couchbase 3.7.0 → 3.8.1

data/ext/couchbase/core/io/mcbp_session.cxx

@@ -240,19 +240,6 @@ class mcbp_session_impl
       stopped_.compare_exchange_strong(expected_state, true);
     }
 
-    static auto sasl_mechanisms(const std::shared_ptr<mcbp_session_impl>& session)
-      -> std::vector<std::string>
-    {
-      if (const auto user_mechanisms = session->origin_.credentials().allowed_sasl_mechanisms;
-          user_mechanisms.has_value()) {
-        return user_mechanisms.value();
-      }
-      if (session->is_tls_) {
-        return { "PLAIN" };
-      }
-      return { "SCRAM-SHA512", "SCRAM-SHA256", "SCRAM-SHA1" };
-    }
-
     auto last_bootstrap_error() && -> impl::bootstrap_error
     {
       return std::move(last_bootstrap_error_);
@@ -265,14 +252,7 @@ class mcbp_session_impl
 
     explicit bootstrap_handler(std::shared_ptr<mcbp_session_impl> session)
       : session_(std::move(session))
-      , sasl_(
-          [origin = session_->origin_]() {
-            return origin.username();
-          },
-          [origin = session_->origin_]() {
-            return origin.password();
-          },
-          sasl_mechanisms(session_))
+      , sasl_(session_->new_sasl_context())
     {
       protocol::client_request<protocol::hello_request_body> hello_req;
       if (session_->origin_.options().enable_unordered_execution) {
@@ -749,6 +729,12 @@ class mcbp_session_impl
                 if (session_) {
                   session_->update_configuration(resp.body().config());
                 }
+              } else if (resp.status() == key_value_status_code::auth_stale) {
+                CB_LOG_WARNING("{} received auth stale status for {}, opaque={}",
+                               session_->log_prefix_,
+                               resp.opcode(),
+                               resp.opaque());
+                session_->stop(retry_reason::do_not_retry);
               } else {
                 CB_LOG_WARNING("{} unexpected message status: {} (opaque={})",
                                session_->log_prefix_,
@@ -779,11 +765,20 @@ class mcbp_session_impl
             case protocol::client_opcode::range_scan_cancel:
             case protocol::client_opcode::decrement:
             case protocol::client_opcode::subdoc_multi_lookup:
-            case protocol::client_opcode::subdoc_multi_mutation: {
+            case protocol::client_opcode::subdoc_multi_mutation:
+            case protocol::client_opcode::sasl_auth: {
               const std::uint16_t status = utils::byte_swap(msg.header.specific);
               if (status == static_cast<std::uint16_t>(key_value_status_code::not_my_vbucket)) {
                 session_->handle_not_my_vbucket(msg);
               }
+              if (status == static_cast<std::uint16_t>(key_value_status_code::auth_stale)) {
+                CB_LOG_WARNING("{} received auth stale status for {}, opaque={}",
+                               session_->log_prefix_,
+                               protocol::client_opcode(msg.header.opcode),
+                               utils::byte_swap(msg.header.opaque));
+                session_->stop(retry_reason::do_not_retry);
+                return;
+              }
 
               std::uint32_t opaque = utils::byte_swap(msg.header.opaque);
               if (session_->handle_request(opcode, status, opaque, std::move(msg))) {
@@ -880,6 +875,7 @@ public:
     , bootstrap_deadline_(ctx_)
     , resolve_deadline_(ctx_)
     , connection_deadline_(ctx_)
+    , reauth_deadline_(ctx_)
     , retry_backoff_(ctx_)
     , ping_timeout_(ctx_)
     , origin_{ std::move(origin) }
@@ -896,7 +892,7 @@ public:
   mcbp_session_impl(std::string_view client_id,
                     std::string_view node_uuid,
                     asio::io_context& ctx,
-                    asio::ssl::context& tls,
+                    tls_context_provider& tls,
                     couchbase::core::origin origin,
                     std::shared_ptr<impl::bootstrap_state_listener> state_listener,
                     std::optional<std::string> bucket_name = {},
@@ -909,6 +905,7 @@ public:
     , bootstrap_deadline_(ctx_)
     , resolve_deadline_(ctx_)
     , connection_deadline_(ctx_)
+    , reauth_deadline_(ctx_)
     , retry_backoff_(ctx_)
     , ping_timeout_(ctx_)
     , origin_(std::move(origin))
@@ -943,6 +940,16 @@ public:
     return connection_endpoints_.remote_address_with_port;
   }
 
+  auto remote_hostname() const -> std::string
+  {
+    return connection_endpoints_.remote_address;
+  }
+
+  auto remote_port() const -> std::uint16_t
+  {
+    return connection_endpoints_.remote.port();
+  }
+
   auto local_address() const -> std::string
   {
     return connection_endpoints_.local_address_with_port;
@@ -962,6 +969,37 @@ public:
              bucket_name_ };
   }
 
+  auto sasl_mechanisms() -> std::vector<std::string>
+  {
+    auto credentials = origin_.credentials();
+    if (const auto user_mechanisms = credentials.allowed_sasl_mechanisms;
+        user_mechanisms.has_value()) {
+      return user_mechanisms.value();
+    }
+    if (credentials.uses_jwt()) {
+      return { "OAUTHBEARER" };
+    }
+    if (is_tls_) {
+      return { "PLAIN" };
+    }
+    return { "SCRAM-SHA512", "SCRAM-SHA256", "SCRAM-SHA1" };
+  }
+
+  auto new_sasl_context() -> sasl::ClientContext
+  {
+    return { [this] {
+              return origin_.username();
+            },
+             [this] {
+               auto credentials = origin_.credentials();
+               if (credentials.uses_jwt()) {
+                 return credentials.jwt_token;
+               }
+               return credentials.password;
+             },
+             sasl_mechanisms() };
+  }
+
   void ping(const std::shared_ptr<diag::ping_reporter>& handler,
             std::optional<std::chrono::milliseconds> timeout)
   {
@@ -1028,6 +1066,132 @@ public:
     return { config_, supported_features_ };
   }
 
+  void reauthenticate()
+  {
+    if (!bootstrapped_ || stopped_) {
+      CB_LOG_DEBUG("{} Cannot reauthenticate as trying to reauthenticate on non-bootstrapped or "
+                   "stopped session",
+                   log_prefix_);
+      return;
+    }
+
+    if (reauth_in_progress_) {
+      CB_LOG_DEBUG("{} Attempted to reauthenticate but reauthentication already in progress",
+                   log_prefix_);
+      return;
+    }
+
+    reauth_in_progress_ = true;
+
+    auto sasl = new_sasl_context();
+    protocol::client_request<protocol::sasl_auth_request_body> req;
+    auto [sasl_code, sasl_payload] = sasl.start();
+    req.opaque(next_opaque());
+    req.body().mechanism(sasl.get_name());
+    req.body().sasl_data(sasl_payload);
+
+    CB_LOG_TRACE("{} starting reauthentication (opaque={}).", log_prefix_, req.opaque());
+
+    reauth_deadline_.expires_after(origin_.options().key_value_timeout);
+    reauth_deadline_.async_wait(
+      [self = shared_from_this(), opaque = req.opaque()](std::error_code ec) {
+        if (ec == asio::error::operation_aborted || self->stopped_) {
+          return;
+        }
+        CB_LOG_DEBUG("{} Reauthentication timed out (opaque={}).", self->log_prefix_, opaque);
+        static_cast<void>(
+          self->cancel(opaque, errc::common::ambiguous_timeout, retry_reason::do_not_retry));
+      });
+    initiate_reauthenticate(std::move(req));
+  }
+
+  void initiate_reauthenticate(protocol::client_request<protocol::sasl_auth_request_body> req)
+  {
+    auto opaque = req.opaque();
+    auto data = req.data();
+    write_and_subscribe(
+      opaque,
+      std::move(data),
+      [self = shared_from_this(), req = std::move(req)](
+        std::error_code ec,
+        retry_reason reason,
+        io::mcbp_message&& msg,
+        const std::optional<key_value_error_map_info>& /* error_info */) -> void {
+        if (ec == asio::error::operation_aborted || ec == errc::common::request_canceled) {
+          self->reauth_in_progress_ = false;
+          return;
+        }
+
+        key_value_status_code status = key_value_status_code::invalid;
+        std::optional<key_value_error_map_info> error_code;
+        if (protocol::is_valid_status(msg.header.status())) {
+          status = static_cast<key_value_status_code>(msg.header.status());
+        } else {
+          error_code = self->decode_error_code(msg.header.status());
+        }
+
+        if (status == key_value_status_code::success) {
+          self->reauth_deadline_.cancel();
+          self->reauth_in_progress_ = false;
+          CB_LOG_DEBUG(
+            "{} reauthentication succeeded (opaque={})", self->log_prefix_, req.opaque());
+          return;
+        }
+
+        if (status == key_value_status_code::auth_continue) {
+          self->reauth_deadline_.cancel();
+          self->reauth_in_progress_ = false;
+          CB_LOG_DEBUG("{} reauthentication received unexpected auth_continue (opaque={})",
+                       self->log_prefix_,
+                       req.opaque());
+          return;
+        }
+
+        if (error_code && error_code.value().has_retry_attribute()) {
+          reason = retry_reason::key_value_error_map_retry_indicated;
+        } else {
+          switch (status) {
+            case key_value_status_code::temporary_failure:
+              reason = retry_reason::key_value_temporary_failure;
+            default:
+              break;
+          }
+        }
+
+        if (reason == retry_reason::do_not_retry || reason == retry_reason::unknown) {
+          CB_LOG_WARNING("{} reauthentication failed (code={}, message={}, reason={}, opaque={})",
+                         self->log_prefix_,
+                         ec.value(),
+                         ec.message(),
+                         reason,
+                         req.opaque());
+          self->reauth_deadline_.cancel();
+          self->reauth_in_progress_ = false;
+          return;
+        }
+
+        CB_LOG_DEBUG("{} reauthentication failed (code={}, reason={}, opaque={}), scheduling retry",
+                     self->log_prefix_,
+                     ec.value(),
+                     reason,
+                     req.opaque());
+
+        auto backoff = std::chrono::milliseconds(300);
+        self->retry_backoff_.expires_after(backoff);
+        self->retry_backoff_.async_wait([self, req = req](std::error_code ec) -> void {
+          if (ec == asio::error::operation_aborted || !self->reauth_in_progress_) {
+            return;
+          }
+          self->initiate_reauthenticate(req);
+        });
+      });
+  }
+
+  void update_credentials(cluster_credentials credentials)
+  {
+    origin_.update_credentials(std::move(credentials));
+  }
+
   void bootstrap(utils::movable_function<void(std::error_code, topology::configuration)>&& callback,
                  bool retry_on_bucket_not_found = false)
   {
@@ -1225,6 +1389,7 @@ public:
     bootstrap_deadline_.cancel();
     resolve_deadline_.cancel();
     connection_deadline_.cancel();
+    reauth_deadline_.cancel();
     retry_backoff_.cancel();
     ping_timeout_.cancel();
     resolver_.cancel();
@@ -1533,6 +1698,16 @@ public:
     return bootstrap_port_number_;
   }
 
+  [[nodiscard]] auto canonical_hostname() const -> const std::string&
+  {
+    return canonical_hostname_;
+  }
+
+  [[nodiscard]] auto canonical_port_number() const -> std::uint16_t
+  {
+    return canonical_port_number_;
+  }
+
   [[nodiscard]] auto next_opaque() -> std::uint32_t
   {
     return ++opaque_;
@@ -1743,10 +1918,18 @@ private:
     if (ec) {
       return stop(retry_reason::node_not_available);
     }
-    if (node_uuid_.empty() && config_.has_value()) {
+    if (config_.has_value()) {
       for (const auto& node : config_.value().nodes) {
         if (node.this_node) {
-          node_uuid_ = node.node_uuid;
+          if (node_uuid_.empty()) {
+            node_uuid_ = node.node_uuid;
+          }
+          if (canonical_hostname_.empty()) {
+            canonical_hostname_ = node.hostname;
+          }
+          if (canonical_port_number_ == 0) {
+            canonical_port_number_ = node.port_or(service_type::key_value, is_tls_, 0);
+          }
         }
       }
     }
@@ -2068,6 +2251,7 @@ private:
   asio::steady_timer bootstrap_deadline_;
   asio::steady_timer resolve_deadline_;
   asio::steady_timer connection_deadline_;
+  asio::steady_timer reauth_deadline_;
   asio::steady_timer retry_backoff_;
   asio::steady_timer ping_timeout_;
   couchbase::core::origin origin_;
@@ -2085,6 +2269,7 @@ private:
 
   std::atomic_bool bootstrapped_{ false };
   std::atomic_bool stopped_{ false };
+  std::atomic_bool reauth_in_progress_{ false };
   bool authenticated_{ false };
   bool bucket_selected_{ false };
   bool supports_gcccp_{ true };
@@ -2112,6 +2297,10 @@ private:
   std::optional<error_map> error_map_;
   collection_cache collection_cache_;
 
+  // Only used for tracing & metrics. They represent the address of the node as given in the config.
+  std::string canonical_hostname_{};
+  std::uint16_t canonical_port_number_{};
+
   const bool is_tls_;
   std::shared_ptr<impl::bootstrap_state_listener> state_listener_{ nullptr };
 
@@ -2153,7 +2342,7 @@ mcbp_session::mcbp_session(const std::string& client_id,
 mcbp_session::mcbp_session(const std::string& client_id,
                            const std::string& node_uuid,
                            asio::io_context& ctx,
-                           asio::ssl::context& tls,
+                           tls_context_provider& tls,
                            core::origin origin,
                            std::shared_ptr<impl::bootstrap_state_listener> state_listener,
                            std::optional<std::string> bucket_name,
@@ -2241,6 +2430,18 @@ mcbp_session::remote_address() const -> std::string
   return impl_->remote_address();
 }
 
+auto
+mcbp_session::remote_hostname() const -> std::string
+{
+  return impl_->remote_hostname();
+}
+
+auto
+mcbp_session::remote_port() const -> std::uint16_t
+{
+  return impl_->remote_port();
+}
+
 auto
 mcbp_session::local_address() const -> std::string
 {
@@ -2277,6 +2478,18 @@ mcbp_session::last_bootstrap_error() const& -> const std::optional<impl::bootstr
   return impl_->last_bootstrap_error();
 }
 
+auto
+mcbp_session::canonical_hostname() const -> const std::string&
+{
+  return impl_->canonical_hostname();
+}
+
+auto
+mcbp_session::canonical_port_number() const -> std::uint16_t
+{
+  return impl_->canonical_port_number();
+}
+
 void
 mcbp_session::write_and_subscribe(std::uint32_t opaque,
                                   std::vector<std::byte>&& data,
@@ -2293,6 +2506,18 @@ mcbp_session::bootstrap(
   return impl_->bootstrap(std::move(handler), retry_on_bucket_not_found);
 }
 
+void
+mcbp_session::reauthenticate()
+{
+  return impl_->reauthenticate();
+}
+
+void
+mcbp_session::update_credentials(cluster_credentials credentials)
+{
+  return impl_->update_credentials(std::move(credentials));
+}
+
 void
 mcbp_session::on_stop(utils::movable_function<void()> handler)
 {

data/ext/couchbase/core/io/mcbp_session.hxx

@@ -19,8 +19,10 @@
 
 #include <couchbase/build_config.hxx>
 
+#include "core/cluster_credentials.hxx"
 #include "core/protocol/hello_feature.hxx"
 #include "core/response_handler.hxx"
+#include "core/tls_context_provider.hxx"
 #include "core/utils/movable_function.hxx"
 #include "mcbp_context.hxx"
 #include "mcbp_message.hxx"
@@ -100,7 +102,7 @@ public:
   mcbp_session(const std::string& client_id,
                const std::string& node_uuid,
                asio::io_context& ctx,
-               asio::ssl::context& tls,
+               tls_context_provider& tls,
                couchbase::core::origin origin,
                std::shared_ptr<impl::bootstrap_state_listener> state_listener,
                std::optional<std::string> bucket_name = {},
@@ -119,6 +121,8 @@ public:
   [[nodiscard]] auto id() const -> const std::string&;
   [[nodiscard]] auto node_uuid() const -> const std::string&;
   [[nodiscard]] auto remote_address() const -> std::string;
+  [[nodiscard]] auto remote_hostname() const -> std::string;
+  [[nodiscard]] auto remote_port() const -> std::uint16_t;
   [[nodiscard]] auto local_address() const -> std::string;
   [[nodiscard]] auto bootstrap_address() const -> const std::string&;
   [[nodiscard]] auto bootstrap_hostname() const -> const std::string&;
@@ -126,6 +130,8 @@ public:
   [[nodiscard]] auto bootstrap_port_number() const -> std::uint16_t;
   [[nodiscard]] auto last_bootstrap_error() && -> std::optional<impl::bootstrap_error>;
   [[nodiscard]] auto last_bootstrap_error() const& -> const std::optional<impl::bootstrap_error>&;
+  [[nodiscard]] auto canonical_hostname() const -> const std::string&;
+  [[nodiscard]] auto canonical_port_number() const -> std::uint16_t;
   void write_and_flush(std::vector<std::byte>&& buffer);
   void write_and_subscribe(const std::shared_ptr<mcbp::queue_request>&,
                            const std::shared_ptr<response_handler>& handler);
@@ -134,6 +140,8 @@ public:
                            command_handler&& handler);
   void bootstrap(utils::movable_function<void(std::error_code, topology::configuration)>&& handler,
                  bool retry_on_bucket_not_found = false);
+  void reauthenticate();
+  void update_credentials(cluster_credentials credentials);
   void on_stop(utils::movable_function<void()> handler);
   void stop(retry_reason reason);
   [[nodiscard]] auto index() const -> std::size_t;

data/ext/couchbase/core/io/mcbp_traits.hxx

@@ -27,12 +27,4 @@ struct supports_durability : public std::false_type {
 
 template<typename T>
 inline constexpr bool supports_durability_v = supports_durability<T>::value;
-
-template<typename T>
-struct supports_parent_span : public std::false_type {
-};
-
-template<typename T>
-inline constexpr bool supports_parent_span_v = supports_parent_span<T>::value;
-
 } // namespace couchbase::core::io::mcbp_traits

data/ext/couchbase/core/io/streams.cxx

@@ -140,12 +140,12 @@ plain_stream_impl::async_read_some(
   return stream_->async_read_some(buffer, std::move(handler));
 }
 
-tls_stream_impl::tls_stream_impl(asio::io_context& ctx, asio::ssl::context& tls)
+tls_stream_impl::tls_stream_impl(asio::io_context& ctx, tls_context_provider& tls)
   : stream_impl(ctx, true)
   , tls_(tls)
   , stream_(
       std::make_shared<asio::ssl::stream<asio::ip::tcp::socket>>(asio::ip::tcp::socket(strand_),
-                                                                 tls_))
+                                                                 *tls_.get_ctx()))
 {
 }
 
@@ -204,7 +204,7 @@ tls_stream_impl::async_connect(const asio::ip::tcp::resolver::results_type::endp
   if (!stream_) {
     id_ = uuid::to_string(uuid::random());
     stream_ = std::make_shared<asio::ssl::stream<asio::ip::tcp::socket>>(
-      asio::ip::tcp::socket(strand_), tls_);
+      asio::ip::tcp::socket(strand_), *tls_.get_ctx());
   }
   return stream_->lowest_layer().async_connect(
     endpoint, [stream = stream_, handler = std::move(handler)](std::error_code ec_connect) mutable {

data/ext/couchbase/core/io/streams.hxx

@@ -17,6 +17,7 @@
 
 #pragma once
 
+#include "core/tls_context_provider.hxx"
 #include "core/utils/movable_function.hxx"
 #include "ip_protocol.hxx"
 
@@ -129,11 +130,11 @@ public:
 class tls_stream_impl : public stream_impl
 {
 private:
-  asio::ssl::context& tls_;
+  tls_context_provider& tls_;
   std::shared_ptr<asio::ssl::stream<asio::ip::tcp::socket>> stream_;
 
 public:
-  tls_stream_impl(asio::io_context& ctx, asio::ssl::context& tls);
+  tls_stream_impl(asio::io_context& ctx, tls_context_provider& tls);
 
   [[nodiscard]] auto local_endpoint() const -> asio::ip::tcp::endpoint override;
 

data/ext/couchbase/core/meta/features.hxx

@@ -253,3 +253,18 @@
  * couchbase::vector_query has a prefilter option.
  */
 #define COUCHBASE_CXX_CLIENT_HAS_VECTOR_SEARCH_PREFILTER 1
+
+/**
+ * couchbase::cluster has set_authenticator() method.
+ */
+#define COUCHBASE_CXX_CLIENT_HAS_SET_AUTHENTICATOR 1
+
+/**
+ * Support for the jwt_authenticator
+ */
+#define COUCHBASE_CXX_CLIENT_HAS_JWT_AUTHENTICATOR 1
+
+/**
+ * Support for the stable OpenTelemetry conventions (Observability RFC revisions 26 & 27)
+ */
+#define COUCHBASE_CXX_CLIENT_STABLE_OTEL_CONVENTIONS 1

data/ext/couchbase/core/meta/version.cxx

@@ -34,6 +34,9 @@
 #include <snappy-stubs-public.h>
 #include <spdlog/fmt/bundled/core.h>
 #include <spdlog/version.h>
+#ifdef COUCHBASE_CXX_CLIENT_BUILD_OPENTELEMETRY
+#include <opentelemetry/version.h>
+#endif
 
 #include <regex>
 
@@ -168,10 +171,20 @@ sdk_build_info() -> std::map<std::string, std::string>
 #if defined(__GLIBC__)
   info["libc"] = fmt::format("glibc {}.{}", __GLIBC__, __GLIBC_MINOR__);
 #endif
+#ifdef COUCHBASE_CXX_CLIENT_BUILD_OPENTELEMETRY
+  info["opentelemetry"] = OPENTELEMETRY_VERSION;
+  info["opentelemetry_abi"] = OPENTELEMETRY_ABI_VERSION;
+#endif
 
   return info;
 }
 
+auto
+is_debug() -> bool
+{
+  return COUCHBASE_CXX_CLIENT_DEBUG_BUILD;
+}
+
 auto
 sdk_build_info_json() -> std::string
 {

data/ext/couchbase/core/meta/version.hxx

@@ -64,4 +64,7 @@ user_agent_for_mcbp(const std::string& client_id,
                     const std::string& session_id,
                     const std::string& extra = "",
                     std::size_t max_length = 0) -> std::string;
+
+auto
+is_debug() -> bool;
 } // namespace couchbase::core::meta

data/ext/couchbase/core/metrics/constants.hxx

@@ -0,0 +1,23 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *     Copyright 2025-Present Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+#pragma once
+
+namespace couchbase::core::metrics
+{
+constexpr auto operation_meter_name = "db.client.operation.duration";
+} // namespace couchbase::core::metrics

data/ext/couchbase/core/metrics/logging_meter.cxx

@@ -19,7 +19,9 @@
 
 #include "couchbase/build_info.hxx"
 
+#include "constants.hxx"
 #include "core/logger/logger.hxx"
+#include "core/tracing/constants.hxx"
 #include "core/utils/json.hxx"
 #include "noop_meter.hxx"
 
@@ -209,18 +211,16 @@ logging_meter::get_value_recorder(const std::string& name,
     std::make_shared<noop_value_recorder>()
   };
 
-  if (static const std::string meter_name = "db.couchbase.operations"; name != meter_name) {
+  if (name != operation_meter_name) {
     return noop_recorder;
   }
 
-  static const std::string service_tag = "db.couchbase.service";
-  const auto service = tags.find(service_tag);
+  const auto service = tags.find(tracing::attributes::op::service);
   if (service == tags.end()) {
     return noop_recorder;
   }
 
-  static const std::string operation_tag = "db.operation";
-  const auto operation = tags.find(operation_tag);
+  const auto operation = tags.find(tracing::attributes::op::operation_name);
   if (operation == tags.end()) {
     return noop_recorder;
   }