Repository navigation
PYTHON-6154 Extract KMS connect helpers into dedicated modules - #3110
Merged
Merged
Conversation
Move the KMS connect plumbing out of the encryption modules into dedicated private modules, prep for the CSFLE HTTP proxy KMS connect helpers (PYTHON-6147): - pymongo/_kms_connect.py holds KMSConnectContext, the callback type aliases, and _close_rejected_kms_socket, shared by both APIs. - pymongo/{asynchronous,synchronous}/_kms_connect.py hold _connect_kms and _KMS_CONNECT_TIMEOUT; the synchronous module is generated by synchro. - encryption_options.py re-exports the public names unchanged. - test/asynchronous/test_kms_connect.py is expanded to cover the new helpers and test/test_kms_connect.py is its synchro-generated mirror.
Deliver the PR's stated goals:
- Rename pymongo/_kms_connect.py to pymongo/_kms_connect_shared.py, so
the shared module reads naturally next to the per-flavor
pymongo/{asynchronous,synchronous}/_kms_connect.py modules.
- Genericize the shared module docstring: it enumerated the module's
exact contents, which would go stale as helpers move in.
- Drop the PYTHON-6147 feature tests (HTTP proxy helpers and the prose
class) that leaked into this refactor and broke test collection: they
import HTTPProxyKMSConnect/AsyncHTTPProxyKMSConnect, which are added
by PYTHON-6147, not by this PR.
- Replace the synchro-mirrored test pair with a single hand-written
test/test_kms_connect.py, written once and parameterized over both
APIs through a Flavor facade (the 18 pre-existing tests, 32 variants,
byte-identical bodies). The async-side file is gone, so synchro no
longer mirrors it.
Deliver the PR's stated goals:
- Rename pymongo/_kms_connect.py to pymongo/_kms_connect_shared.py, so
the shared module reads naturally next to the per-API
pymongo/{asynchronous,synchronous}/_kms_connect.py modules.
- Genericize the shared module docstring: it enumerated the module's
exact contents, which would go stale as helpers move in.
- Drop the PYTHON-6147 feature tests (HTTP proxy helpers and the prose
class) that leaked into this refactor and broke test collection: they
import HTTPProxyKMSConnect/AsyncHTTPProxyKMSConnect, which are added
by PYTHON-6147, not by this PR.
- Replace the synchro-mirrored test pair with a single hand-written
test/test_kms_connect.py, written once and parameterized over both
APIs through a Facade class (the 18 pre-existing tests, 32 variants,
byte-identical bodies). The async-side file is gone, so synchro no
longer mirrors it.
- Tighten the docstrings and comments across the touched modules and
the test file.
Deliver the PR's stated goals:
- Rename pymongo/_kms_connect.py to pymongo/_kms_connect_shared.py, so
the shared module reads naturally next to the per-API
pymongo/{asynchronous,synchronous}/_kms_connect.py modules.
- Genericize the shared module docstring: it enumerated the module's
exact contents, which would go stale as helpers move in.
- Drop the PYTHON-6147 feature tests (HTTP proxy helpers and the prose
class) that leaked into this refactor and broke test collection: they
import HTTPProxyKMSConnect/AsyncHTTPProxyKMSConnect, which are added
by PYTHON-6147, not by this PR.
- Replace the synchro-mirrored test pair with a single hand-written
test/test_kms_connect.py, written once and parameterized over both
APIs through a Facade class (the 18 pre-existing tests, 32 variants,
byte-identical bodies). The async-side file is gone, so synchro no
longer mirrors it.
- Tighten the docstrings and comments across the touched modules and
the test file.
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The extraction preserves existing behavior and provides consolidated coverage for both APIs.
0 open findings
What changed in this PR
Extracts KMS connection plumbing from encryption orchestration into dedicated shared, asynchronous, and synchronous modules.
Changes:
- Centralizes shared KMS callback types and validation helpers.
- Moves API-specific connection logic into dedicated modules.
- Consolidates synchronous and asynchronous tests into one parametrized suite.
| File | Description |
|---|---|
pymongo/_kms_connect_shared.py |
Adds shared KMS types and cleanup logic. |
pymongo/asynchronous/_kms_connect.py |
Adds asynchronous KMS connection handling. |
pymongo/synchronous/_kms_connect.py |
Adds generated synchronous connection handling. |
pymongo/asynchronous/encryption.py |
Delegates async KMS connections to the new module. |
pymongo/synchronous/encryption.py |
Delegates sync KMS connections to the new module. |
pymongo/encryption_options.py |
Re-exports the relocated callback types. |
test/test_kms_connect.py |
Tests both APIs through parametrization. |
test/asynchronous/test_kms_connect.py |
Removes the superseded mirrored test suite. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
blink1073
marked this pull request as ready for review
October 8, 2026 22:26
blink1073
requested review from
NoahStapp and
sleepyStick
and removed request for
NoahStapp
October 8, 2026 22:26
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
sleepyStick
approved these changes
Oct 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PYTHON-6154
Summary
Moves the KMS connect plumbing out of the encryption modules into dedicated private modules and avoids duplication of tests using a facade pattern in a single test module. This work prepares for the CSFLE HTTP proxy KMS connect helpers (PYTHON-6147).
Motivation
The encryption modules mix encryption orchestration with socket-level connect code. The dedicated modules let the proxy work extend the connect path without touching the encryption modules. The tests also did not need a full client, and can be deduped to run against sync and async versions in the same module.
Changes
pymongo/_kms_connect.py.Testing
just lintandjust typingpass.pytest test/test_kms_connect.py -m ""passes all 33 tests.