{"id":"2045163e13bdafaa","repo":"mongodb/node-mongodb-native","slug":"option-autoencryption-must-be-specified","errorCode":null,"errorMessage":"Option \"autoEncryption\" must be specified","messagePattern":"Option \"autoEncryption\" must be specified","errorType":"exception","errorClass":"MongoInvalidArgumentError","httpStatus":null,"severity":"error","filePath":"src/encrypter.ts","lineNumber":22,"sourceCode":"import { MongoInvalidArgumentError, MongoMissingDependencyError } from './error';\nimport { MongoClient, type MongoClientOptions } from './mongo_client';\n\n/** @internal */\nexport interface EncrypterOptions {\n  autoEncryption: AutoEncryptionOptions;\n  maxPoolSize?: number;\n}\n\n/** @internal */\nexport class Encrypter {\n  private internalClient: MongoClient | null;\n  bypassAutoEncryption: boolean;\n  needsConnecting: boolean;\n  autoEncrypter: AutoEncrypter;\n\n  constructor(client: MongoClient, uri: string, options: MongoClientOptions) {\n    if (typeof options.autoEncryption !== 'object') {\n      throw new MongoInvalidArgumentError('Option \"autoEncryption\" must be specified');\n    }\n    // initialize to null, if we call getInternalClient, we may set this it is important to not overwrite those function calls.\n    this.internalClient = null;\n\n    this.bypassAutoEncryption = !!options.autoEncryption.bypassAutoEncryption;\n    this.needsConnecting = false;\n\n    if (options.maxPoolSize === 0 && options.autoEncryption.keyVaultClient == null) {\n      options.autoEncryption.keyVaultClient = client;\n    } else if (options.autoEncryption.keyVaultClient == null) {\n      options.autoEncryption.keyVaultClient = this.getInternalClient(client, uri, options);\n    }\n\n    if (this.bypassAutoEncryption) {\n      options.autoEncryption.metadataClient = undefined;\n    } else if (options.maxPoolSize === 0) {\n      options.autoEncryption.metadataClient = client;\n    } else {","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/encrypter.ts#L4-L40","documentation":"The Encrypter is constructed only when autoEncryption is enabled on MongoClient. Reaching its constructor with a non-object autoEncryption means the option was set to a truthy non-object (boolean, string) — a misconfiguration the driver catches at client construction time.","triggerScenarios":"new MongoClient(uri, { autoEncryption: true }), autoEncryption: 'enabled', or any non-object value for the option.","commonSituations":"Booleans mistaken for option flags; partial config; copying examples that omit the keyVaultNamespace/kmsProviders shape.","solutions":["Set autoEncryption to an object with at least keyVaultNamespace and kmsProviders","Confirm the option is an object literal, not a boolean or string","Follow the CSFLE setup tutorial for the full options shape"],"exampleFix":"// before\nnew MongoClient(uri, { autoEncryption: true });\n// after\nnew MongoClient(uri, {\n  autoEncryption: {\n    keyVaultNamespace: 'encryption.__keyVault',\n    kmsProviders: { local: { key: localKey } }\n  }\n});","handlingStrategy":"validation","validationCode":"if (options.autoEncryption != null && typeof options.autoEncryption !== 'object') {\n  throw new Error('autoEncryption must be an object with keyVaultNamespace and kmsProviders');\n}","typeGuard":"function isAutoEncryptionOptions(o: unknown): o is { keyVaultNamespace: string; kmsProviders: Record<string, unknown> } {\n  return typeof o === 'object' && o !== null\n    && typeof (o as any).keyVaultNamespace === 'string'\n    && typeof (o as any).kmsProviders === 'object';\n}","tryCatchPattern":null,"preventionTips":["Always pass autoEncryption as a fully-formed config object","Follow the CSFLE tutorial for the exact options shape","Lint MongoClient options at app boot"],"tags":["encryption","csfle","config","mongo-client"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}