mongo 2.10.5 → 2.15.1

data/lib/mongo/client.rb

@@ -1,4 +1,7 @@
-# Copyright (C) 2014-2019 MongoDB, Inc.
+# frozen_string_literal: true
+# encoding: utf-8
+
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the 'License');
 # you may not use this file except in compliance with the License.
@@ -27,6 +30,7 @@ module Mongo
     #
     # @since 2.1.0
     CRUD_OPTIONS = [
+      :auto_encryption_options,
       :database,
       :read, :read_concern,
       :write, :write_concern,
@@ -53,8 +57,11 @@ module Mongo
       :auth_mech,
       :auth_mech_properties,
       :auth_source,
+      :auto_encryption_options,
+      :bg_error_backtrace,
       :cleanup,
       :compressors,
+      :direct_connection,
       :connect,
       :connect_timeout,
       :database,
@@ -62,6 +69,7 @@ module Mongo
       :id_generator,
       :local_threshold,
       :logger,
+      :log_prefix,
       :max_idle_time,
       :max_pool_size,
       :max_read_retries,
@@ -75,10 +83,12 @@ module Mongo
       :read_concern,
       :read_retry_interval,
       :replica_set,
+      :resolv_options,
       :retry_reads,
       :retry_writes,
       :scan,
       :sdam_proc,
+      :server_api,
       :server_selection_timeout,
       :socket_timeout,
       :ssl,
@@ -95,9 +105,11 @@ module Mongo
       :ssl_verify,
       :ssl_verify_certificate,
       :ssl_verify_hostname,
+      :ssl_verify_ocsp_endpoint,
       :truncate_logs,
       :user,
       :wait_queue_timeout,
+      :wrapping_libraries,
       :write,
       :write_concern,
       :zlib_compression_level,
@@ -106,7 +118,16 @@ module Mongo
     # The compression algorithms supported by the driver.
     #
     # @since 2.5.0
-    VALID_COMPRESSORS = [ Mongo::Protocol::Compressed::ZLIB ].freeze
+    VALID_COMPRESSORS = [
+      Mongo::Protocol::Compressed::ZSTD,
+      Mongo::Protocol::Compressed::SNAPPY,
+      Mongo::Protocol::Compressed::ZLIB
+    ].freeze
+
+    # The known server API versions.
+    VALID_SERVER_API_VERSIONS = %w(
+      1
+    ).freeze
 
     # @return [ Mongo::Cluster ] cluster The cluster of servers for the client.
     attr_reader :cluster
@@ -117,6 +138,10 @@ module Mongo
     # @return [ Hash ] options The configuration options.
     attr_reader :options
 
+    # @return [ Mongo::Crypt::AutoEncrypter ] The object that encapsulates
+    #   auto-encryption behavior
+    attr_reader :encrypter
+
     # Delegate command and collections execution to the current database.
     def_delegators :@database, :command, :collections
 
@@ -197,7 +222,6 @@ module Mongo
     #   connection string is also provided, these options take precedence over any
     #   analogous options present in the URI string.
     #
-    #
     # @option options [ String, Symbol ] :app_name Application name that is
     #   printed to the mongod logs upon establishing a connection in server
     #   versions >= 3.4.
@@ -205,23 +229,34 @@ module Mongo
     #   use. One of :mongodb_cr, :mongodb_x509, :plain, :scram, :scram256
     # @option options [ Hash ] :auth_mech_properties
     # @option options [ String ] :auth_source The source to authenticate from.
+    # @option options [ true | false | nil | Integer ] :bg_error_backtrace
+    #   Experimental. Set to true to log complete backtraces for errors in
+    #   background threads. Set to false or nil to not log backtraces. Provide
+    #   a positive integer to log up to that many backtrace lines.
     # @option options [ Array<String> ] :compressors A list of potential
     #   compressors to use, in order of preference. The driver chooses the
     #   first compressor that is also supported by the server. Currently the
-    #   driver only supports 'zlib'.
-    # @option options [ Symbol ] :connect The connection method to use. This
+    #   driver only supports 'zstd, 'snappy' and 'zlib'.
+    # @option options [ true | false ] :direct_connection Whether to connect
+    #   directly to the specified seed, bypassing topology discovery. Exactly
+    #   one seed must be provided.
+    # @option options [ Symbol ] :connect Deprecated - use :direct_connection
+    #   option instead of this option. The connection method to use. This
     #   forces the cluster to behave in the specified way instead of
     #   auto-discovering. One of :direct, :replica_set, :sharded
     # @option options [ Float ] :connect_timeout The timeout, in seconds, to
     #   attempt a connection.
     # @option options [ String ] :database The database to connect to.
-    # @option options [ Float ] :heartbeat_frequency The number of seconds for
-    #   the server monitor to refresh it's description via ismaster.
+    # @option options [ Float ] :heartbeat_frequency The interval, in seconds,
+    #   for the server monitor to refresh its description via hello.
     # @option options [ Object ] :id_generator A custom object to generate ids
     #   for documents. Must respond to #generate.
     # @option options [ Integer ] :local_threshold The local threshold boundary
     #   in seconds for selecting a near server for an operation.
-    # @option options [ Logger ] :logger A custom logger if desired.
+    # @option options [ Logger ] :logger A custom logger to use.
+    # @option options [ String ] :log_prefix A custom log prefix to use when
+    #   logging. This option is experimental and subject to change in a future
+    #   version of the driver.
     # @option options [ Integer ] :max_idle_time The maximum seconds a socket can remain idle
     #   since it has been checked in to the pool.
     # @option options [ Integer ] :max_pool_size The maximum size of the
@@ -283,18 +318,23 @@ module Mongo
     #   will ignore it and will never scan seeds in the constructor.
     # @option options [ Proc ] :sdam_proc A Proc to invoke with the client
     #   as the argument prior to performing server discovery and monitoring.
-    #   Use this to set up SDAM event listeners to receive events dispatched
+    #   Use this to set up SDAM event listeners to receive events published
     #   during client construction.
     #
     #   Note: the client is not fully constructed when sdam_proc is invoked,
     #   in particular the cluster is nil at this time. sdam_proc should
     #   limit itself to calling #subscribe and #unsubscribe methods on the
     #   client only.
+    # @option options [ Hash ] :server_api The requested server API version.
+    #   This hash can have the following items:
+    #   - *:version* -- string
+    #   - *:strict* -- boolean
+    #   - *:deprecation_errors* -- boolean
     # @option options [ Integer ] :server_selection_timeout The timeout in seconds
     #   for selecting a server for an operation.
     # @option options [ Float ] :socket_timeout The timeout, in seconds, to
     #   execute operations on a socket.
-    # @option options [ true, false ] :ssl Whether to use SSL.
+    # @option options [ true, false ] :ssl Whether to use TLS.
     # @option options [ String ] :ssl_ca_cert The file containing concatenated
     #   certificate authority certificates used to validate certs passed from the
     #   other end of the connection. Intermediate certificates should NOT be
@@ -355,23 +395,70 @@ module Mongo
     # @option options [ String ] :user The user name.
     # @option options [ Float ] :wait_queue_timeout The time to wait, in
     #   seconds, in the connection pool for a connection to be checked in.
+    # @option options [ Array<Hash> ] :wrapping_libraries Information about
+    #   libraries such as ODMs that are wrapping the driver, to be added to
+    #    metadata sent to the server. Specify the lower level libraries first.
+    #    Allowed hash keys: :name, :version, :platform.
     # @option options [ Hash ] :write Deprecated. Equivalent to :write_concern
     #   option.
     # @option options [ Hash ] :write_concern The write concern options.
-    #   Can be :w => Integer|String, :fsync => Boolean, :j => Boolean.
+    #   Can be :w => Integer|String, :wtimeout => Integer (in milliseconds),
+    #   :j => Boolean, :fsync => Boolean.
     # @option options [ Integer ] :zlib_compression_level The Zlib compression level to use, if using compression.
     #   See Ruby's Zlib module for valid levels.
+    # @option options [ Hash ] :resolv_options For internal driver use only.
+    #   Options to pass through to Resolv::DNS constructor for SRV lookups.
+    # @option options [ Hash ] :auto_encryption_options Auto-encryption related
+    #   options.
+    #   - :key_vault_client => Client | nil, a client connected to the MongoDB
+    #     instance containing the encryption key vault
+    #   - :key_vault_namespace => String, the namespace of the key vault in the
+    #     format database.collection
+    #   - :kms_providers => Hash, A hash of key management service configuration
+    #     information. Valid hash keys are :local or :aws. There may be more
+    #     than one kms provider specified.
+    #   - :schema_map => Hash | nil, JSONSchema for one or more collections
+    #     specifying which fields should be encrypted.
+    #     - Note: Schemas supplied in the schema_map only apply to configuring
+    #       automatic encryption for client side encryption. Other validation
+    #       rules in the JSON schema will not be enforced by the driver and will
+    #       result in an error.
+    #     - Note: Supplying a schema_map provides more security than relying on
+    #       JSON Schemas obtained from the server. It protects against a
+    #       malicious server advertising a false JSON Schema, which could trick
+    #       the client into sending unencrypted data that should be encrypted.
+    #   - :bypass_auto_encryption => Boolean, when true, disables auto encryption;
+    #     defaults to false.
+    #   - :extra_options => Hash | nil, options related to spawning mongocryptd
+    #     (this part of the API is subject to change).
+    #
+    #   Notes on automatic encryption:
+    #   - Automatic encryption is an enterprise only feature that only applies
+    #     to operations on a collection.
+    #   - Automatic encryption is not supported for operations on a database or
+    #     view.
+    #   - Automatic encryption requires the authenticated user to have the
+    #     listCollections privilege.
+    #   - At worst, automatic encryption may triple the number of connections
+    #     used by the Client at any one time.
+    #   - If automatic encryption fails on an operation, use a MongoClient
+    #     configured with bypass_auto_encryption: true and use
+    #     ClientEncryption.encrypt to manually encrypt values.
+    #   - Enabling Client Side Encryption reduces the maximum write batch size
+    #     and may have a negative performance impact.
     #
     # @since 2.0.0
     def initialize(addresses_or_uri, options = nil)
-      if options
-        options = options.dup
-      else
-        options = {}
-      end
+      options = options ? options.dup : {}
 
+      srv_uri = nil
       if addresses_or_uri.is_a?(::String)
         uri = URI.get(addresses_or_uri, options)
+        if uri.is_a?(URI::SRVProtocol)
+          # If the URI is an SRV URI, note this so that we can start
+          # SRV polling if the topology is a sharded cluster.
+          srv_uri = uri
+        end
         addresses = uri.servers
         uri_options = uri.client_options.dup
         # Special handing for :write and :write_concern: allow client Ruby
@@ -382,22 +469,55 @@ module Mongo
           uri_options.delete(:write_concern)
         end
         options = uri_options.merge(options)
+        @srv_records = uri.srv_records
       else
         addresses = addresses_or_uri
-      end
+        addresses.each do |addr|
+          if addr =~ /\Amongodb(\+srv)?:\/\//i
+            raise ArgumentError, "Host '#{addr}' should not contain protocol. Did you mean to not use an array?"
+          end
+        end
 
-      unless options[:retry_reads] == false
-        options[:retry_reads] = true
+        @srv_records = nil
       end
-      unless options[:retry_writes] == false
-        options[:retry_writes] = true
+
+      options = self.class.canonicalize_ruby_options(options)
+
+      # The server API version is specified to be a string.
+      # However, it is very annoying to always provide the number 1 as a string,
+      # therefore cast to the string type here.
+      if server_api = options[:server_api]
+        if server_api.is_a?(Hash)
+          server_api = Options::Redacted.new(server_api)
+          if (version = server_api[:version]).is_a?(Integer)
+            options[:server_api] = server_api.merge(version: version.to_s)
+          end
+        end
       end
 
       # Special handling for sdam_proc as it is only used during client
       # construction
       sdam_proc = options.delete(:sdam_proc)
 
-      @options = validate_new_options!(Database::DEFAULT_OPTIONS.merge(options))
+      # For gssapi service_name, the default option is given in a hash
+      # (one level down from the top level).
+      merged_options = default_options(options)
+      options.each do |k, v|
+        default_v = merged_options[k]
+        if Hash === default_v
+          v = default_v.merge(v)
+        end
+        merged_options[k] = v
+      end
+      options = merged_options
+
+      options.keys.each do |k|
+        if options[k].nil?
+          options.delete(k)
+        end
+      end
+
+      @options = validate_new_options!(options)
 =begin WriteConcern object support
       if @options[:write_concern].is_a?(WriteConcern::Base)
         # Cache the instance so that we do not needlessly reconstruct it.
@@ -406,9 +526,12 @@ module Mongo
       end
 =end
       @options.freeze
-      validate_options!
+      validate_options!(addresses)
+      validate_authentication_options!
 
-      @database = Database.new(self, @options[:database], @options)
+      database_options = @options.dup
+      database_options.delete(:server_api)
+      @database = Database.new(self, @options[:database], database_options)
 
       # Temporarily set monitoring so that event subscriptions can be
       # set up without there being a cluster
@@ -418,13 +541,39 @@ module Mongo
         sdam_proc.call(self)
       end
 
-      @server_selection_semaphore = Semaphore.new
-      @cluster = Cluster.new(addresses, @monitoring, cluster_options)
+      @connect_lock = Mutex.new
+      @connect_lock.synchronize do
+        @cluster = Cluster.new(addresses, @monitoring,
+          cluster_options.merge(srv_uri: srv_uri))
+      end
 
-      # Unset monitoring, it will be taken out of cluster from now on
-      remove_instance_variable('@monitoring')
+      begin
+        # Unset monitoring, it will be taken out of cluster from now on
+        remove_instance_variable('@monitoring')
 
-      yield(self) if block_given?
+        if @options[:auto_encryption_options]
+          @connect_lock.synchronize do
+            build_encrypter
+          end
+        end
+
+      rescue
+        begin
+          @cluster.disconnect!
+        rescue => e
+          log_warn("Eror disconnecting cluster in client constructor's exception handler: #{e.class}: #{e}")
+          # Drop this exception so that the original exception is raised
+        end
+        raise
+      end
+
+      if block_given?
+        begin
+          yield(self)
+        ensure
+          close
+        end
+      end
     end
 
     # @api private
@@ -435,7 +584,6 @@ module Mongo
       options.reject do |key, value|
         CRUD_OPTIONS.include?(key.to_sym)
       end.merge(
-        server_selection_semaphore: @server_selection_semaphore,
         # but need to put the database back in for auth...
         database: options[:database],
 
@@ -444,7 +592,14 @@ module Mongo
         # applications should read these values from client, not from cluster
         max_read_retries: options[:max_read_retries],
         read_retry_interval: options[:read_retry_interval],
-      )
+      ).tap do |options|
+        # If the client has a cluster already, forward srv_uri to the new
+        # cluster to maintain SRV monitoring. If the client is brand new,
+        # its constructor sets srv_uri manually.
+        if cluster
+          options.update(srv_uri: cluster.options[:srv_uri])
+        end
+      end
     end
 
     # Get the maximum number of times the client can retry a read operation
@@ -491,15 +646,12 @@ module Mongo
 
     # Get a summary of the client state.
     #
-    # @note This method is experimental and subject to change.
+    # @note The exact format and layout of the returned summary string is
+    #   not part of the driver's public API and may be changed at any time.
     #
-    # @example Inspect the client.
-    #   client.summary
-    #
-    # @return [ String ] Summary string.
+    # @return [ String ] The summary string.
     #
     # @since 2.7.0
-    # @api experimental
     def summary
       "#<Client cluster=#{cluster.summary}>"
     end
@@ -529,7 +681,7 @@ module Mongo
     #
     # @return [ BSON::Document ] The user-defined read preference.
     #   The document may have the following fields:
-    #   - *:read* -- read preference specified as a symbol; valid values are
+    #   - *:mode* -- read preference specified as a symbol; valid values are
     #     *:primary*, *:primary_preferred*, *:secondary*, *:secondary_preferred*
     #     and *:nearest*.
     #   - *:tag_sets* -- an array of hashes.
@@ -577,9 +729,9 @@ module Mongo
     # @return [ Mongo::Client ] A new client instance.
     #
     # @since 2.0.0
-    def with(new_options = Options::Redacted.new)
+    def with(new_options = nil)
       clone.tap do |client|
-        opts = client.update_options(new_options)
+        opts = client.update_options(new_options || Options::Redacted.new)
         Database.create(client)
         # We can't use the same cluster if some options that would affect it
         # have changed.
@@ -604,6 +756,10 @@ module Mongo
     #
     # @api private
     def update_options(new_options)
+      old_options = @options
+
+      new_options = self.class.canonicalize_ruby_options(new_options || {})
+
       validate_new_options!(new_options).tap do |opts|
         # Our options are frozen
         options = @options.dup
@@ -613,9 +769,31 @@ module Mongo
         if options[:write_concern] && opts[:write]
           options.delete(:write_concern)
         end
+
         options.update(opts)
         @options = options.freeze
+
+        auto_encryption_options_changed =
+          @options[:auto_encryption_options] != old_options[:auto_encryption_options]
+
+        # If there are new auto_encryption_options, create a new encrypter.
+        # Otherwise, allow the new client to share an encrypter with the
+        # original client.
+        #
+        # If auto_encryption_options are nil, set @encrypter to nil, but do not
+        # close the encrypter because it may still be used by the original client.
+        if @options[:auto_encryption_options] && auto_encryption_options_changed
+          @connect_lock.synchronize do
+            build_encrypter
+          end
+        elsif @options[:auto_encryption_options].nil?
+          @connect_lock.synchronize do
+            @encrypter = nil
+          end
+        end
+
         validate_options!
+        validate_authentication_options!
       end
     end
 
@@ -631,7 +809,6 @@ module Mongo
       options[:read_concern]
     end
 
-
     # Get the write concern for this client. If no option was provided, then a
     # default single server acknowledgement will be used.
     #
@@ -647,17 +824,22 @@ module Mongo
 
     # Close all connections.
     #
-    # @example Disconnect the client.
-    #   client.close
-    #
-    # @param [ Boolean ] wait Whether to wait for background threads to
-    #   finish running.
-    #
     # @return [ true ] Always true.
     #
     # @since 2.1.0
-    def close(wait=false)
-      @cluster.disconnect!(wait)
+    def close
+      @connect_lock.synchronize do
+        do_close
+      end
+      true
+    end
+
+    # Close encrypter and clean up auto-encryption resources.
+    #
+    # @return [ true ] Always true.
+    def close_encrypter
+      @encrypter.close if @encrypter
+
       true
     end
 
@@ -672,9 +854,16 @@ module Mongo
     def reconnect
       addresses = cluster.addresses.map(&:to_s)
 
-      @cluster.disconnect! rescue nil
+      @connect_lock.synchronize do
+        do_close rescue nil
+
+        @cluster = Cluster.new(addresses, monitoring, cluster_options)
+
+        if @options[:auto_encryption_options]
+          build_encrypter
+        end
+      end
 
-      @cluster = Cluster.new(addresses, monitoring, cluster_options)
       true
     end
 
@@ -686,6 +875,13 @@ module Mongo
     # @param [ Hash ] filter The filter criteria for getting a list of databases.
     # @param [ Hash ] opts The command options.
     #
+    # @option opts [ true, false ] :authorized_databases A flag that determines
+    #   which databases are returned based on user privileges when access control
+    #   is enabled
+    #
+    #   See https://docs.mongodb.com/manual/reference/command/listDatabases/
+    #   for more information and usage.
+    #
     # @return [ Array<String> ] The names of the databases.
     #
     # @since 2.0.5
@@ -702,6 +898,13 @@ module Mongo
     # @param [ true, false ] name_only Whether to only return each database name without full metadata.
     # @param [ Hash ] opts The command options.
     #
+    # @option opts [ true, false ] :authorized_databases A flag that determines
+    #   which databases are returned based on user privileges when access control
+    #   is enabled
+    #
+    #   See https://docs.mongodb.com/manual/reference/command/listDatabases/
+    #   for more information and usage.
+    #
     # @return [ Array<Hash> ] The info for each database.
     #
     # @since 2.0.5
@@ -709,6 +912,7 @@ module Mongo
       cmd = { listDatabases: 1 }
       cmd[:nameOnly] = !!name_only
       cmd[:filter] = filter unless filter.empty?
+      cmd[:authorizedDatabases] = true if opts[:authorized_databases]
       use(Database::ADMIN).database.read_command(cmd, opts).first[Database::DATABASES]
     end
 
@@ -749,8 +953,16 @@ module Mongo
     #
     # @since 2.5.0
     def start_session(options = {})
-      cluster.send(:get_session, self, options.merge(implicit: false)) ||
-        (raise Error::InvalidSession.new(Session::SESSIONS_NOT_SUPPORTED))
+      session = get_session!(options.merge(implicit: false))
+      if block_given?
+        begin
+          yield session
+        ensure
+          session.end_session
+        end
+      else
+        session
+      end
     end
 
     # As of version 3.6 of the MongoDB server, a ``$changeStream`` pipeline stage is supported
@@ -796,21 +1008,136 @@ module Mongo
         options)
     end
 
-    private
-
-    # If options[:session] is set, validates that session and returns it.
-    # If deployment supports sessions, creates a new session and returns it.
-    # The session is implicit unless options[:implicit] is given.
-    # If deployment does not support session, returns nil.
+    # Returns a session to use for operations if possible.
+    #
+    # If :session option is set, validates that session and returns it.
+    # Otherwise, if deployment supports sessions, creates a new session and
+    # returns it. When a new session is created, the session will be implicit
+    # (lifecycle is managed by the driver) if the :implicit option is given,
+    # otherwise the session will be explicit (lifecycle managed by the
+    # application). If deployment does not support session, returns nil.
+    #
+    # @option options [ true | false ] :implicit When no session is passed in,
+    #   whether to create an implicit session.
+    # @option options [ Session ] :session The session to validate and return.
     #
-    # @note This method will return nil if deployment has no data-bearing
-    #   servers at the time of the call.
+    # @return [ Session | nil ] Session object or nil if sessions are not
+    #   supported by the deployment.
+    #
+    # @api private
     def get_session(options = {})
-      cluster.send(:get_session, self, options)
+      get_session!(options)
+    rescue Error::SessionsNotSupported
+      nil
     end
 
+    # Creates a session to use for operations if possible and yields it to
+    # the provided block.
+    #
+    # If :session option is set, validates that session and uses it.
+    # Otherwise, if deployment supports sessions, creates a new session and
+    # uses it. When a new session is created, the session will be implicit
+    # (lifecycle is managed by the driver) if the :implicit option is given,
+    # otherwise the session will be explicit (lifecycle managed by the
+    # application). If deployment does not support session, yields nil to
+    # the block.
+    #
+    # When the block finishes, if the session was created and was implicit,
+    # or if an implicit session was passed in, the session is ended which
+    # returns it to the pool of available sessions.
+    #
+    # @option options [ true | false ] :implicit When no session is passed in,
+    #   whether to create an implicit session.
+    # @option options [ Session ] :session The session to validate and return.
+    #
+    # @api private
     def with_session(options = {}, &block)
-      cluster.send(:with_session, self, options, &block)
+      session = get_session(options)
+
+      yield session
+    ensure
+      if session && session.implicit?
+        session.end_session
+      end
+    end
+
+    class << self
+      # Lowercases auth mechanism properties, if given, in the specified
+      # options, then converts the options to an instance of Options::Redacted.
+      #
+      # @api private
+      def canonicalize_ruby_options(options)
+        Options::Redacted.new(Hash[options.map do |k, v|
+          if k == :auth_mech_properties || k == 'auth_mech_properties'
+            if v
+              v = Hash[v.map { |pk, pv| [pk.downcase, pv] }]
+            end
+          end
+          [k, v]
+        end])
+      end
+    end
+
+    private
+
+    # Create a new encrypter object using the client's auto encryption options
+    def build_encrypter
+      @encrypter = Crypt::AutoEncrypter.new(
+        @options[:auto_encryption_options].merge(client: self)
+      )
+    end
+
+    # Generate default client options based on the URI and options
+    # passed into the Client constructor.
+    def default_options(options)
+      Database::DEFAULT_OPTIONS.dup.tap do |default_options|
+        if options[:auth_mech] || options[:user]
+          default_options[:auth_source] = Auth::User.default_auth_source(options)
+        end
+
+        if options[:auth_mech] == :gssapi
+          default_options[:auth_mech_properties] = { service_name: 'mongodb' }
+        end
+
+        default_options[:retry_reads] = true
+        default_options[:retry_writes] = true
+      end
+    end
+
+    # Implementation for #close, assumes the connect lock is already acquired.
+    def do_close
+      @cluster.disconnect!
+      close_encrypter
+    end
+
+    # Returns a session to use for operations.
+    #
+    # If :session option is set, validates that session and returns it.
+    # Otherwise, if deployment supports sessions, creates a new session and
+    # returns it. When a new session is created, the session will be implicit
+    # (lifecycle is managed by the driver) if the :implicit option is given,
+    # otherwise the session will be explicit (lifecycle managed by the
+    # application). If deployment does not support session, raises
+    # Error::InvalidSession.
+    #
+    # @option options [ true | false ] :implicit When no session is passed in,
+    #   whether to create an implicit session.
+    # @option options [ Session ] :session The session to validate and return.
+    #
+    # @return [ Session ] A session object.
+    #
+    # @raise Error::SessionsNotSupported if sessions are not supported by
+    #   the deployment.
+    #
+    # @api private
+    def get_session!(options = {})
+      if options[:session]
+        return options[:session].validate!(self)
+      end
+
+      cluster.validate_session_support!
+
+      Session.new(cluster.session_pool.checkout, self, { implicit: true }.merge(options))
     end
 
     def initialize_copy(original)
@@ -834,8 +1161,42 @@ module Mongo
     # The argument may contain a subset of options that the client will
     # eventually have; this method validates each of the provided options
     # but does not check for interactions between combinations of options.
-    def validate_new_options!(opts = Options::Redacted.new)
+    def validate_new_options!(opts)
       return Options::Redacted.new unless opts
+      if opts[:read_concern]
+        # Raise an error for non user-settable options
+        if opts[:read_concern][:after_cluster_time]
+          raise Mongo::Error::InvalidReadConcern.new(
+            'The after_cluster_time read_concern option cannot be specified by the user'
+          )
+        end
+
+        given_keys = opts[:read_concern].keys.map(&:to_s)
+        allowed_keys = ['level']
+        invalid_keys = given_keys - allowed_keys
+        # Warn that options are invalid but keep it and forward to the server
+        unless invalid_keys.empty?
+          log_warn("Read concern has invalid keys: #{invalid_keys.join(',')}.")
+        end
+      end
+
+      if server_api = opts[:server_api]
+        unless server_api.is_a?(Hash)
+          raise ArgumentError, ":server_api value must be a hash: #{server_api}"
+        end
+
+        extra_keys = server_api.keys - %w(version strict deprecation_errors)
+        unless extra_keys.empty?
+          raise ArgumentError, "Unknown keys under :server_api: #{extra_keys.map(&:inspect).join(', ')}"
+        end
+
+        if version = server_api[:version]
+          unless VALID_SERVER_API_VERSIONS.include?(version)
+            raise ArgumentError, "Unknown server API version: #{version}"
+          end
+        end
+      end
+
       Lint.validate_underscore_read_preference(opts[:read])
       Lint.validate_read_concern_option(opts[:read_concern])
       opts.each.inject(Options::Redacted.new) do |_options, (k, v)|
@@ -845,6 +1206,15 @@ module Mongo
           validate_read!(key, opts)
           if key == :compressors
             compressors = valid_compressors(v)
+
+            if compressors.include?('snappy')
+              validate_snappy_compression!
+            end
+
+            if compressors.include?('zstd')
+              validate_zstd_compression!
+            end
+
             _options[key] = compressors unless compressors.empty?
           else
             _options[key] = v
@@ -857,12 +1227,141 @@ module Mongo
     end
 
     # Validates all options after they are set on the client.
-    # This method is intended to catch combinations of options which do are
+    # This method is intended to catch combinations of options which are
     # not allowed.
-    def validate_options!
+    def validate_options!(addresses = nil)
       if options[:write] && options[:write_concern] && options[:write] != options[:write_concern]
         raise ArgumentError, "If :write and :write_concern are both given, they must be identical: #{options.inspect}"
       end
+
+      if options[:direct_connection]
+        if options[:connect] && options[:connect].to_sym != :direct
+          raise ArgumentError, "Conflicting client options: direct_connection=true and connect=#{options[:connect]}"
+        end
+        # When a new client is created, we get the list of seed addresses
+        if addresses && addresses.length > 1
+          raise ArgumentError, "direct_connection=true cannot be used with multiple seeds"
+        end
+        # When a client is copied using #with, we have a cluster
+        if cluster && !cluster.topology.is_a?(Mongo::Cluster::Topology::Single)
+          raise ArgumentError, "direct_connection=true cannot be used with topologies other than Single (this client is #{cluster.topology.class.name.sub(/.*::/, '')})"
+        end
+      end
+
+      if options[:direct_connection] == false && options[:connect] && options[:connect].to_sym == :direct
+        raise ArgumentError, "Conflicting client options: direct_connection=false and connect=#{options[:connect]}"
+      end
+
+      %i(connect_timeout socket_timeout).each do |key|
+        if value = options[key]
+          unless Numeric === value
+            raise ArgumentError, "#{key} must be a non-negative number: #{value}"
+          end
+          if value < 0
+            raise ArgumentError, "#{key} must be a non-negative number: #{value}"
+          end
+        end
+      end
+
+      if value = options[:bg_error_backtrace]
+        case value
+        when Integer
+          if value <= 0
+            raise ArgumentError, ":bg_error_backtrace option value must be true, false, nil or a positive integer: #{value}"
+          end
+        when true
+          # OK
+        else
+          raise ArgumentError, ":bg_error_backtrace option value must be true, false, nil or a positive integer: #{value}"
+        end
+      end
+
+      if libraries = options[:wrapping_libraries]
+        unless Array === libraries
+          raise ArgumentError, ":wrapping_libraries must be an array of hashes: #{libraries}"
+        end
+
+        libraries = libraries.map do |library|
+          Utils.shallow_symbolize_keys(library)
+        end
+
+        libraries.each do |library|
+          unless Hash === library
+            raise ArgumentError, ":wrapping_libraries element is not a hash: #{library}"
+          end
+
+          if library.empty?
+            raise ArgumentError, ":wrapping_libraries element is empty"
+          end
+
+          unless (library.keys - %i(name platform version)).empty?
+            raise ArgumentError, ":wrapping_libraries element has invalid keys (allowed keys: :name, :platform, :version): #{library}"
+          end
+
+          library.each do |key, value|
+            if value.include?('|')
+              raise ArgumentError, ":wrapping_libraries element value cannot include '|': #{value}"
+            end
+          end
+        end
+      end
+    end
+
+    # Validates all authentication-related options after they are set on the client
+    # This method is intended to catch combinations of options which are not allowed
+    def validate_authentication_options!
+      auth_mech = options[:auth_mech]
+      user = options[:user]
+      password = options[:password]
+      auth_source = options[:auth_source]
+      mech_properties = options[:auth_mech_properties]
+
+      if auth_mech.nil?
+        if user && user.empty?
+          raise Mongo::Auth::InvalidConfiguration, 'Empty username is not supported for default auth mechanism'
+        end
+
+        if auth_source == ''
+          raise Mongo::Auth::InvalidConfiguration, 'Auth source cannot be empty for default auth mechanism'
+        end
+
+        return
+      end
+
+      if !Mongo::Auth::SOURCES.key?(auth_mech)
+        raise Mongo::Auth::InvalidMechanism.new(auth_mech)
+      end
+
+      if user.nil? && !%i(aws mongodb_x509).include?(auth_mech)
+        raise Mongo::Auth::InvalidConfiguration, "Username is required for auth mechanism #{auth_mech}"
+      end
+
+      if password.nil? && !%i(aws gssapi mongodb_x509).include?(auth_mech)
+        raise Mongo::Auth::InvalidConfiguration, "Password is required for auth mechanism #{auth_mech}"
+      end
+
+      if password && auth_mech == :mongodb_x509
+        raise Mongo::Auth::InvalidConfiguration, 'Password is not supported for :mongodb_x509 auth mechanism'
+      end
+
+      if auth_mech == :aws && user && !password
+        raise Mongo::Auth::InvalidConfiguration, 'Username is provided but password is not provided for :aws auth mechanism'
+      end
+
+      if %i(aws gssapi mongodb_x509).include?(auth_mech)
+        if !['$external', nil].include?(auth_source)
+          raise Mongo::Auth::InvalidConfiguration, "#{auth_source} is an invalid auth source for #{auth_mech}; valid options are $external and nil"
+        end
+      else
+        # Auth source is the database name, and thus cannot be the empty string.
+        if auth_source == ''
+          raise Mongo::Auth::InvalidConfiguration, "Auth source cannot be empty for auth mechanism #{auth_mech}"
+        end
+      end
+
+      if mech_properties && !%i(aws gssapi).include?(auth_mech)
+        raise Mongo::Auth::InvalidConfiguration, ":mechanism_properties are not supported for auth mechanism #{auth_mech}"
+      end
     end
 
     def valid_compressors(compressors)
@@ -872,11 +1371,30 @@ module Mongo
                        "This compressor will not be used.")
           false
         else
+
           true
         end
       end
     end
 
+    def validate_snappy_compression!
+      return if defined?(Snappy)
+      require 'snappy'
+    rescue LoadError => e
+      raise Error::UnmetDependency, "Cannot enable snappy compression because the snappy gem " \
+        "has not been installed. Add \"gem 'snappy'\" to your Gemfile and run " \
+        "\"bundle install\" to install the gem. (#{e.class}: #{e})"
+    end
+
+    def validate_zstd_compression!
+      return if defined?(Zstd)
+      require 'zstd-ruby'
+    rescue LoadError => e
+      raise Error::UnmetDependency, "Cannot enable zstd compression because the zstd-ruby gem " \
+        "has not been installed. Add \"gem 'zstd-ruby'\" to your Gemfile and run " \
+        "\"bundle install\" to install the gem. (#{e.class}: #{e})"
+    end
+
     def validate_max_min_pool_size!(option, opts)
       if option == :min_pool_size && opts[:min_pool_size]
         max = opts[:max_pool_size] || Server::ConnectionPool::DEFAULT_MAX_SIZE