Summary

Add an enabled-by-default safety check in drivers to ensure Queryable Encryption (QE) collections are created server-side before sending QE payloads.

Motivation

When driver_options.autoEncryption.encryptedFieldsMap is configured but the target collection is not created as encrypted (no server-side encryptedFields), the client encrypts data, but the server has undesirable behavior (see comment).

Who is the affected end user?

Application developers using automatic Queryable Encryption who write documents before running the encrypted collection creation step. This can result in undesirable server behavior without noticing (see comment).

Is this issue urgent?

No.

Is this ticket only for tests?

No.

Acceptance Criteria

• Upgrade libmongocrypt to include MONGOCRYPT-995 and add an opt-out flag.
• The check is enabled by default and can be opted out.
• Define automatic encryption test coverage across drivers (PHPLIB, NODE, JAVA, PYTHON, C# etc.).