couchbase 3.8.2 → 3.9.1

data/ext/couchbase/core/logger/redaction.hxx

@@ -0,0 +1,503 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *   Copyright 2024-Present Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+/*
+ * Log redaction annotations.
+ *
+ * The SDK never removes or obscures anything itself. It wraps sensitive values in fixed tags so
+ * that an external tool can strip or hash them after the fact. Three categories exist:
+ *
+ *   <ud>...</ud>  user data    document keys and values, application usernames, query statements,
+ *                              email addresses, document xattrs
+ *   <md>...</md>  metadata     cluster names, bucket/scope/collection names, design document,
+ *                              view and index names, replication stream names
+ *   <sd>...</sd>  system data  IP addresses, hostnames, ports, DNS topology
+ *
+ * Usage at a log site:
+ *
+ *   CB_LOG_INFO("connecting to {}", logger::system_data(host));
+ *   CB_LOG_DEBUG("fetching {}", logger::user_data(key));
+ *
+ * Choosing a category, in order:
+ *
+ *   A literal from this source takes no tag: an opcode name, a status enum, an error code, a
+ *   duration, a retry count. It reads the same for every deployment and identifies nobody.
+ *
+ *   A secret takes no tag either, because it must not be logged at all: a password, a bearer
+ *   token, a TLS private key, a SASL payload, a session cookie. A tag would be no protection
+ *   here, since redaction is off by default and a credential that reaches a log file has already
+ *   left the process. There is deliberately no wrapper for this case.
+ *
+ *   Otherwise the origin of the value decides. Something the application supplied is user data, a
+ *   Couchbase resource name is metadata, a host or the network path to it is system data. A value
+ *   that came from outside the SDK and fits none of the three is user data, because the fallback
+ *   has to be the strictest category rather than no tag at all.
+ *
+ * A tag belongs to a log line and nowhere else, so it goes on in the log statement rather than in
+ * the code that produced the value. Nothing headed for the wire, into a config, or back to the
+ * caller may carry one, which means no getter, no to_json() and no fmt formatter for a core type
+ * returns a tagged value: those same functions are reached from places a tag would corrupt.
+ * key_value_error_context::to_json() is the case to keep in mind, since couchbase/fmt/error.hxx
+ * puts its output into any fmt::format("{}", error) an application writes, with no log statement
+ * involved. Leaving the tag to the statement also keeps a bucket name rendering the same way
+ * whether the statement got it from config parsing or from a user call. An accessor added to serve
+ * a log statement therefore returns its value bare: get_node_addresses() hands back "host:port"
+ * and each of the four call sites wraps it.
+ *
+ * The categories are the ones Couchbase Server's log redaction specification defines, and are not
+ * ours to reinterpret. The tool that consumes these tags removes only user data today; removing
+ * metadata and system data as well is specified but unreleased. Tagging all three regardless is
+ * what makes that a change in the tool rather than an audit of every log statement in the SDK, so
+ * a tag being inert today is not a reason to leave it off.
+ *
+ * A list of values gets one tag per entry rather than one around the whole list, so that an entry
+ * still matches the same value logged on its own elsewhere. There is a list form of each category,
+ * and it also renders the double quotes some of these lines already carry, because a tag has to sit
+ * inside them:
+ *
+ *   CB_LOG_INFO("bootstrap nodes: [{}]",
+ *               logger::system_data_list(addresses, logger::list_entries::quoted));
+ *
+ * A serialized document goes the other way: annotate the whole argument, or none of it, but never
+ * a value inside it. A tag written into a JSON string value is read back as part of that value by
+ * anything that parses the line, and some of what this SDK logs has a shape other tools consume --
+ * SDK RFC 0067 fixes the threshold and orphan reports field by field. So the tag sits outside the
+ * document. Note that the values inside are still escaped as described below, so this is no longer
+ * byte-identical. It is still safe for a consumer that parses the line, because both escapes are
+ * JSON's own: "\n" is how JSON spells a newline inside a string, where a literal one is illegal,
+ * and "\u003c" is a legal escape for "<". A parser therefore reconstructs the original value
+ * exactly, which is what SDK RFC 0067 consumers depend on:
+ *
+ *   CB_LOG_WARNING("Operations over threshold: {}",
+ *                  logger::system_data(utils::json::generate(report)));
+ *
+ * One tag then has to carry values that may span categories, so pick the strictest category any
+ * value inside the document could belong to. The whole document hashes as a single token either
+ * way, so what a coarse span costs is diagnosability, not protection. "None of it" is the other
+ * legitimate answer, and it is the one the configuration dumps below take.
+ *
+ * The same holds outside a serialized document: a value that mixes categories takes one tag,
+ * around the whole value, at the strictest category it contains. A connection string carries a
+ * hostname, a bucket name and a username at once, and an HTTP request path can carry a view's
+ * start_key, so both are tagged whole as user data. Reaching inside a value to tag only the part
+ * of it that is sensitive is where this feature gets implemented wrong: the boundaries move with
+ * the format, and a miss is silent.
+ *
+ * Two things must never appear inside a tagged value, and the wrappers remove both while redaction
+ * is enabled, so that no call site has to remember.
+ *
+ * A newline. The tool that consumes these tags is line-oriented, so a value that spans lines leaves
+ * its opening tag and its closing tag on different lines; the tool reports an unmatched tag and
+ * passes the value through in clear text, which is the one failure mode this whole mechanism exists
+ * to prevent. Newlines and carriage returns become "\n" and "\r". The values most likely to span
+ * lines are HTTP bodies and serialized documents, which is to say exactly the ones that must not
+ * leak.
+ *
+ * A tag sequence. A value containing "</ud>" closes its own span early, and the rest of it is then
+ * outside any tag. This is not an attack -- whoever controls the value already knows it -- but it
+ * is a silent failure: an application whose document happens to contain one of these sequences
+ * hands out a log it believes was redacted. Only the "<" of such a sequence is escaped, and only
+ * when it really begins one, so ordinary markup in a logged body stays readable.
+ *
+ * The exclusion markers below escape neither, because the whole point of not_redacted() is to show
+ * the bytes as they are.
+ *
+ * One shape stays untagged for the opposite reason. A hex dump written with the "{:a}" spec
+ * renders as a multi-line grid, so escaping would keep the tag intact but flatten the dump into a
+ * single line of "\n" literals, and a flattened hex dump is not a hex dump. So a hex dump is never
+ * tagged, and the checker rejects a tag around one. The dumps left in the tree are frame headers
+ * and raw socket reads, neither of which carries application data, so they are passed bare rather
+ * than marked; the one that could have carried a document body was removed instead of annotated.
+ *
+ * `bin/check-log-annotations` cannot help with the general case. Whether a value contains a
+ * newline is a property of the value at run time, not of the source.
+ *
+ * Qualify the calls as above. In particular `metadata` is also a member function on several core
+ * types (query_result, row_streamer, transaction_get_result), where an unqualified call would
+ * resolve to the member instead. In a file whose enclosing namespace is `couchbase` rather than
+ * `couchbase::core`, write `core::logger::` instead: a plain `logger::` there finds the public
+ * `couchbase::logger` from <couchbase/logger.hxx>, which has none of these functions.
+ *
+ * When redaction is disabled the wrappers format exactly as the underlying value, so annotating a
+ * log statement never changes its output for users who have not opted in.
+ *
+ * These wrappers hold a reference to the value and are only valid within the enclosing
+ * full-expression. That is always the case inside a CB_LOG_* macro. Do not store one:
+ *
+ *   auto tagged = logger::user_data(build_key());  // DANGLING - build_key() is destroyed here
+ *
+ * Note that CB_LOG_*_RAW bypasses fmt entirely and cannot carry annotations, and CB_LOG_PROTOCOL
+ * is deliberately not redacted. The configuration dumps behind the dump_configuration option are
+ * left unannotated for the same reason: both exist to show exactly what crossed the wire, and both
+ * are opt-in debugging aids rather than something a deployment leaves on. Each of those sites says
+ * so with logger::not_redacted(), so the choice is visible where the dump is written.
+ *
+ * `bin/check-log-annotations` reports log arguments that look sensitive but are not wrapped. It is
+ * a heuristic over argument names, so it suggests rather than decides. It cannot see a value that
+ * was tagged anywhere other than the log site, which is why the list forms above exist as named
+ * wrappers rather than as a helper per file: the checker recognises the name and counts the
+ * argument as annotated, instead of having to be told to look away from it.
+ *
+ * Two wrappers record a reviewed exclusion:
+ *
+ *   logger::not_sensitive(value)  the identifier suggests a category the value does not belong to
+ *   logger::not_redacted(value)   sensitive, and deliberately logged untagged anyway
+ *
+ * Neither changes what is printed. Prefer them to the `no-redact` comment the checker also honours,
+ * which silences a whole log statement and so also silences arguments added to it later.
+ */
+
+#pragma once
+
+#include "logger.hxx"
+
+#include <spdlog/fmt/bundled/core.h>
+#include <spdlog/fmt/bundled/format.h>
+
+#include <cstddef>
+#include <string>
+#include <string_view>
+
+namespace couchbase::core::logger
+{
+
+template<typename T>
+struct redacted_user_data {
+  const T& value;
+};
+
+template<typename T>
+struct redacted_meta_data {
+  const T& value;
+};
+
+template<typename T>
+struct redacted_system_data {
+  const T& value;
+};
+
+template<typename T>
+struct conditionally_redacted_user_data {
+  const T& value;
+  bool sensitive;
+};
+
+template<typename T>
+struct not_sensitive_value {
+  const T& value;
+};
+
+template<typename T>
+struct not_redacted_value {
+  const T& value;
+};
+
+/**
+ * Tag a value as user data (<ud>): document keys and values, application usernames, query
+ * statements, email addresses, document xattrs.
+ */
+template<typename T>
+auto
+user_data(const T& value)
+{
+  return redacted_user_data<T>{ value };
+}
+
+/**
+ * Tag a value as metadata (<md>): cluster, bucket, scope and collection names, design document,
+ * view and index names, and other Couchbase resource names.
+ */
+template<typename T>
+auto
+metadata(const T& value)
+{
+  return redacted_meta_data<T>{ value };
+}
+
+/**
+ * Tag a value as system data (<sd>): IP addresses, hostnames, ports and DNS topology.
+ */
+template<typename T>
+auto
+system_data(const T& value)
+{
+  return redacted_system_data<T>{ value };
+}
+
+/**
+ * Tag a value as user data (<ud>) only when `sensitive` holds, and print it unchanged otherwise.
+ *
+ * For an argument that is sensitive on one branch of a log statement and a constant on another.
+ * Tagging the constant hashes it to a fixed digest, which protects nothing -- the domain is one
+ * value, so anyone holding the salt recovers it immediately -- and costs the reader the diagnostic
+ * the constant was there to give. A body the SDK elided to "[hidden]" and a body it redacted are
+ * then indistinguishable in the output.
+ */
+template<typename T>
+auto
+user_data_if(bool sensitive, const T& value)
+{
+  return conditionally_redacted_user_data<T>{ value, sensitive };
+}
+
+/**
+ * Mark a value the annotation checker flags but that is not sensitive, because the identifier
+ * suggests a category the value does not belong to. Formats exactly as the value would unwrapped,
+ * so this is an assertion for the reader and for the checker rather than a change in behaviour.
+ */
+template<typename T>
+auto
+not_sensitive(const T& value)
+{
+  return not_sensitive_value<T>{ value };
+}
+
+/**
+ * Mark a sensitive value that is deliberately logged without a tag, because wrapping it here is
+ * either not possible or not wanted. Formats exactly as the value would unwrapped. Unlike
+ * not_sensitive() this asserts nothing about the content, so say at the call site why the value
+ * carries no tag, and reference a ticket when the answer is that it eventually should.
+ */
+template<typename T>
+auto
+not_redacted(const T& value)
+{
+  return not_redacted_value<T>{ value };
+}
+
+/**
+ * Whether the entries of a tagged list render inside double quotes. The tag sits inside the quotes,
+ * never around them: a span that swallows the punctuation hashes to something matching no other
+ * line in the log.
+ */
+enum class list_entries {
+  bare,
+  quoted,
+};
+
+namespace detail
+{
+/*
+ * The tag sequences themselves, which must not survive inside a tagged value: a value carrying one
+ * would close its own span early, and whatever followed would sit outside any tag.
+ */
+inline constexpr std::string_view tag_sequences[]{
+  "<ud>", "</ud>", "<md>", "</md>", "<sd>", "</sd>",
+};
+
+constexpr auto
+opens_tag_sequence(std::string_view value) -> bool
+{
+  for (const auto sequence : tag_sequences) {
+    if (value.substr(0, sequence.size()) == sequence) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/*
+ * Replace what would otherwise break the span around a value.
+ *
+ * A newline splits it: the consumer of these tags is line-oriented, so an embedded newline leaves
+ * the opening tag and the closing tag on different lines, and the value is then passed through
+ * untouched instead of being redacted. A tag sequence inside the value closes the span early, with
+ * the same result for whatever follows it. Only the "<" of such a sequence is escaped, which is
+ * enough to break it; escaping it to "\<" would not be, because "\</ud>" still contains "</ud>".
+ *
+ * A "<" that does not begin a tag sequence is left alone, so ordinary markup in a logged body is
+ * still readable.
+ */
+template<typename OutputIt>
+auto
+write_escaped(OutputIt out, std::string_view value) -> OutputIt
+{
+  // std::copy is deliberately not used here. fmt's appender does not satisfy MSVC's
+  // iterator_traits requirements, so std::copy over it fails to compile on Windows.
+  std::size_t copied = 0;
+  for (std::size_t index = 0; index < value.size(); ++index) {
+    std::string_view replacement{};
+    switch (value[index]) {
+      case '\n':
+        replacement = "\\n";
+        break;
+      case '\r':
+        replacement = "\\r";
+        break;
+      case '<':
+        if (!opens_tag_sequence(value.substr(index))) {
+          continue;
+        }
+        replacement = "\\u003c";
+        break;
+      default:
+        continue;
+    }
+    out = fmt::format_to(out, "{}{}", value.substr(copied, index - copied), replacement);
+    copied = index + 1;
+  }
+  return fmt::format_to(out, "{}", value.substr(copied));
+}
+
+template<typename Container, typename Wrap>
+auto
+tagged_list(const Container& values, list_entries entries, std::string_view separator, Wrap wrap)
+  -> std::string
+{
+  std::string result;
+  auto first = true;
+  for (const auto& value : values) {
+    if (!first) {
+      result.append(separator);
+    }
+    first = false;
+    if (entries == list_entries::quoted) {
+      result.append(fmt::format(R"("{}")", wrap(value)));
+    } else {
+      result.append(fmt::format("{}", wrap(value)));
+    }
+  }
+  return result;
+}
+} // namespace detail
+
+/*
+ * Tag every entry of a container and join them, so a list correlates entry by entry. One tag around
+ * the joined string would hash the whole list as a single token, matching nothing else in the log,
+ * not even the same value logged beside it in a span of its own.
+ *
+ * Unlike the wrappers above, these return a std::string rather than a view of the value, because
+ * there is nothing to view: the tagged entries do not exist until they are built. Call them inside
+ * the CB_LOG_* argument list, so they stay as lazy as the statement that needs them.
+ */
+
+/**
+ * Tag each entry of a container as user data (<ud>) and join them.
+ */
+template<typename Container>
+auto
+user_data_list(const Container& values,
+               list_entries entries = list_entries::bare,
+               std::string_view separator = ", ") -> std::string
+{
+  return detail::tagged_list(values, entries, separator, [](const auto& value) {
+    return user_data(value);
+  });
+}
+
+/**
+ * Tag each entry of a container as metadata (<md>) and join them.
+ */
+template<typename Container>
+auto
+metadata_list(const Container& values,
+              list_entries entries = list_entries::bare,
+              std::string_view separator = ", ") -> std::string
+{
+  return detail::tagged_list(values, entries, separator, [](const auto& value) {
+    return metadata(value);
+  });
+}
+
+/**
+ * Tag each entry of a container as system data (<sd>) and join them.
+ */
+template<typename Container>
+auto
+system_data_list(const Container& values,
+                 list_entries entries = list_entries::bare,
+                 std::string_view separator = ", ") -> std::string
+{
+  return detail::tagged_list(values, entries, separator, [](const auto& value) {
+    return system_data(value);
+  });
+}
+
+} // namespace couchbase::core::logger
+
+#ifndef COUCHBASE_CXX_CLIENT_DOXYGEN
+/*
+ * The formatters inherit parse() from the underlying formatter, so format specifications keep
+ * working. Note that a specification applies to the value only, so "{:>10}" pads inside the tags.
+ */
+#define COUCHBASE_LOGGER_REDACTION_FORMATTER(wrapper, tag)                                         \
+  template<typename T>                                                                             \
+  struct fmt::formatter<couchbase::core::logger::wrapper<T>> : fmt::formatter<T> {                 \
+    template<typename FormatContext>                                                               \
+    auto format(const couchbase::core::logger::wrapper<T>& redacted, FormatContext& ctx) const     \
+    {                                                                                              \
+      if (!couchbase::core::logger::is_log_redaction_enabled()) {                                  \
+        return fmt::formatter<T>::format(redacted.value, ctx);                                     \
+      }                                                                                            \
+      fmt::memory_buffer buffer;                                                                   \
+      /* The caller's arguments come along: a dynamic specification such as "{:{}}" resolves its   \
+       * width through the context, so an empty argument store would throw here while the          \
+       * unredacted branch worked. */                                                              \
+      fmt::basic_format_context<fmt::appender, char> buffered{ fmt::appender(buffer),              \
+                                                               ctx.args(),                         \
+                                                               ctx.locale() };                     \
+      fmt::formatter<T>::format(redacted.value, buffered);                                         \
+      ctx.advance_to(fmt::format_to(ctx.out(), "<" tag ">"));                                      \
+      ctx.advance_to(couchbase::core::logger::detail::write_escaped(                               \
+        ctx.out(), std::string_view{ buffer.data(), buffer.size() }));                             \
+      return fmt::format_to(ctx.out(), "</" tag ">");                                              \
+    }                                                                                              \
+  }
+
+COUCHBASE_LOGGER_REDACTION_FORMATTER(redacted_user_data, "ud");
+COUCHBASE_LOGGER_REDACTION_FORMATTER(redacted_meta_data, "md");
+COUCHBASE_LOGGER_REDACTION_FORMATTER(redacted_system_data, "sd");
+
+#undef COUCHBASE_LOGGER_REDACTION_FORMATTER
+
+/*
+ * Reuses the <ud> formatter for the tagged branch rather than repeating it, so the two cannot
+ * drift apart on escaping or on what a disabled redaction level prints.
+ */
+template<typename T>
+struct fmt::formatter<couchbase::core::logger::conditionally_redacted_user_data<T>>
+  : fmt::formatter<couchbase::core::logger::redacted_user_data<T>> {
+  template<typename FormatContext>
+  auto format(const couchbase::core::logger::conditionally_redacted_user_data<T>& redacted,
+              FormatContext& ctx) const
+  {
+    if (!redacted.sensitive) {
+      return fmt::formatter<T>::format(redacted.value, ctx);
+    }
+    return fmt::formatter<couchbase::core::logger::redacted_user_data<T>>::format(
+      couchbase::core::logger::redacted_user_data<T>{ redacted.value }, ctx);
+  }
+};
+
+/*
+ * The exclusion markers print their value and nothing else, whether or not redaction is enabled.
+ */
+#define COUCHBASE_LOGGER_EXCLUSION_FORMATTER(wrapper)                                              \
+  template<typename T>                                                                             \
+  struct fmt::formatter<couchbase::core::logger::wrapper<T>> : fmt::formatter<T> {                 \
+    template<typename FormatContext>                                                               \
+    auto format(const couchbase::core::logger::wrapper<T>& marked, FormatContext& ctx) const       \
+    {                                                                                              \
+      return fmt::formatter<T>::format(marked.value, ctx);                                         \
+    }                                                                                              \
+  }
+
+COUCHBASE_LOGGER_EXCLUSION_FORMATTER(not_sensitive_value);
+COUCHBASE_LOGGER_EXCLUSION_FORMATTER(not_redacted_value);
+
+#undef COUCHBASE_LOGGER_EXCLUSION_FORMATTER
+#endif

data/ext/couchbase/core/management/eventing_status.hxx

@@ -54,6 +54,16 @@ enum class function_status {
    * The function is currently being paused.
    */
   pausing,
+
+  /**
+   * The function is currently being resumed, after having been paused.
+   */
+  resuming,
+
+  /**
+   * The server reported an unrecognized function status.
+   */
+  unknown,
 };
 
 enum class function_deployment_status {

data/ext/couchbase/core/management/eventing_status_json.hxx

@@ -72,6 +72,10 @@ struct traits<couchbase::core::management::eventing::status> {
           function.status = couchbase::core::management::eventing::function_status::paused;
         } else if (composite_status == "pausing") {
           function.status = couchbase::core::management::eventing::function_status::pausing;
+        } else if (composite_status == "resuming") {
+          function.status = couchbase::core::management::eventing::function_status::resuming;
+        } else {
+          function.status = couchbase::core::management::eventing::function_status::unknown;
         }
 
         if (const auto* function_scope = app.find("function_scope");

data/ext/couchbase/core/mcbp/big_endian.cxx

@@ -75,7 +75,7 @@ void
 put_uint64(gsl::span<std::byte> bytes, std::uint64_t value)
 {
   for (std::size_t i = 0; i < 8; ++i) {
-    bytes[i] = static_cast<std::byte>(value >> (56 - i * 8));
+    bytes[i] = static_cast<std::byte>(value >> (56 - (i * 8)));
   }
 }
 } // namespace couchbase::core::mcbp::big_endian

data/ext/couchbase/core/mcbp/codec.cxx

@@ -76,8 +76,7 @@ codec::encode_packet(const couchbase::core::mcbp::packet& packet) const
       // It also doesn't expect the collection ID to be leb encoded.
       extras.resize(sizeof(std::uint32_t));
       big_endian::put_uint32(extras, packet.collection_id_);
-    }
-    if (packet.collection_id_ > 0) {
+    } else if (packet.collection_id_ > 0) {
       CB_LOG_DEBUG("cannot encode collection id with a non-collection command");
       return tl::unexpected(errc::common::invalid_argument);
     }
@@ -432,11 +431,11 @@ codec::decode_packet(gsl::span<std::byte> header, gsl::span<std::byte> body) con
           } else if (frame_type == mcbp::request_sync_durability &&
                      (frame_len == 1 || frame_len == 3)) {
             pkt.durability_level_frame_ = mcbp::durability_level_frame{
-              static_cast<mcbp::durability_level>(body[frame_offset])
+              static_cast<mcbp::durability_level>(body[frame_offset]),
             };
             if (frame_len == 3) {
               pkt.durability_timeout_frame_ = mcbp::durability_timeout_frame{
-                std::chrono::milliseconds{ big_endian::read_uint16(body, frame_offset + 1) }
+                std::chrono::milliseconds{ big_endian::read_uint16(body, frame_offset + 1) },
               };
             } else {
               // We follow the semantic that duplicate frames overwrite previous ones, since the
@@ -445,39 +444,49 @@ codec::decode_packet(gsl::span<std::byte> header, gsl::span<std::byte> body) con
               pkt.durability_timeout_frame_.reset();
             }
           } else if (frame_type == mcbp::request_stream_id && frame_len == 2) {
-            pkt.stream_id_frame_ =
-              mcbp::stream_id_frame{ big_endian::read_uint16(body, frame_offset) };
+            pkt.stream_id_frame_ = mcbp::stream_id_frame{
+              big_endian::read_uint16(body, frame_offset),
+            };
           } else if (frame_type == mcbp::request_open_tracing && frame_len > 0) {
-            pkt.open_tracing_frame_ =
-              mcbp::open_tracing_frame{ big_endian::read(body, frame_offset, frame_len) };
+            pkt.open_tracing_frame_ = mcbp::open_tracing_frame{
+              big_endian::read(body, frame_offset, frame_len),
+            };
           } else if (frame_type == mcbp::request_preserve_expiry && frame_len == 0) {
             pkt.preserve_expiry_frame_ = mcbp::preserve_expiry_frame{};
           } else if (frame_type == mcbp::request_user_impersonation && frame_len > 0) {
-            pkt.user_impersonation_frame_ =
-              mcbp::user_impersonation_frame{ big_endian::read(body, frame_offset, frame_len) };
+            pkt.user_impersonation_frame_ = mcbp::user_impersonation_frame{
+              big_endian::read(body, frame_offset, frame_len),
+            };
           } else {
             // If we don't understand this frame type, we record it as an UnsupportedFrame (as
             // opposed to dropping it blindly)
             pkt.unsupported_frames_.emplace_back(mcbp::unsupported_frame{
-              frame_type, big_endian::read(body, frame_offset, frame_len) });
+              frame_type,
+              big_endian::read(body, frame_offset, frame_len),
+            });
           }
           break;
 
         case protocol::magic::alt_client_response:
           if (frame_type == mcbp::response_server_duration && frame_len == 2) {
-            pkt.server_duration_frame_ = mcbp::server_duration_frame{ mcbp::decode_server_duration(
-              big_endian::read_uint16(body, frame_offset)) };
+            pkt.server_duration_frame_ = mcbp::server_duration_frame{
+              mcbp::decode_server_duration(big_endian::read_uint16(body, frame_offset)),
+            };
           } else if (frame_type == mcbp::response_read_units && frame_len == 2) {
-            pkt.read_units_frame_ =
-              mcbp::read_units_frame{ big_endian::read_uint16(body, frame_offset) };
+            pkt.read_units_frame_ = mcbp::read_units_frame{
+              big_endian::read_uint16(body, frame_offset),
+            };
           } else if (frame_type == mcbp::response_write_units && frame_len == 2) {
-            pkt.write_units_frame_ =
-              mcbp::write_units_frame{ big_endian::read_uint16(body, frame_offset) };
+            pkt.write_units_frame_ = mcbp::write_units_frame{
+              big_endian::read_uint16(body, frame_offset),
+            };
           } else {
             // If we don't understand this frame type, we record it as an UnsupportedFrame (as
             // opposed to dropping it blindly)
             pkt.unsupported_frames_.emplace_back(mcbp::unsupported_frame{
-              frame_type, big_endian::read(body, frame_offset, frame_len) });
+              frame_type,
+              big_endian::read(body, frame_offset, frame_len),
+            });
           }
           break;
 

data/ext/couchbase/core/mcbp/operation_queue.cxx

@@ -77,7 +77,7 @@ operation_queue::push(std::shared_ptr<queue_request> request,
     return errc::network::operation_queue_full;
   }
 
-  if (operation_queue * no_queue{ nullptr };
+  if (operation_queue* no_queue{ nullptr };
       !request->queued_with_.compare_exchange_strong(no_queue, this)) {
     return errc::network::request_already_queued;
   }
@@ -102,7 +102,7 @@ operation_queue::remove(const std::shared_ptr<queue_request>& request) -> bool
     return false;
   }
 
-  if (operation_queue * this_queue{ nullptr };
+  if (operation_queue* this_queue{ this };
       !request->queued_with_.compare_exchange_strong(this_queue, nullptr)) {
     return false;
   }

data/ext/couchbase/core/mcbp/packet.hxx

@@ -43,8 +43,8 @@ class packet
 public:
   [[nodiscard]] auto debug_string() const -> std::string;
 
-  protocol::magic magic_;
-  protocol::client_opcode command_;
+  protocol::magic magic_{ protocol::magic::invalid };
+  protocol::client_opcode command_{ protocol::client_opcode::invalid };
   std::byte datatype_{};
   std::uint16_t status_{ 0x00 };
   key_value_status_code status_code_{ key_value_status_code::success };