mongo 2.17.4 → 2.21.0

data/lib/mongo/{operation/drop_database/command.rb → auth/aws/credentials.rb}

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
-# Copyright (C) 2018-2020 MongoDB Inc.
+# Copyright (C) 2023-present MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,24 +16,21 @@
 # limitations under the License.
 
 module Mongo
-  module Operation
-    class DropDatabase
-
-      # A MongoDB dropdatabase operation sent as a command message.
+  module Auth
+    class Aws
+      # The AWS credential set.
       #
       # @api private
-      #
-      # @since 2.5.2
-      class Command
-        include Specifiable
-        include Executable
-        include Limited
-        include WriteConcernSupported
-
-        private
-
-        def message(connection)
-          Protocol::Query.new(db_name, Database::COMMAND, command(connection), options(connection))
+      Credentials = Struct.new(:access_key_id, :secret_access_key, :session_token, :expiration) do
+        # @return [ true | false ] Whether the credentials have expired.
+        def expired?
+          if expiration.nil?
+            false
+          else
+            # According to the spec, Credentials are considered
+            # valid if they are more than five minutes away from expiring.
+            Time.now.utc >= expiration - 300
+          end
         end
       end
     end

data/lib/mongo/auth/aws/credentials_cache.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+# rubocop:todo all
+
+# Copyright (C) 2023-present MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+    class Aws
+      # Thread safe cache to store AWS credentials.
+      #
+      # @api private
+      class CredentialsCache
+        # Get or create the singleton instance of the cache.
+        #
+        # @return [ CredentialsCache ] The singleton instance.
+        def self.instance
+          @instance ||= new
+        end
+
+        def initialize
+          @lock = Mutex.new
+          @credentials = nil
+        end
+
+        # Set the credentials in the cache.
+        #
+        # @param [ Aws::Credentials ] credentials The credentials to cache.
+        def credentials=(credentials)
+          @lock.synchronize do
+            @credentials = credentials
+          end
+        end
+
+        # Get the credentials from the cache.
+        #
+        # @return [ Aws::Credentials ] The cached credentials.
+        def credentials
+          @lock.synchronize do
+            @credentials
+          end
+        end
+
+        # Fetch the credentials from the cache or yield to get them
+        # if they are not in the cache or have expired.
+        #
+        # @return [ Aws::Credentials ] The cached credentials.
+        def fetch
+          @lock.synchronize do
+            @credentials = yield if @credentials.nil? || @credentials.expired?
+            @credentials
+          end
+        end
+
+        # Clear the credentials from the cache.
+        def clear
+          @lock.synchronize do
+            @credentials = nil
+          end
+        end
+      end
+    end
+  end
+end

data/lib/mongo/auth/aws/credentials_retriever.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2020 MongoDB Inc.
 #
@@ -18,6 +18,14 @@
 module Mongo
   module Auth
     class Aws
+      # Raised when trying to authorize with an invalid configuration
+      #
+      # @api private
+      class CredentialsNotFound < Mongo::Error::AuthError
+        def initialize
+          super("Could not locate AWS credentials (checked Client URI and Ruby options, environment variables, ECS and EC2 metadata, and Web Identity)")
+        end
+      end
 
       # Retrieves AWS credentials from a variety of sources.
       #
@@ -27,6 +35,7 @@ module Mongo
       # - AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN
       #   environment variables (commonly used by AWS SDKs and various tools,
       #   as well as AWS Lambda)
+      # - AssumeRoleWithWebIdentity API call
       # - EC2 metadata endpoint
       # - ECS metadata endpoint
       #
@@ -41,15 +50,17 @@ module Mongo
       #
       # @api private
       class CredentialsRetriever
-
         # Timeout for metadata operations, in seconds.
         #
         # The auth spec suggests a 10 second timeout but this seems
         # excessively long given that the endpoint is essentially local.
         METADATA_TIMEOUT = 5
 
-        def initialize(user = nil)
+        # @param [ Auth::User | nil ] user The user object, if one was provided.
+        # @param [ Auth::Aws::CredentialsCache ] credentials_cache The credentials cache.
+        def initialize(user = nil, credentials_cache: CredentialsCache.instance)
           @user = user
+          @credentials_cache = credentials_cache
         end
 
         # @return [ Auth::User | nil ] The user object, if one was provided.
@@ -58,70 +69,110 @@ module Mongo
         # Retrieves a valid set of credentials, if possible, or raises
         # Auth::InvalidConfiguration.
         #
+        # @param [ CsotTimeoutHolder | nil ] timeout_holder CSOT timeout, if any.
+        #
         # @return [ Auth::Aws::Credentials ] A valid set of credentials.
         #
-        # @raise Auth::InvalidConfiguration if credentials could not be
-        #   retrieved for any reason, or if a source contains an invalid set
+        # @raise Auth::InvalidConfiguration if a source contains an invalid set
         #   of credentials.
-        def credentials
-          if user
-            credentials = Credentials.new(
-              user.name,
-              user.password,
-              user.auth_mech_properties['aws_session_token'],
-            )
-
-            if credentials_valid?(credentials, 'Mongo::Client URI or Ruby options')
-              return credentials
-            end
-          end
+        # @raise Auth::Aws::CredentialsNotFound if credentials could not be
+        #   retrieved from any source.
+        # @raise Error::TimeoutError if credentials cannot be retrieved within
+        #   the timeout defined on the operation context.
+        def credentials(timeout_holder = nil)
+          credentials = credentials_from_user(user)
+          return credentials unless credentials.nil?
 
-          credentials = Credentials.new(
-            ENV['AWS_ACCESS_KEY_ID'],
-            ENV['AWS_SECRET_ACCESS_KEY'],
-            ENV['AWS_SESSION_TOKEN'],
-          )
+          credentials = credentials_from_environment
+          return credentials unless credentials.nil?
 
-          if credentials_valid?(credentials, 'environment variables')
-            return credentials
-          end
+          credentials = @credentials_cache.fetch { obtain_credentials_from_endpoints(timeout_holder) }
+          return credentials unless credentials.nil?
 
-          credentials = ecs_metadata_credentials
+          raise Auth::Aws::CredentialsNotFound
+        end
 
-          if credentials && credentials_valid?(credentials, 'ECS task metadata')
-            return credentials
-          end
+        private
 
-          credentials = ec2_metadata_credentials
+        # Returns credentials from the user object.
+        #
+        # @param [ Auth::User | nil ] user The user object, if one was provided.
+        #
+        # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
+        #
+        # @raise Auth::InvalidConfiguration if a source contains an invalid set
+        #   of credentials.
+        def credentials_from_user(user)
+          return nil unless user
 
-          if credentials && credentials_valid?(credentials, 'EC2 instance metadata')
-            return credentials
-          end
+          credentials = Credentials.new(
+            user.name,
+            user.password,
+            user.auth_mech_properties['aws_session_token']
+          )
+          return credentials if credentials_valid?(credentials, 'Mongo::Client URI or Ruby options')
+        end
 
-          raise Auth::InvalidConfiguration,
-            "Could not locate AWS credentials (checked Client URI and Ruby options, environment variables, ECS and EC2 metadata)"
+        # Returns credentials from environment variables.
+        #
+        # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
+        #   if retrieval failed or the obtained credentials are invalid.
+        #
+        # @raise Auth::InvalidConfiguration if a source contains an invalid set
+        #   of credentials.
+        def credentials_from_environment
+          credentials = Credentials.new(
+            ENV['AWS_ACCESS_KEY_ID'],
+            ENV['AWS_SECRET_ACCESS_KEY'],
+            ENV['AWS_SESSION_TOKEN']
+          )
+          credentials if credentials && credentials_valid?(credentials, 'environment variables')
         end
 
-        private
+        # Returns credentials from the AWS metadata endpoints.
+        #
+        # @param [ CsotTimeoutHolder ] timeout_holder CSOT timeout.
+        #
+        # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
+        #   if retrieval failed or the obtained credentials are invalid.
+        #
+        # @raise Auth::InvalidConfiguration if a source contains an invalid set
+        #   of credentials.
+        # @ raise Error::TimeoutError if credentials cannot be retrieved within
+        #   the timeout defined on the operation context.
+        def obtain_credentials_from_endpoints(timeout_holder = nil)
+          if (credentials = web_identity_credentials(timeout_holder)) && credentials_valid?(credentials, 'Web identity token')
+            credentials
+          elsif (credentials = ecs_metadata_credentials(timeout_holder)) && credentials_valid?(credentials, 'ECS task metadata')
+            credentials
+          elsif (credentials = ec2_metadata_credentials(timeout_holder)) && credentials_valid?(credentials, 'EC2 instance metadata')
+            credentials
+          end
+        end
 
         # Returns credentials from the EC2 metadata endpoint. The credentials
         # could be empty, partial or invalid.
         #
+        # @param [ CsotTimeoutHolder ] timeout_holder CSOT timeout.
+        #
         # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
         #   if retrieval failed.
-        def ec2_metadata_credentials
+        # @ raise Error::TimeoutError if credentials cannot be retrieved within
+        #   the timeout.
+        def ec2_metadata_credentials(timeout_holder = nil)
+          timeout_holder&.check_timeout!
           http = Net::HTTP.new('169.254.169.254')
           req = Net::HTTP::Put.new('/latest/api/token',
             # The TTL is required in order to obtain the metadata token.
             {'x-aws-ec2-metadata-token-ttl-seconds' => '30'})
-          resp = ::Timeout.timeout(METADATA_TIMEOUT) do
+          resp = with_timeout(timeout_holder) do
             http.request(req)
           end
           if resp.code != '200'
             return nil
           end
           metadata_token = resp.body
-          resp = ::Timeout.timeout(METADATA_TIMEOUT) do
+          resp = with_timeout(timeout_holder) do
             http_get(http, '/latest/meta-data/iam/security-credentials', metadata_token)
           end
           if resp.code != '200'
@@ -129,7 +180,7 @@ module Mongo
           end
           role_name = resp.body
           escaped_role_name = CGI.escape(role_name).gsub('+', '%20')
-          resp = ::Timeout.timeout(METADATA_TIMEOUT) do
+          resp = with_timeout(timeout_holder) do
             http_get(http, "/latest/meta-data/iam/security-credentials/#{escaped_role_name}", metadata_token)
           end
           if resp.code != '200'
@@ -143,14 +194,25 @@ module Mongo
             payload['AccessKeyId'],
             payload['SecretAccessKey'],
             payload['Token'],
+            DateTime.parse(payload['Expiration']).to_time
           )
         # When trying to use the EC2 metadata endpoint on ECS:
         # Errno::EINVAL: Failed to open TCP connection to 169.254.169.254:80 (Invalid argument - connect(2) for "169.254.169.254" port 80)
-        rescue ::Timeout::Error, IOError, SystemCallError
+        rescue ::Timeout::Error, IOError, SystemCallError, TypeError
           return nil
         end
 
-        def ecs_metadata_credentials
+        # Returns credentials from the ECS metadata endpoint. The credentials
+        # could be empty, partial or invalid.
+        #
+        # @param [ CsotTimeoutHolder | nil ] timeout_holder CSOT timeout.
+        #
+        # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
+        #   if retrieval failed.
+        # @ raise Error::TimeoutError if credentials cannot be retrieved within
+        #   the timeout defined on the operation context.
+        def ecs_metadata_credentials(timeout_holder = nil)
+          timeout_holder&.check_timeout!
           relative_uri = ENV['AWS_CONTAINER_CREDENTIALS_RELATIVE_URI']
           if relative_uri.nil? || relative_uri.empty?
             return nil
@@ -164,7 +226,7 @@ module Mongo
           # a leading slash must be added by the driver, but this is not
           # in fact needed.
           req = Net::HTTP::Get.new(relative_uri)
-          resp = ::Timeout.timeout(METADATA_TIMEOUT) do
+          resp = with_timeout(timeout_holder) do
             http.request(req)
           end
           if resp.code != '200'
@@ -175,11 +237,116 @@ module Mongo
             payload['AccessKeyId'],
             payload['SecretAccessKey'],
             payload['Token'],
+            DateTime.parse(payload['Expiration']).to_time
           )
-        rescue ::Timeout::Error, IOError, SystemCallError
+        rescue ::Timeout::Error, IOError, SystemCallError, TypeError
           return nil
         end
 
+        # Returns credentials associated with web identity token that is
+        # stored in a file. This authentication mechanism is used to authenticate
+        # inside EKS. See https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html
+        # for further details.
+        #
+        # @param [ CsotTimeoutHolder | nil ] timeout_holder CSOT timeout.
+        #
+        # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
+        #   if retrieval failed.
+        def web_identity_credentials(timeout_holder = nil)
+          web_identity_token, role_arn, role_session_name = prepare_web_identity_inputs
+          return nil if web_identity_token.nil?
+          response = request_web_identity_credentials(
+            web_identity_token, role_arn, role_session_name, timeout_holder
+          )
+          return if response.nil?
+          credentials_from_web_identity_response(response)
+        end
+
+        # Returns inputs for the AssumeRoleWithWebIdentity AWS API call.
+        #
+        # @return [ Array<String | nil, String | nil, String | nil> ] Web
+        #   identity token, role arn, and role session name.
+        def prepare_web_identity_inputs
+          token_file = ENV['AWS_WEB_IDENTITY_TOKEN_FILE']
+          role_arn = ENV['AWS_ROLE_ARN']
+          if token_file.nil? || role_arn.nil?
+            return nil
+          end
+          web_identity_token = File.open(token_file).read
+          role_session_name = ENV['AWS_ROLE_SESSION_NAME']
+          if role_session_name.nil?
+            role_session_name = "ruby-app-#{SecureRandom.alphanumeric(50)}"
+          end
+          [web_identity_token, role_arn, role_session_name]
+        rescue Errno::ENOENT, IOError, SystemCallError
+          nil
+        end
+
+        # Calls AssumeRoleWithWebIdentity to obtain credentials for the
+        # given web identity token.
+        #
+        # @param [ String ] token The OAuth 2.0 access token or
+        #   OpenID Connect ID token that is provided by the identity provider.
+        # @param [ String ] role_arn The Amazon Resource Name (ARN) of the role
+        #   that the caller is assuming.
+        # @param [ String ] role_session_name An identifier for the assumed
+        #   role session.
+        # @param [ CsotTimeoutHolder | nil ] timeout_holder CSOT timeout.
+        #
+        # @return [ Net::HTTPResponse | nil ] AWS API response if successful,
+        #   otherwise nil.
+        #
+        # @ raise Error::TimeoutError if credentials cannot be retrieved within
+        #   the timeout defined on the operation context.
+        def request_web_identity_credentials(token, role_arn, role_session_name, timeout_holder)
+          timeout_holder&.check_timeout!
+          uri = URI('https://sts.amazonaws.com/')
+          params = {
+            'Action' => 'AssumeRoleWithWebIdentity',
+            'Version' => '2011-06-15',
+            'RoleArn' => role_arn,
+            'WebIdentityToken' => token,
+            'RoleSessionName' => role_session_name
+          }
+          uri.query = ::URI.encode_www_form(params)
+          req = Net::HTTP::Post.new(uri)
+          req['Accept'] = 'application/json'
+          resp = with_timeout(timeout_holder) do
+            Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |https|
+              https.request(req)
+            end
+          end
+          if resp.code != '200'
+            return nil
+          end
+          resp
+        rescue Errno::ENOENT, IOError, SystemCallError
+          nil
+        end
+
+        # Extracts credentials from AssumeRoleWithWebIdentity response.
+        #
+        # @param [ Net::HTTPResponse ] response AssumeRoleWithWebIdentity
+        #   call response.
+        #
+        # @return [ Auth::Aws::Credentials | nil ] A set of credentials, or nil
+        #   if response parsing failed.
+        def credentials_from_web_identity_response(response)
+          payload = JSON.parse(response.body).dig(
+            'AssumeRoleWithWebIdentityResponse',
+            'AssumeRoleWithWebIdentityResult',
+            'Credentials'
+          ) || {}
+          Credentials.new(
+            payload['AccessKeyId'],
+            payload['SecretAccessKey'],
+            payload['SessionToken'],
+            Time.at(payload['Expiration'])
+          )
+        rescue JSON::ParserError, TypeError
+          nil
+        end
+
         def http_get(http, uri, metadata_token)
           req = Net::HTTP::Get.new(uri,
             {'x-aws-ec2-metadata-token' => metadata_token})
@@ -216,6 +383,27 @@ module Mongo
 
           true
         end
+
+        # Execute the given block considering the timeout defined on the context,
+        # or the default timeout value.
+        #
+        # We use +Timeout.timeout+ here because there is no other acceptable easy
+        # way to time limit http requests.
+        #
+        # @param [ CsotTimeoutHolder | nil ] timeout_holder CSOT timeout.
+        #
+        # @ raise Error::TimeoutError if deadline exceeded.
+        def with_timeout(timeout_holder)
+          timeout = timeout_holder&.remaining_timeout_sec! || METADATA_TIMEOUT
+          exception_class = if timeout_holder&.csot?
+                              Error::TimeoutError
+                            else
+                              nil
+                            end
+          ::Timeout.timeout(timeout, exception_class) do
+            yield
+          end
+        end
       end
     end
   end

data/lib/mongo/auth/aws/request.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2020 MongoDB Inc.
 #
@@ -215,7 +215,6 @@ module Mongo
         # @return [ String ] The signature.
         def signature
           hashed_canonical_request = Digest::SHA256.hexdigest(canonical_request)
-          hashed_body = Digest::SHA256.new.update(STS_REQUEST_BODY).hexdigest
           string_to_sign = "AWS4-HMAC-SHA256\n" +
             "#{formatted_time}\n" +
             "#{scope}\n" +

data/lib/mongo/auth/aws.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2020 MongoDB Inc.
 #
@@ -25,16 +25,16 @@ module Mongo
       # @return [ BSON::Document ] The document of the authentication response.
       def login
         converse_2_step(connection, conversation)
+      rescue StandardError
+        CredentialsCache.instance.clear
+        raise
       end
-
-      # The AWS credential set.
-      #
-      # @api private
-      Credentials = Struct.new(:access_key_id, :secret_access_key, :session_token)
     end
   end
 end
 
 require 'mongo/auth/aws/conversation'
+require 'mongo/auth/aws/credentials'
+require 'mongo/auth/aws/credentials_cache'
 require 'mongo/auth/aws/credentials_retriever'
 require 'mongo/auth/aws/request'

data/lib/mongo/auth/base.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB Inc.
 #
@@ -112,7 +112,12 @@ module Mongo
         reply = connection.dispatch([msg], context)
         reply_document = reply.documents.first
         validate_reply!(connection, conversation, reply_document)
-        result = Operation::Result.new(reply, connection.description)
+        connection_global_id = if connection.respond_to?(:global_id)
+          connection.global_id
+        else
+          nil
+        end
+        result = Operation::Result.new(reply, connection.description, connection_global_id, context: context)
         connection.update_cluster_time(result)
         reply_document
       end
@@ -126,10 +131,12 @@ module Mongo
             code_name: doc[:codeName],
             message: doc[:errmsg],
           )
+
           raise Unauthorized.new(user,
             used_mechanism: self.class.const_get(:MECHANISM),
             message: message,
             server: connection.server,
+            code: doc[:code]
           )
         end
       end

data/lib/mongo/auth/conversation_base.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2020 MongoDB Inc.
 #

data/lib/mongo/auth/cr/conversation.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB Inc.
 #

data/lib/mongo/auth/cr.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB Inc.
 #

data/lib/mongo/auth/credential_cache.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2019-2020 MongoDB Inc.
 #

data/lib/mongo/auth/gssapi/conversation.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2015-2020 MongoDB Inc.
 #

data/lib/mongo/auth/gssapi.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB, Inc.
 #

data/lib/mongo/auth/ldap/conversation.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB Inc.
 #

data/lib/mongo/auth/ldap.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# encoding: utf-8
+# rubocop:todo all
 
 # Copyright (C) 2014-2020 MongoDB Inc.
 #