couchbase 3.7.0 → 3.8.1

data/ext/couchbase/core/origin.cxx

@@ -26,6 +26,7 @@
 
 #include <tao/json.hpp>
 
+#include <mutex>
 #include <random>
 #include <utility>
 
@@ -99,6 +100,19 @@ struct traits<couchbase::core::io::dns::dns_config> {
   }
 };
 
+template<>
+struct traits<couchbase::core::orphan_reporter_options> {
+  template<template<typename...> class Traits>
+  static void assign(tao::json::basic_value<Traits>& v,
+                     const couchbase::core::orphan_reporter_options& o)
+  {
+    v = {
+      { "emit_interval", o.emit_interval },
+      { "sample_size", o.sample_size },
+    };
+  }
+};
+
 template<>
 struct traits<couchbase::core::tracing::threshold_logging_options> {
   template<template<typename...> class Traits>
@@ -106,8 +120,6 @@ struct traits<couchbase::core::tracing::threshold_logging_options> {
                      const couchbase::core::tracing::threshold_logging_options& o)
   {
     v = {
-      { "orphaned_emit_interval", o.orphaned_emit_interval },
-      { "orphaned_sample_size", o.orphaned_sample_size },
       { "threshold_emit_interval", o.threshold_emit_interval },
       { "threshold_sample_size", o.threshold_sample_size },
       { "key_value_threshold", o.key_value_threshold },
@@ -275,12 +287,14 @@ origin::to_json() const -> std::string
         { "enable_compression", options_.enable_compression },
         { "enable_tracing", options_.enable_tracing },
         { "enable_metrics", options_.enable_metrics },
+        { "enable_orphan_reporting", options_.enable_orphan_reporting },
         { "tcp_keep_alive_interval", options_.tcp_keep_alive_interval },
         { "config_idle_redial_timeout", options_.config_idle_redial_timeout },
         { "max_http_connections", options_.max_http_connections },
         { "idle_http_connection_timeout", options_.idle_http_connection_timeout },
         { "metrics_options", options_.metrics_options },
         { "tracing_options", options_.tracing_options },
+        { "orphan_reporter_options", options_.orphan_options },
         { "transactions_options", options_.transactions },
         { "server_group", options_.server_group },
 #endif
@@ -302,12 +316,36 @@ origin::to_json() const -> std::string
 
 } // namespace couchbase::core
 
+couchbase::core::origin::origin(origin&& other) noexcept
+  : options_(std::move(other.options_))
+  , nodes_(std::move(other.nodes_))
+  , next_node_(other.next_node_)
+  , exhausted_(other.exhausted_)
+  , connection_string_(std::move(other.connection_string_))
+  , credentials_(std::move(other.credentials_))
+{
+}
+
+auto
+couchbase::core::origin::operator=(origin&& other) noexcept -> origin&
+{
+  if (this != &other) {
+    options_ = std::move(other.options_);
+    nodes_ = std::move(other.nodes_);
+    next_node_ = other.next_node_;
+    exhausted_ = other.exhausted_;
+    connection_string_ = std::move(other.connection_string_);
+    credentials_ = std::move(other.credentials_);
+  }
+  return *this;
+}
+
 couchbase::core::origin::origin(const couchbase::core::origin& other)
   : options_(other.options_)
-  , credentials_(other.credentials_)
   , nodes_(other.nodes_)
   , next_node_(nodes_.begin())
 {
+  update_credentials(other.credentials());
 }
 
 couchbase::core::origin::origin(origin other, const topology::configuration& config)
@@ -321,9 +359,9 @@ couchbase::core::origin::origin(couchbase::core::cluster_credentials auth,
                                 std::uint16_t port,
                                 couchbase::core::cluster_options options)
   : options_(std::move(options))
-  , credentials_(std::move(auth))
   , nodes_{ { hostname, std::to_string(port) } }
   , next_node_(nodes_.begin())
+  , credentials_(std::move(auth))
 {
 }
 couchbase::core::origin::origin(couchbase::core::cluster_credentials auth,
@@ -331,16 +369,16 @@ couchbase::core::origin::origin(couchbase::core::cluster_credentials auth,
                                 const std::string& port,
                                 couchbase::core::cluster_options options)
   : options_(std::move(options))
-  , credentials_(std::move(auth))
   , nodes_{ { hostname, port } }
   , next_node_(nodes_.begin())
+  , credentials_(std::move(auth))
 {
 }
 couchbase::core::origin::origin(couchbase::core::cluster_credentials auth,
                                 const couchbase::core::utils::connection_string& connstr)
   : options_(connstr.options)
-  , credentials_(std::move(auth))
   , connection_string_(connstr.input)
+  , credentials_(std::move(auth))
 {
   nodes_.reserve(connstr.bootstrap_nodes.size());
   for (const auto& node : connstr.bootstrap_nodes) {
@@ -358,7 +396,7 @@ couchbase::core::origin::operator=(const couchbase::core::origin& other) -> couc
 {
   if (this != &other) {
     options_ = other.options_;
-    credentials_ = other.credentials_;
+    update_credentials(other.credentials());
     nodes_ = other.nodes_;
     next_node_ = nodes_.begin();
     exhausted_ = false;
@@ -371,26 +409,36 @@ couchbase::core::origin::connection_string() const -> const std::string&
   return connection_string_;
 }
 auto
-couchbase::core::origin::username() const -> const std::string&
+couchbase::core::origin::username() const -> std::string
 {
+  const std::shared_lock lock(credentials_mutex_);
   return credentials_.username;
 }
 auto
-couchbase::core::origin::password() const -> const std::string&
+couchbase::core::origin::password() const -> std::string
 {
+  const std::shared_lock lock(credentials_mutex_);
   return credentials_.password;
 }
 auto
-couchbase::core::origin::certificate_path() const -> const std::string&
+couchbase::core::origin::certificate_path() const -> std::string
 {
+  const std::shared_lock lock(credentials_mutex_);
   return credentials_.certificate_path;
 }
 auto
-couchbase::core::origin::key_path() const -> const std::string&
+couchbase::core::origin::key_path() const -> std::string
 {
+  const std::shared_lock lock(credentials_mutex_);
   return credentials_.key_path;
 }
 auto
+couchbase::core::origin::jwt_token() const -> std::string
+{
+  const std::shared_lock lock(credentials_mutex_);
+  return credentials_.jwt_token;
+}
+auto
 couchbase::core::origin::get_hostnames() const -> std::vector<std::string>
 {
   std::vector<std::string> res;
@@ -455,6 +503,12 @@ couchbase::core::origin::set_nodes_from_config(const topology::configuration& co
   }
   next_node_ = nodes_.begin();
 }
+void
+couchbase::core::origin::update_credentials(cluster_credentials auth)
+{
+  const std::unique_lock lock(credentials_mutex_);
+  credentials_ = std::move(auth);
+}
 auto
 couchbase::core::origin::next_address() -> std::pair<std::string, std::string>
 {
@@ -490,7 +544,8 @@ couchbase::core::origin::options() -> couchbase::core::cluster_options&
   return options_;
 }
 auto
-couchbase::core::origin::credentials() const -> const couchbase::core::cluster_credentials&
+couchbase::core::origin::credentials() const -> couchbase::core::cluster_credentials
 {
+  const std::shared_lock lock(credentials_mutex_);
   return credentials_;
 }

data/ext/couchbase/core/origin.hxx

@@ -20,6 +20,7 @@
 #include "cluster_credentials.hxx"
 #include "cluster_options.hxx"
 
+#include <shared_mutex>
 #include <string>
 #include <utility>
 #include <vector>
@@ -43,7 +44,7 @@ struct origin {
   origin() = default;
   ~origin() = default;
 
-  origin(origin&& other) = default;
+  origin(origin&& other) noexcept;
   origin(const origin& other);
   origin(origin other, const topology::configuration& config);
   origin(cluster_credentials auth,
@@ -55,14 +56,15 @@ struct origin {
          const std::string& port,
          cluster_options options);
   origin(cluster_credentials auth, const utils::connection_string& connstr);
-  auto operator=(origin&& other) -> origin& = default;
+  auto operator=(origin&& other) noexcept -> origin&;
   auto operator=(const origin& other) -> origin&;
 
   [[nodiscard]] auto connection_string() const -> const std::string&;
-  [[nodiscard]] auto username() const -> const std::string&;
-  [[nodiscard]] auto password() const -> const std::string&;
-  [[nodiscard]] auto certificate_path() const -> const std::string&;
-  [[nodiscard]] auto key_path() const -> const std::string&;
+  [[nodiscard]] auto username() const -> std::string;
+  [[nodiscard]] auto password() const -> std::string;
+  [[nodiscard]] auto certificate_path() const -> std::string;
+  [[nodiscard]] auto key_path() const -> std::string;
+  [[nodiscard]] auto jwt_token() const -> std::string;
 
   [[nodiscard]] auto get_hostnames() const -> std::vector<std::string>;
   [[nodiscard]] auto get_nodes() const -> std::vector<std::string>;
@@ -71,6 +73,8 @@ struct origin {
   void set_nodes(node_list nodes);
   void set_nodes_from_config(const topology::configuration& config);
 
+  void update_credentials(cluster_credentials auth);
+
   [[nodiscard]] auto next_address() -> std::pair<std::string, std::string>;
 
   [[nodiscard]] auto exhausted() const -> bool;
@@ -79,16 +83,17 @@ struct origin {
 
   [[nodiscard]] auto options() const -> const couchbase::core::cluster_options&;
   [[nodiscard]] auto options() -> couchbase::core::cluster_options&;
-  [[nodiscard]] auto credentials() const -> const couchbase::core::cluster_credentials&;
+  [[nodiscard]] auto credentials() const -> couchbase::core::cluster_credentials;
   [[nodiscard]] auto to_json() const -> std::string;
 
 private:
   couchbase::core::cluster_options options_{};
-  cluster_credentials credentials_{};
   node_list nodes_{};
   node_list::iterator next_node_{};
   bool exhausted_{ false };
   std::string connection_string_{};
+  cluster_credentials credentials_{};
+  mutable std::shared_mutex credentials_mutex_{};
 };
 
 } // namespace couchbase::core

data/ext/couchbase/core/orphan_reporter.cxx

@@ -0,0 +1,164 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *   Copyright 2025 Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+#include "orphan_reporter.hxx"
+
+#include <couchbase/build_info.hxx>
+
+#include "logger/logger.hxx"
+#include "utils/concurrent_fixed_priority_queue.hxx"
+#include "utils/json.hxx"
+
+#include <asio/steady_timer.hpp>
+#include <tao/json/value.hpp>
+
+namespace couchbase::core
+{
+auto
+orphan_attributes::operator<(const orphan_attributes& other) const -> bool
+{
+  return total_duration < other.total_duration;
+}
+
+auto
+orphan_attributes::operator>(const orphan_attributes& other) const -> bool
+{
+  return total_duration > other.total_duration;
+}
+
+auto
+orphan_attributes::to_json() const -> tao::json::value
+{
+  return tao::json::value{
+    { "total_duration_us", total_duration.count() },
+    { "last_server_duration_us", last_server_duration.count() },
+    { "total_server_duration_us", total_server_duration.count() },
+    { "operation_name", operation_name },
+    { "last_local_id", connection_id },
+    { "operation_id", operation_id },
+    { "last_local_socket", last_local_socket },
+    { "last_remote_socket", last_remote_socket },
+  };
+}
+
+class orphan_reporter_impl : public std::enable_shared_from_this<orphan_reporter_impl>
+{
+public:
+  orphan_reporter_impl(asio::io_context& ctx, const orphan_reporter_options& options)
+    : options_{ options }
+    , orphan_queue_{ options.sample_size }
+    , emit_timer_{ ctx }
+  {
+  }
+
+  void add_orphan(orphan_attributes&& orphan)
+  {
+    orphan_queue_.emplace(std::move(orphan));
+  }
+
+  void start()
+  {
+    rearm();
+  }
+
+  void stop()
+  {
+    emit_timer_.cancel();
+  }
+
+  auto flush_and_create_output() -> std::optional<std::string>
+  {
+    if (orphan_queue_.empty()) {
+      return std::nullopt;
+    }
+
+    auto [queue, dropped_count] = orphan_queue_.steal_data();
+
+    auto total_count = queue.size() + dropped_count;
+
+    // We only do orphan reporting for KV at the moment. If we extend this to HTTP services, we must
+    // update this to handle other types of services as well.
+    tao::json::value report{
+#if COUCHBASE_CXX_CLIENT_DEBUG_BUILD
+      { "emit_interval_ms", options_.emit_interval.count() },
+      { "sample_size", options_.sample_size },
+#endif
+      { "kv", tao::json::value{ { "total_count", total_count } } },
+    };
+
+    tao::json::value entries = tao::json::empty_array;
+    while (!queue.empty()) {
+      entries.emplace_back(queue.top().to_json());
+      queue.pop();
+    }
+    report["kv"]["top_requests"] = entries;
+
+    return utils::json::generate(report);
+  }
+
+private:
+  void rearm()
+  {
+    emit_timer_.expires_after(options_.emit_interval);
+    emit_timer_.async_wait([self = shared_from_this()](std::error_code ec) -> void {
+      if (ec == asio::error::operation_aborted) {
+        return;
+      }
+
+      if (auto report = self->flush_and_create_output(); report.has_value()) {
+        CB_LOG_WARNING("Orphan responses observed: {}", report.value());
+      }
+
+      self->rearm();
+    });
+  }
+
+  orphan_reporter_options options_;
+  utils::concurrent_fixed_priority_queue<orphan_attributes> orphan_queue_;
+  asio::steady_timer emit_timer_;
+};
+
+orphan_reporter::orphan_reporter(asio::io_context& ctx, const orphan_reporter_options& options)
+  : impl_{ std::make_shared<orphan_reporter_impl>(ctx, options) }
+{
+}
+
+void
+orphan_reporter::add_orphan(orphan_attributes&& orphan)
+{
+  impl_->add_orphan(std::move(orphan));
+}
+
+void
+orphan_reporter::start()
+{
+  impl_->start();
+}
+
+void
+orphan_reporter::stop()
+{
+  impl_->stop();
+}
+
+auto
+orphan_reporter::flush_and_create_output() -> std::optional<std::string>
+{
+  return impl_->flush_and_create_output();
+}
+
+} // namespace couchbase::core

data/ext/couchbase/core/orphan_reporter.hxx

@@ -0,0 +1,65 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *   Copyright 2025 Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+#pragma once
+
+#include "core/protocol/client_opcode.hxx"
+
+#include <asio/io_context.hpp>
+#include <tao/json/value.hpp>
+
+#include <chrono>
+#include <memory>
+
+namespace couchbase::core
+{
+struct orphan_reporter_options {
+  std::chrono::milliseconds emit_interval{ std::chrono::seconds{ 10 } };
+  std::size_t sample_size{ 64 };
+};
+
+struct orphan_attributes {
+  std::string connection_id;
+  std::string operation_id;
+  std::string last_remote_socket;
+  std::string last_local_socket;
+  std::chrono::microseconds total_duration;
+  std::chrono::microseconds last_server_duration{ 0 };
+  std::chrono::microseconds total_server_duration{ 0 };
+  std::string operation_name;
+
+  auto operator<(const orphan_attributes& other) const -> bool;
+  auto operator>(const orphan_attributes& other) const -> bool;
+  auto to_json() const -> tao::json::value;
+};
+
+class orphan_reporter_impl;
+
+class orphan_reporter
+{
+public:
+  orphan_reporter(asio::io_context& ctx, const orphan_reporter_options& options);
+
+  void add_orphan(orphan_attributes&& orphan);
+  void start();
+  void stop();
+  auto flush_and_create_output() -> std::optional<std::string>;
+
+private:
+  std::shared_ptr<orphan_reporter_impl> impl_;
+};
+} // namespace couchbase::core

data/ext/couchbase/core/sasl/CMakeLists.txt

@@ -3,6 +3,7 @@ add_library(
   client.cc
   context.cc
   mechanism.cc
+  oauthbearer/oauthbearer.cc
   plain/plain.cc
   scram-sha/scram-sha.cc
   scram-sha/stringutils.cc)

data/ext/couchbase/core/sasl/client.cc

@@ -17,6 +17,7 @@
 
 #include "client.h"
 
+#include "core/sasl/oauthbearer/oauthbearer.h"
 #include "core/sasl/plain/plain.h"
 #include "core/sasl/scram-sha/scram-sha.h"
 
@@ -43,6 +44,11 @@ ClientContext::ClientContext(GetUsernameCallback user_cb,
       break;
     case Mechanism::PLAIN:
       backend = std::make_unique<mechanism::plain::ClientBackend>(user_cb, password_cb, *this);
+      break;
+    case Mechanism::OAUTHBEARER:
+      backend =
+        std::make_unique<mechanism::oauthbearer::ClientBackend>(user_cb, password_cb, *this);
+      break;
   }
 
   if (!backend) {

data/ext/couchbase/core/sasl/mechanism.cc

@@ -30,7 +30,8 @@ select_mechanism(const std::vector<std::string>& available_mechanisms) -> Mechan
     { std::string{ "SCRAM-SHA512" }, Mechanism::SCRAM_SHA512 },
     { std::string{ "SCRAM-SHA256" }, Mechanism::SCRAM_SHA256 },
     { std::string{ "SCRAM-SHA1" }, Mechanism::SCRAM_SHA1 },
-    { std::string{ "PLAIN" }, Mechanism::PLAIN }
+    { std::string{ "PLAIN" }, Mechanism::PLAIN },
+    { std::string{ "OAUTHBEARER" }, Mechanism::OAUTHBEARER },
   };
 
   for (const auto& [name, code] : mechs) {

data/ext/couchbase/core/sasl/mechanism.h

@@ -30,7 +30,8 @@ enum class Mechanism {
   SCRAM_SHA512,
   SCRAM_SHA256,
   SCRAM_SHA1,
-  PLAIN
+  PLAIN,
+  OAUTHBEARER,
 };
 
 class unknown_mechanism : public std::invalid_argument

data/ext/couchbase/core/sasl/oauthbearer/oauthbearer.cc

@@ -0,0 +1,41 @@
+/*
+ *     Copyright 2018 Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+#include "oauthbearer.h"
+
+#include <spdlog/fmt/bundled/core.h>
+
+namespace couchbase::core::sasl::mechanism::oauthbearer
+{
+auto
+ClientBackend::start() -> std::pair<error, std::string_view>
+{
+  auto header = std::string{ "n,," };
+  header.push_back(0x01);
+  header.append(fmt::format("auth=Bearer {}", passwordCallback()));
+  header.push_back(0x01);
+  header.push_back(0x01);
+  client_message = header;
+  return { error::OK, client_message };
+}
+
+auto
+ClientBackend::step(std::string_view /*input*/) -> std::pair<error, std::string_view>
+{
+  throw std::logic_error("ClientBackend::step(): OAUTHBEARER auth should not call step");
+}
+
+} // namespace couchbase::core::sasl::mechanism::oauthbearer

data/ext/couchbase/core/sasl/oauthbearer/oauthbearer.h

@@ -0,0 +1,47 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *     Copyright 2016 Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+#pragma once
+
+#include "core/sasl/client.h"
+
+/// Extremely simple prototype of an OAUTHBEARER mechanism as
+/// desceribed in https://datatracker.ietf.org/doc/html/rfc7628 and
+/// https://datatracker.ietf.org/doc/html/rfc6750
+namespace couchbase::core::sasl::mechanism::oauthbearer
+{
+
+class ClientBackend : public MechanismBackend
+{
+public:
+  ClientBackend(GetUsernameCallback& user_cb, GetPasswordCallback& password_cb, ClientContext& ctx)
+    : MechanismBackend(user_cb, password_cb, ctx)
+  {
+  }
+
+  [[nodiscard]] auto get_name() const -> std::string_view override
+  {
+    return "OAUTHBEARER";
+  }
+
+  auto start() -> std::pair<error, std::string_view> override;
+
+  auto step(std::string_view) -> std::pair<error, std::string_view> override;
+
+private:
+  std::string client_message;
+};
+} // namespace couchbase::core::sasl::mechanism::oauthbearer

data/ext/couchbase/core/tls_context_provider.cxx

@@ -0,0 +1,44 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ * Copyright 2022-Present Couchbase, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file
+ * except in compliance with the License. You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF
+ * ANY KIND, either express or implied. See the License for the specific language governing
+ * permissions and limitations under the License.
+ */
+
+#include "tls_context_provider.hxx"
+
+#include <asio/ssl/context.hpp>
+
+namespace couchbase::core
+{
+
+tls_context_provider::tls_context_provider()
+  : ctx_(std::make_shared<asio::ssl::context>(asio::ssl::context::tls_client))
+{
+}
+
+tls_context_provider::tls_context_provider(std::shared_ptr<asio::ssl::context> ctx)
+  : ctx_(std::move(ctx))
+{
+}
+
+auto
+tls_context_provider::get_ctx() const -> std::shared_ptr<asio::ssl::context>
+{
+  return std::atomic_load(&ctx_);
+}
+
+void
+tls_context_provider::set_ctx(std::shared_ptr<asio::ssl::context> new_ctx)
+{
+  std::atomic_store(&ctx_, std::move(new_ctx));
+}
+} // namespace couchbase::core