mongo 2.10.5 → 2.15.1

data/lib/mongo/auth/user.rb

@@ -1,4 +1,7 @@
-# Copyright (C) 2014-2019 MongoDB Inc.
+# frozen_string_literal: true
+# encoding: utf-8
+
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -155,13 +158,11 @@ module Mongo
       #   If :password and :pwd are both specified, :password takes precedence.
       # @option options [ Symbol ] :auth_mech The authorization mechanism.
       # @option options [ Array<String>, Array<Hash> ] roles The user roles.
-      # @option options [ String ] :client_key The user's client key cached from a previous
-      #   authentication on the same connection.
       #
       # @since 2.0.0
       def initialize(options)
         @database = options[:database] || Database::ADMIN
-        @auth_source = options[:auth_source] || @database
+        @auth_source = options[:auth_source] || self.class.default_auth_source(options)
         @name = options[:user]
         @password = options[:password] || options[:pwd]
         @mechanism = options[:auth_mech]
@@ -186,7 +187,6 @@ module Mongo
         end
         @auth_mech_properties = options[:auth_mech_properties] || {}
         @roles = options[:roles] || []
-        @client_key = options[:client_key]
       end
 
       # Get the specification for the user, used in creation.
@@ -207,10 +207,19 @@ module Mongo
 
       private
 
-      # The client key for the user.
+      # Generate default auth source based on the URI and options
       #
-      # @return [ String ] The client key for the user.
-      attr_reader :client_key
+      # @api private
+      def self.default_auth_source(options)
+        case options[:auth_mech]
+        when :aws, :gssapi, :mongodb_x509
+          '$external'
+        when :plain
+          options[:database] || '$external'
+        else
+          options[:database] || Database::ADMIN
+        end
+      end
     end
   end
 end

data/lib/mongo/auth/x509/conversation.rb

@@ -1,4 +1,7 @@
-# Copyright (C) 2014-2019 MongoDB Inc.
+# frozen_string_literal: true
+# encoding: utf-8
+
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,89 +19,50 @@ module Mongo
   module Auth
     class X509
 
-      # Defines behavior around a single x.509 conversation between the
+      # Defines behavior around a single X.509 conversation between the
       # client and server.
       #
       # @since 2.0.0
-      class Conversation
+      # @api private
+      class Conversation < ConversationBase
 
         # The login message.
         #
         # @since 2.0.0
-        LOGIN = { authenticate: 1 }.freeze
-
-        # @return [ Protocol::Message ] reply The current reply in the
-        #   conversation.
-        attr_reader :reply
-
-        # @return [ User ] user The user for the conversation.
-        attr_reader :user
-
-        # Finalize the x.509 conversation. This is meant to be iterated until
-        # the provided reply indicates the conversation is finished.
-        #
-        # @example Finalize the conversation.
-        #   conversation.finalize(reply)
-        #
-        # @param [ Protocol::Message ] reply The reply of the previous
-        #   message.
-        #
-        # @return [ Protocol::Query ] The next message to send.
-        #
-        # @since 2.0.0
-        def finalize(reply)
-          validate!(reply)
-        end
+        LOGIN = { authenticate: 1, mechanism: X509::MECHANISM }.freeze
 
-        # Start the x.509 conversation. This returns the first message that
+        # Start the X.509 conversation. This returns the first message that
         # needs to be sent to the server.
         #
-        # @example Start the conversation.
-        #   conversation.start
-        #
-        # @param [ Mongo::Server::Connection ] connection The connection being authenticated.
+        # @param [ Server::Connection ] connection The connection being
+        #   authenticated.
         #
-        # @return [ Protocol::Query ] The first x.509 conversation message.
+        # @return [ Protocol::Message ] The first X.509 conversation message.
         #
         # @since 2.0.0
-        def start(connection = nil)
-          login = LOGIN.merge(mechanism: X509::MECHANISM)
-          login[:user] = user.name if user.name
-          if connection && connection.features.op_msg_enabled?
-            selector = login
-            selector[Protocol::Msg::DATABASE_IDENTIFIER] = user.auth_source
-            cluster_time = connection.mongos? && connection.cluster_time
-            selector[Operation::CLUSTER_TIME] = cluster_time if cluster_time
-            Protocol::Msg.new([], {}, selector)
-          else
-            Protocol::Query.new(
-              Auth::EXTERNAL,
-              Database::COMMAND,
-              login,
-              limit: -1
-            )
-          end
+        def start(connection)
+          validate_external_auth_source
+          selector = client_first_document
+          build_message(connection, '$external', selector)
         end
 
-        # Create the new conversation.
-        #
-        # @example Create the new conversation.
-        #   Conversation.new(user, "admin")
+        # Returns the hash to provide to the server in the handshake
+        # as value of the speculativeAuthenticate key.
         #
-        # @param [ Auth::User ] user The user to converse about.
+        # If the auth mechanism does not support speculative authentication,
+        # this method returns nil.
         #
-        # @since 2.0.0
-        def initialize(user)
-          @user = user
+        # @return [ Hash | nil ] Speculative authentication document.
+        def speculative_auth_document
+          client_first_document
         end
 
         private
 
-        def validate!(reply)
-          if reply.documents[0][Operation::Result::OK] != 1
-            raise Unauthorized.new(user, MECHANISM)
+        def client_first_document
+          LOGIN.dup.tap do |payload|
+            payload[:user] = user.name if user.name
           end
-          @reply = reply
         end
       end
     end

data/lib/mongo/auth/x509.rb

@@ -1,4 +1,7 @@
-# Copyright (C) 2014-2019 MongoDB Inc.
+# frozen_string_literal: true
+# encoding: utf-8
+
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,53 +15,46 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-require 'mongo/auth/x509/conversation'
-
 module Mongo
   module Auth
 
-    # Defines behavior for x.509 authentication.
+    # Defines behavior for X.509 authentication.
     #
     # @since 2.0.0
-    class X509
+    # @api private
+    class X509 < Base
 
-      # The authentication mechinism string.
+      # The authentication mechanism string.
       #
       # @since 2.0.0
       MECHANISM = 'MONGODB-X509'.freeze
 
-      # @return [ Mongo::Auth::User ] The user to authenticate.
-      attr_reader :user
+      # Initializes the X.509 authenticator.
+      #
+      # @param [ Auth::User ] user The user to authenticate.
+      # @param [ Mongo::Connection ] connection The connection to authenticate over.
+      def initialize(user, connection, **opts)
+        # The only valid database for X.509 authentication is $external.
+        if user.auth_source != '$external'
+          user_name_msg = if user.name
+            " #{user.name}"
+          else
+            ''
+          end
+          raise Auth::InvalidConfiguration, "User#{user_name_msg} specifies auth source '#{user.auth_source}', but the only valid auth source for X.509 is '$external'"
+        end
 
-      # Instantiate a new authenticator.
-      #
-      # @example Create the authenticator.
-      #   Mongo::Auth::X509.new(user)
-      #
-      # @param [ Mongo::Auth::User ] user The user to authenticate.
-      #
-      # @since 2.0.0
-      def initialize(user)
-        @user = user
+        super
       end
 
-      # Log the user in on the given connection.
+      # Log the user in on the current connection.
       #
-      # @example Log the user in.
-      #   user.login(connection)
-      #
-      # @param [ Mongo::Connection ] connection The connection to log into.
-      #   on.
-      #
-      # @return [ Protocol::Message ] The authentication response.
-      #
-      # @since 2.0.0
-      def login(connection)
-        conversation = Conversation.new(user)
-        reply = connection.dispatch([ conversation.start(connection) ])
-        connection.update_cluster_time(Operation::Result.new(reply))
-        conversation.finalize(reply)
+      # @return [ BSON::Document ] The document of the authentication response.
+      def login
+        converse_1_step(connection, conversation)
       end
     end
   end
 end
+
+require 'mongo/auth/x509/conversation'

data/lib/mongo/auth.rb

@@ -1,4 +1,7 @@
-# Copyright (C) 2014-2019 MongoDB, Inc.
+# frozen_string_literal: true
+# encoding: utf-8
+
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,13 +15,21 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+require 'mongo/auth/credential_cache'
+require 'mongo/auth/stringprep'
+require 'mongo/auth/conversation_base'
+require 'mongo/auth/sasl_conversation_base'
+require 'mongo/auth/scram_conversation_base'
+require 'mongo/auth/user'
+require 'mongo/auth/roles'
+require 'mongo/auth/base'
+require 'mongo/auth/aws'
 require 'mongo/auth/cr'
+require 'mongo/auth/gssapi'
 require 'mongo/auth/ldap'
 require 'mongo/auth/scram'
-require 'mongo/auth/user'
+require 'mongo/auth/scram256'
 require 'mongo/auth/x509'
-require 'mongo/auth/roles'
-require 'mongo/auth/stringprep'
 
 module Mongo
 
@@ -31,49 +42,70 @@ module Mongo
     # The external database name.
     #
     # @since 2.0.0
+    # @api private
     EXTERNAL = '$external'.freeze
 
     # Constant for the nonce command.
     #
     # @since 2.0.0
+    # @api private
     GET_NONCE = { getnonce: 1 }.freeze
 
     # Constant for the nonce field.
     #
     # @since 2.0.0
+    # @api private
     NONCE = 'nonce'.freeze
 
     # Map the symbols parsed from the URI connection string to strategies.
     #
+    # @note This map is not frozen because when mongo_kerberos is loaded,
+    #   it mutates this map by adding the Kerberos authenticator.
+    #
     # @since 2.0.0
     SOURCES = {
+      aws: Aws,
+      gssapi: Gssapi,
       mongodb_cr: CR,
       mongodb_x509: X509,
       plain: LDAP,
-      scram: SCRAM,
-      scram256: SCRAM,
+      scram: Scram,
+      scram256: Scram256,
     }
 
-    # Get the authorization strategy for the provided auth mechanism.
+    # Get an authenticator for the provided user to authenticate over the
+    # provided connection.
     #
-    # @example Get the strategy.
-    #   Auth.get(user)
+    # @param [ Auth::User ] user The user to authenticate.
+    # @param [ Mongo::Connection ] connection The connection to authenticate over.
     #
-    # @param [ Auth::User ] user The user object.
+    # @option opts [ String | nil ] speculative_auth_client_nonce The client
+    #   nonce used in speculative auth on the specified connection that
+    #   produced the specified speculative auth result.
+    # @option opts [ BSON::Document | nil ] speculative_auth_result The
+    #   value of speculativeAuthenticate field of hello response of
+    #   the handshake on the specified connection.
     #
-    # @return [ CR, X509, LDAP, Kerberos ] The auth strategy.
+    # @return [ Auth::Aws | Auth::CR | Auth::Gssapi | Auth::LDAP |
+    #   Auth::Scram | Auth::Scram256 | Auth::X509 ] The authenticator.
     #
     # @since 2.0.0
-    def get(user)
+    # @api private
+    def get(user, connection, **opts)
       mechanism = user.mechanism
       raise InvalidMechanism.new(mechanism) if !SOURCES.has_key?(mechanism)
-      SOURCES[mechanism].new(user)
+      SOURCES[mechanism].new(user, connection, **opts)
     end
 
+    # Raised when trying to authorize with an invalid configuration
+    #
+    # @since 2.11.0
+    class InvalidConfiguration < Mongo::Error::AuthError; end
+
     # Raised when trying to get an invalid authorization mechanism.
     #
     # @since 2.0.0
-    class InvalidMechanism < RuntimeError
+    class InvalidMechanism < InvalidConfiguration
 
       # Instantiate the new error.
       #
@@ -94,7 +126,7 @@ module Mongo
     # Raised when a user is not authorized on a database.
     #
     # @since 2.0.0
-    class Unauthorized < RuntimeError
+    class Unauthorized < Mongo::Error::AuthError
 
       # Instantiate the new error.
       #
@@ -104,20 +136,49 @@ module Mongo
       # @param [ Mongo::Auth::User ] user The unauthorized user.
       # @param [ String ] used_mechanism Auth mechanism actually used for
       #   authentication. This is a full string like SCRAM-SHA-256.
+      # @param [ String ] message The error message returned by the server.
+      # @param [ Server ] server The server instance that authentication
+      #   was attempted against.
       #
       # @since 2.0.0
-      def initialize(user, used_mechanism = nil)
-        specified_mechanism = if user.mechanism
-          " (mechanism: #{user.mechanism})"
+      def initialize(user, used_mechanism: nil, message: nil,
+        server: nil
+      )
+        configured_bits = []
+        used_bits = [
+          "auth source: #{user.auth_source}",
+        ]
+
+        if user.mechanism
+          configured_bits << "mechanism: #{user.mechanism}"
+        end
+
+        if used_mechanism
+          used_bits << "used mechanism: #{used_mechanism}"
+        end
+
+        if server
+          used_bits << "used server: #{server.address} (#{server.status})"
+        end
+
+        used_user = if user.mechanism == :mongodb_x509
+          'Client certificate'
         else
-          ''
+          "User #{user.name}"
         end
-        used_mechanism = if used_mechanism
-          " (used mechanism: #{used_mechanism})"
+
+        if configured_bits.empty?
+          configured_bits = ''
         else
-          ''
+          configured_bits = " (#{configured_bits.join(', ')})"
+        end
+
+        used_bits = " (#{used_bits.join(', ')})"
+
+        msg = "#{used_user}#{configured_bits} is not authorized to access #{user.database}#{used_bits}"
+        if message
+          msg += ': ' + message
         end
-        msg = "User #{user.name}#{specified_mechanism} is not authorized to access #{user.database}#{used_mechanism}"
         super(msg)
       end
     end

data/lib/mongo/background_thread.rb

@@ -0,0 +1,173 @@
+# frozen_string_literal: true
+# encoding: utf-8
+
+# Copyright (C) 2019-2020 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+
+  # The run!, running? and stop! methods used to be part of the public API
+  # in some of the classes which now include this module. Therefore these
+  # methods must be considered part of the driver's public API for backwards
+  # compatibility reasons. However using these methods outside of the driver
+  # is deprecated.
+  #
+  # @note Do not start or stop background threads in finalizers. See
+  #   https://jira.mongodb.org/browse/RUBY-2453 and
+  #   https://bugs.ruby-lang.org/issues/16288. When interpreter exits,
+  #   background threads are stopped first and finalizers are invoked next,
+  #   and MRI's internal data structures are basically corrupt at this point
+  #   if threads are being referenced. Prior to interpreter shutdown this
+  #   means threads cannot be stopped by objects going out of scope, but
+  #   most likely the threads hold references to said objects anyway if
+  #   work is being performed thus the objects wouldn't go out of scope in
+  #   the first place.
+  #
+  # @api private
+  module BackgroundThread
+    include Loggable
+
+    # Start the background thread.
+    #
+    # If the thread is already running, this method does nothing.
+    #
+    # @api public for backwards compatibility only
+    def run!
+      if @stop_requested && @thread
+        wait_for_stop
+        if @thread.alive?
+          log_warn("Starting a new background thread in #{self}, but the previous background thread is still running")
+          @thread = nil
+        end
+        @stop_requested = false
+      end
+      if running?
+        @thread
+      else
+        start!
+      end
+    end
+
+    # @api public for backwards compatibility only
+    def running?
+      if @thread
+        @thread.alive?
+      else
+        false
+      end
+    end
+
+    # Stop the background thread and wait for to terminate for a reasonable
+    # amount of time.
+    #
+    # @return [ true | false ] Whether the thread was terminated.
+    #
+    # @api public for backwards compatibility only
+    def stop!
+      # If the thread was not started, there is nothing to stop.
+      #
+      # Classes including this module may want to perform additional
+      # cleanup, which they can do by overriding this method.
+      return true unless @thread
+
+      # Background threads generally perform operations in a loop.
+      # This flag is meant to be checked on each iteration of the
+      # working loops and the thread should stop working when this flag
+      # is set.
+      @stop_requested = true
+
+      # Besides setting the flag, a particular class may have additional
+      # ways of signaling the background thread to either stop working or
+      # wake up to check the stop flag, for example, setting a semaphore.
+      # This can be accomplished by providing the pre_stop method.
+      pre_stop
+
+      # Now we have requested the graceful termination, and we could wait
+      # for the thread to exit on its own accord. A future version of the
+      # driver may allow a certain amount of time for the thread to quit.
+      # For now, we additionally use the Ruby machinery to request the thread
+      # be terminated, and do so immediately.
+      #
+      # Note that this may cause the background thread to terminate in
+      # the middle of an operation.
+      @thread.kill
+
+      wait_for_stop
+    end
+
+    private
+
+    def start!
+      @thread = Thread.new do
+        catch(:done) do
+          until @stop_requested
+            do_work
+          end
+        end
+      end
+    end
+
+    # Waits for the thread to die, with a timeout.
+    #
+    # Returns true if the thread died, false otherwise.
+    def wait_for_stop
+      # Wait for the thread to die. This is important in order to reliably
+      # clean up resources like connections knowing that no background
+      # thread will reconnect because it is still working.
+      #
+      # However, we do not want to wait indefinitely because in theory
+      # a background thread could be performing, say, network I/O and if
+      # the network is no longer available that could take a long time.
+      start_time = Utils.monotonic_time
+      ([0.1, 0.15] + [0.2] * 5 + [0.3] * 20).each do |interval|
+        begin
+          Timeout.timeout(interval) do
+            @thread.join
+          end
+          break
+        rescue ::Timeout::Error
+        end
+      end
+
+      # Some driver objects can be reconnected, for backwards compatibiilty
+      # reasons. Clear the thread instance variable to support this cleanly.
+      if @thread.alive?
+        log_warn("Failed to stop the background thread in #{self} in #{(Utils.monotonic_time - start_time).to_i} seconds: #{@thread.inspect} (thread status: #{@thread.status})")
+        # On JRuby the thread may be stuck in aborting state
+        # seemingly indefinitely. If the thread is aborting, consider it dead
+        # for our purposes (we will create a new thread if needed, and
+        # the background thread monitor will not detect the aborting thread
+        # as being alive).
+        if @thread.status == 'aborting'
+          @thread = nil
+          @stop_requested = false
+        end
+        false
+      else
+        @thread = nil
+        @stop_requested = false
+        true
+      end
+    end
+
+    # Override this method to do the work in the background thread.
+    def do_work
+    end
+
+    # Override this method to perform additional signaling for the background
+    # thread to stop.
+    def pre_stop
+    end
+  end
+end

data/lib/mongo/bson.rb

@@ -1,4 +1,7 @@
-# Copyright (C) 2015-2019 MongoDB, Inc.
+# frozen_string_literal: true
+# encoding: utf-8
+
+# Copyright (C) 2015-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

data/lib/mongo/bulk_write/combineable.rb

@@ -1,4 +1,7 @@
-# Copyright (C) 2015-2019 MongoDB, Inc.
+# frozen_string_literal: true
+# encoding: utf-8
+
+# Copyright (C) 2015-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -25,13 +28,6 @@ module Mongo
       # @return [ Array<Hash, BSON::Document> ] requests The provided requests.
       attr_reader :requests
 
-      # @return [ true, false ] has_collation Whether one or more operations has a collation defined.
-      attr_reader :has_collation
-
-      # @return [ true, false ] has_array_filters Whether one or more operations specifies an array
-      # filters option.
-      attr_reader :has_array_filters
-
       # Create the ordered combiner.
       #
       # @api private
@@ -46,6 +42,25 @@ module Mongo
         @requests = requests
         @has_collation = false
         @has_array_filters = false
+        @has_hint = false
+      end
+
+      # @return [ Boolean ] Whether one or more operation specifies the collation
+      #   option.
+      def has_collation?
+        @has_collation
+      end
+
+      # @return [ Boolean ] Whether one or more operation specifies the
+      #   array_filters option.
+      def has_array_filters?
+        @has_array_filters
+      end
+
+      # @return [ Boolean ] Whether one or more operation specifies the
+      #   hint option.
+      def has_hint?
+        @has_hint
       end
 
       private

data/lib/mongo/bulk_write/ordered_combiner.rb

@@ -1,4 +1,7 @@
-# Copyright (C) 2015-2019 MongoDB, Inc.
+# frozen_string_literal: true
+# encoding: utf-8
+
+# Copyright (C) 2015-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.