[Client encryption]: Add JsonNode Encryption processor

Microsoft.Azure.Cosmos.Encryption.Custom/src/EncryptionOptions.cs

@@ -6,6 +6,25 @@ namespace Microsoft.Azure.Cosmos.Encryption.Custom
 {
     using System.Collections.Generic;
 
+    /// <summary>
+    /// API for JSON processing
+    /// </summary>
+    public enum JsonProcessor
+    {
+        /// <summary>
+        /// Newtonsoft.Json
+        /// </summary>
+        Newtonsoft,
+
+#if NET8_0_OR_GREATER
+        /// <summary>
+        /// System.Text.Json
+        /// </summary>
+        /// <remarks>Available with .NET8.0 package only.</remarks>
+        SystemTextJson,
+#endif
+    }
+
     /// <summary>
     /// Options for encryption of data.
     /// </summary>
@@ -35,5 +54,11 @@ public sealed class EncryptionOptions
         /// Example of a path specification: /sensitive
         /// </summary>
         public IEnumerable<string> PathsToEncrypt { get; set; }
+
+        /// <summary>
+        /// Gets or sets API used for Json processing
+        /// </summary>
+        /// <remarks>Setting only applies with Mde encryption is used.</remarks>
+        public JsonProcessor JsonProcessor { get; set; } = JsonProcessor.Newtonsoft;
     }
 }

Microsoft.Azure.Cosmos.Encryption.Custom/src/EncryptionProperties.cs

@@ -5,23 +5,29 @@
 namespace Microsoft.Azure.Cosmos.Encryption.Custom
 {
     using System.Collections.Generic;
+    using System.Text.Json.Serialization;
     using Newtonsoft.Json;
 
     internal class EncryptionProperties
     {
         [JsonProperty(PropertyName = Constants.EncryptionFormatVersion)]
+        [JsonPropertyName(Constants.EncryptionFormatVersion)]
         public int EncryptionFormatVersion { get; }
 
         [JsonProperty(PropertyName = Constants.EncryptionDekId)]
+        [JsonPropertyName(Constants.EncryptionDekId)]
         public string DataEncryptionKeyId { get; }
 
         [JsonProperty(PropertyName = Constants.EncryptionAlgorithm)]
+        [JsonPropertyName(Constants.EncryptionAlgorithm)]
         public string EncryptionAlgorithm { get; }
 
         [JsonProperty(PropertyName = Constants.EncryptedData)]
+        [JsonPropertyName(Constants.EncryptedData)]
         public byte[] EncryptedData { get; }
 
         [JsonProperty(PropertyName = Constants.EncryptedPaths)]
+        [JsonPropertyName(Constants.EncryptedPaths)]
         public IEnumerable<string> EncryptedPaths { get; }
 
         public EncryptionProperties(

Microsoft.Azure.Cosmos.Encryption.Custom/src/Transformation/MdeEncryptionProcessor.Preview.cs

@@ -7,78 +7,33 @@
 namespace Microsoft.Azure.Cosmos.Encryption.Custom.Transformation
 {
     using System;
-    using System.Collections.Generic;
     using System.IO;
-    using System.Linq;
     using System.Threading;
     using System.Threading.Tasks;
     using Newtonsoft.Json.Linq;
 
     internal class MdeEncryptionProcessor
     {
-        internal JObjectSqlSerializer Serializer { get; set; } = new JObjectSqlSerializer();
+        internal MdeJObjectEncryptionProcessor JObjectEncryptionProcessor { get; set; } = new MdeJObjectEncryptionProcessor();
 
-        internal MdeEncryptor Encryptor { get; set; } = new MdeEncryptor();
+#if NET8_0_OR_GREATER
+        internal MdeJsonNodeEncryptionProcessor JsonNodeEncryptionProcessor { get; set; } = new MdeJsonNodeEncryptionProcessor();
+#endif
 
         public async Task<Stream> EncryptAsync(
             Stream input,
             Encryptor encryptor,
             EncryptionOptions encryptionOptions,
             CancellationToken token)
         {
-            JObject itemJObj = EncryptionProcessor.BaseSerializer.FromStream<JObject>(input);
-            List<string> pathsEncrypted = new ();
-            TypeMarker typeMarker;
-
-            using ArrayPoolManager arrayPoolManager = new ();
-
-            DataEncryptionKey encryptionKey = await encryptor.GetEncryptionKeyAsync(encryptionOptions.DataEncryptionKeyId, encryptionOptions.EncryptionAlgorithm, token);
-
-            foreach (string pathToEncrypt in encryptionOptions.PathsToEncrypt)
+            return encryptionOptions.JsonProcessor switch
             {
+                JsonProcessor.Newtonsoft => await this.JObjectEncryptionProcessor.EncryptAsync(input, encryptor, encryptionOptions, token),
 #if NET8_0_OR_GREATER
-                string propertyName = pathToEncrypt[1..];
-#else
-                string propertyName = pathToEncrypt.Substring(1);
+                JsonProcessor.SystemTextJson => await this.JsonNodeEncryptionProcessor.EncryptAsync(input, encryptor, encryptionOptions, token),
 #endif
-                if (!itemJObj.TryGetValue(propertyName, out JToken propertyValue))
-                {
-                    continue;
-                }
-
-                if (propertyValue.Type == JTokenType.Null)
-                {
-                    continue;
-                }
-
-                byte[] plainText = null;
-                (typeMarker, plainText, int plainTextLength) = this.Serializer.Serialize(propertyValue, arrayPoolManager);
-
-                if (plainText == null)
-                {
-                    continue;
-                }
-
-                byte[] encryptedBytes = this.Encryptor.Encrypt(encryptionKey, typeMarker, plainText, plainTextLength);
-
-                itemJObj[propertyName] = encryptedBytes;
-                pathsEncrypted.Add(pathToEncrypt);
-            }
-
-            EncryptionProperties encryptionProperties = new (
-                encryptionFormatVersion: 3,
-                encryptionOptions.EncryptionAlgorithm,
-                encryptionOptions.DataEncryptionKeyId,
-                encryptedData: null,
-                pathsEncrypted);
-
-            itemJObj.Add(Constants.EncryptedInfo, JObject.FromObject(encryptionProperties));
-#if NET8_0_OR_GREATER
-            await input.DisposeAsync();
-#else
-            input.Dispose();
-#endif
-            return EncryptionProcessor.BaseSerializer.ToStream(itemJObj);
+                _ => throw new InvalidOperationException("Unsupported JsonProcessor")
+            };
         }
 
         internal async Task<DecryptionContext> DecryptObjectAsync(
@@ -88,57 +43,7 @@ internal async Task<DecryptionContext> DecryptObjectAsync(
             CosmosDiagnosticsContext diagnosticsContext,
             CancellationToken cancellationToken)
         {
-            _ = diagnosticsContext;
-
-            if (encryptionProperties.EncryptionFormatVersion != 3)
-            {
-                throw new NotSupportedException($"Unknown encryption format version: {encryptionProperties.EncryptionFormatVersion}. Please upgrade your SDK to the latest version.");
-            }
-
-            using ArrayPoolManager arrayPoolManager = new ();
-            using ArrayPoolManager<char> charPoolManager = new ();
-
-            DataEncryptionKey encryptionKey = await encryptor.GetEncryptionKeyAsync(encryptionProperties.DataEncryptionKeyId, encryptionProperties.EncryptionAlgorithm, cancellationToken);
-
-            List<string> pathsDecrypted = new (encryptionProperties.EncryptedPaths.Count());
-            foreach (string path in encryptionProperties.EncryptedPaths)
-            {
-#if NET8_0_OR_GREATER
-                string propertyName = path[1..];
-#else
-                string propertyName = path.Substring(1);
-#endif
-
-                if (!document.TryGetValue(propertyName, out JToken propertyValue))
-                {
-                    // malformed document, such record shouldn't be there at all
-                    continue;
-                }
-
-                byte[] cipherTextWithTypeMarker = propertyValue.ToObject<byte[]>();
-                if (cipherTextWithTypeMarker == null)
-                {
-                    continue;
-                }
-
-                (byte[] plainText, int decryptedCount) = this.Encryptor.Decrypt(encryptionKey, cipherTextWithTypeMarker, arrayPoolManager);
-
-                this.Serializer.DeserializeAndAddProperty(
-                    (TypeMarker)cipherTextWithTypeMarker[0],
-                    plainText.AsSpan(0, decryptedCount),
-                    document,
-                    propertyName,
-                    charPoolManager);
-
-                pathsDecrypted.Add(path);
-            }
-
-            DecryptionContext decryptionContext = EncryptionProcessor.CreateDecryptionContext(
-                pathsDecrypted,
-                encryptionProperties.DataEncryptionKeyId);
-
-            document.Remove(Constants.EncryptedInfo);
-            return decryptionContext;
+            return await this.JObjectEncryptionProcessor.DecryptObjectAsync(document, encryptor, encryptionProperties, diagnosticsContext, cancellationToken);
         }
     }
 }

Microsoft.Azure.Cosmos.Encryption.Custom/src/Transformation/MdeEncryptor.cs

@@ -31,6 +31,29 @@ internal virtual byte[] Encrypt(DataEncryptionKey encryptionKey, TypeMarker type
             return encryptedText;
         }
 
+        internal virtual (byte[], int) Encrypt(DataEncryptionKey encryptionKey, TypeMarker typeMarker, byte[] plainText, int plainTextLength, ArrayPoolManager arrayPoolManager)
+        {
+            int encryptedTextLength = encryptionKey.GetEncryptByteCount(plainTextLength) + 1;
+
+            byte[] encryptedText = arrayPoolManager.Rent(encryptedTextLength);
+
+            encryptedText[0] = (byte)typeMarker;
+
+            int encryptedLength = encryptionKey.EncryptData(
+                plainText,
+                plainTextOffset: 0,
+                plainTextLength,
+                encryptedText,
+                outputOffset: 1);
+
+            if (encryptedLength < 0)
+            {
+                throw new InvalidOperationException($"{nameof(DataEncryptionKey)} returned null cipherText from {nameof(DataEncryptionKey.EncryptData)}.");
+            }
+
+            return (encryptedText, encryptedTextLength);
+        }
+
         internal virtual (byte[] plainText, int plainTextLength) Decrypt(DataEncryptionKey encryptionKey, byte[] cipherText, ArrayPoolManager arrayPoolManager)
         {
             int plainTextLength = encryptionKey.GetDecryptByteCount(cipherText.Length - 1);