{"id":"54cecab32e49582d","repo":"mongodb/node-mongodb-native","slug":"cannot-set-both-proxyoptions-and-kmsconnectcallbac-54ceca","errorCode":null,"errorMessage":"Cannot set both proxyOptions and kmsConnectCallback","messagePattern":"Cannot set both proxyOptions and kmsConnectCallback","errorType":"validation","errorClass":"MongoCryptInvalidArgumentError","httpStatus":null,"severity":"error","filePath":"src/client-side-encryption/client_encryption.ts","lineNumber":132,"sourceCode":"   *\n   * @example\n   * ```ts\n   * new ClientEncryption(mongoClient, {\n   *   keyVaultNamespace: 'client.encryption',\n   *   kmsProviders: {\n   *     aws: {\n   *       accessKeyId: AWS_ACCESS_KEY,\n   *       secretAccessKey: AWS_SECRET_KEY\n   *     }\n   *   }\n   * });\n   * ```\n   */\n  constructor(client: MongoClient, options: ClientEncryptionOptions) {\n    this._client = client;\n    this._proxyOptions = options.proxyOptions ?? {};\n    if (this._proxyOptions.proxyHost && options.kmsConnectCallback) {\n      throw new MongoCryptInvalidArgumentError(\n        'Cannot set both proxyOptions and kmsConnectCallback'\n      );\n    }\n    this._tlsOptions = options.tlsOptions ?? {};\n    this._kmsConnectCallback = options.kmsConnectCallback;\n    this._kmsProviders = options.kmsProviders || {};\n    const { timeoutMS } = resolveTimeoutOptions(client, options);\n    this._timeoutMS = timeoutMS;\n    this._credentialProviders = options.credentialProviders;\n\n    if (options.credentialProviders?.aws && !isEmptyCredentials('aws', this._kmsProviders)) {\n      throw new MongoCryptInvalidArgumentError(\n        'Can only provide a custom AWS credential provider when the state machine is configured for automatic AWS credential fetching'\n      );\n    }\n\n    if (options.keyVaultNamespace == null) {\n      throw new MongoCryptInvalidArgumentError('Missing required option `keyVaultNamespace`');","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/client-side-encryption/client_encryption.ts#L114-L150","documentation":"Same validation as error 27, but enforced in the ClientEncryption constructor (explicit encryption API). Thrown as MongoCryptInvalidArgumentError when proxyOptions.proxyHost and kmsConnectCallback are both provided. ClientEncryption is used for explicit encryption/decryption rather than auto-encryption, but the KMS routing rule is identical.","triggerScenarios":"Constructing `new ClientEncryption(client, { proxyOptions: { proxyHost }, kmsConnectCallback })` for explicit encryption workflows.","commonSituations":"Building a ClientEncryption for explicit encrypt/decrypt while reusing an autoEncryption-style config that included both fields; corporate proxy setups combined with custom KMS hooks.","solutions":["Remove one of the two options; keep kmsConnectCallback and drop proxyOptions, or vice-versa.","Implement proxy logic inside kmsConnectCallback so only one mechanism is active.","Share a single normalized CSFLE options builder between autoEncryption and ClientEncryption to prevent drift."],"exampleFix":"// before\nnew ClientEncryption(client, {\n  keyVaultNamespace: 'enc.keys',\n  kmsProviders: { aws: {} },\n  proxyOptions: { proxyHost: 'corp.proxy' },\n  kmsConnectCallback: cb\n});\n\n// after\nnew ClientEncryption(client, {\n  keyVaultNamespace: 'enc.keys',\n  kmsProviders: { aws: {} },\n  kmsConnectCallback: cb\n});","handlingStrategy":"validation","validationCode":"function validateClientEncryption(opt) {\n  if (opt.proxyOptions?.proxyHost && opt.kmsConnectCallback)\n    throw new Error('Cannot set both proxyOptions and kmsConnectCallback');\n}","typeGuard":"type ClientEncKmsTransport = { proxyOptions: { proxyHost: string } } | { kmsConnectCallback: Function };","tryCatchPattern":"try { new ClientEncryption(client, opt); }\ncatch (err) {\n  if (err instanceof MongoCryptInvalidArgumentError && /proxyOptions and kmsConnectCallback/.test(err.message)) {\n    /* drop one field */\n  } else throw err;\n}","preventionTips":["Reuse the same options builder for AutoEncrypter and ClientEncryption.","Use a discriminated union for KMS transport options.","Add a lint check forbidding both fields in CSFLE configs."],"tags":["csfle","configuration","kms","proxy","client-encryption"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}