Context

Similar to INTPYTHON-913, in the case where QE settings have been configured but migrations have not been run, it is still possible to import and use "encrypted" models to create "encrypted" data. INTPYTHON-913 added a check to fail startup if QE settings are not configured. Here we propose adding a check for collection names on startup to determine whether or not migrations have been run. If they have, OK to proceed. If not, fail with error and suggestion to run the migrations.

Definition of done

Add a check for existence of encrypted collections without impacting performance.

Pitfalls

There is strong sentiment against adding this type of enforcement which I agree with, however QE itself has some "anti-Mongo" patterns already, most notably the required schema definition. This check is in alignment with QE's design and most importantly prevents the user from being able to create unencrypted collections and add unencrypted data to them.