             opts = AutoEncryptionOpts({}, "k.d", kms_tls_options=tls_opts)
             with self.assertRaisesRegex(ConfigurationError, "Insecure TLS options prohibited"):
-                client = await self.async_rs_or_single_client(auto_encryption_opts=opts)
-                await client.db.coll.insert_one({"encrypted": "test"})
+                AsyncMongoClient(auto_encryption_opts=opts)
         opts = AutoEncryptionOpts(
             {}, "k.d", kms_tls_options={"kmip": {"tlsCAFile": "does-not-exist"}}
         )
         with self.assertRaises(FileNotFoundError):
-            client = await self.async_rs_or_single_client(auto_encryption_opts=opts)
-            await client.db.coll.insert_one({"encrypted": "test"})
+            AsyncMongoClient(auto_encryption_opts=opts)
         # Success cases:
         tls_opts: Any
         for tls_opts in [None, {}]:

test/test_encryption.py

@@ -170,8 +170,7 @@ def test_init_kms_tls_options(self):
         # Error cases:
         opts = AutoEncryptionOpts({}, "k.d", kms_tls_options={"kmip": 1})
         with self.assertRaisesRegex(TypeError, r'kms_tls_options\["kmip"\] must be a dict'):
-            client = self.rs_or_single_client(auto_encryption_opts=opts)
-            client.db.coll.insert_one({"encrypted": "test"})
+            MongoClient(auto_encryption_opts=opts)
 
         tls_opts: Any
         for tls_opts in [
@@ -181,14 +180,12 @@ def test_init_kms_tls_options(self):
         ]:
             opts = AutoEncryptionOpts({}, "k.d", kms_tls_options=tls_opts)
             with self.assertRaisesRegex(ConfigurationError, "Insecure TLS options prohibited"):
-                client = self.rs_or_single_client(auto_encryption_opts=opts)
-                client.db.coll.insert_one({"encrypted": "test"})
+                MongoClient(auto_encryption_opts=opts)
         opts = AutoEncryptionOpts(
             {}, "k.d", kms_tls_options={"kmip": {"tlsCAFile": "does-not-exist"}}
         )
         with self.assertRaises(FileNotFoundError):
-            client = self.rs_or_single_client(auto_encryption_opts=opts)
-            client.db.coll.insert_one({"encrypted": "test"})
+            MongoClient(auto_encryption_opts=opts)
         # Success cases:
         tls_opts: Any
         for tls_opts in [None, {}]: