@depup/mongodb 7.1.0-depup.0

package/lib/cmap/auth/mongodb_oidc/automated_callback_workflow.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AutomatedCallbackWorkflow = void 0;
+const error_1 = require("../../../error");
+const timeout_1 = require("../../../timeout");
+const mongodb_oidc_1 = require("../mongodb_oidc");
+const callback_workflow_1 = require("./callback_workflow");
+/**
+ * Class implementing behaviour for the non human callback workflow.
+ * @internal
+ */
+class AutomatedCallbackWorkflow extends callback_workflow_1.CallbackWorkflow {
+    /**
+     * Instantiate the human callback workflow.
+     */
+    constructor(cache, callback) {
+        super(cache, callback);
+    }
+    /**
+     * Execute the OIDC callback workflow.
+     */
+    async execute(connection, credentials) {
+        // If there is a cached access token, try to authenticate with it. If
+        // authentication fails with an Authentication error (18),
+        // invalidate the access token, fetch a new access token, and try
+        // to authenticate again.
+        // If the server fails for any other reason, do not clear the cache.
+        if (this.cache.hasAccessToken) {
+            const token = this.cache.getAccessToken();
+            if (!connection.accessToken) {
+                connection.accessToken = token;
+            }
+            try {
+                return await this.finishAuthentication(connection, credentials, token);
+            }
+            catch (error) {
+                if (error instanceof error_1.MongoError &&
+                    error.code === error_1.MONGODB_ERROR_CODES.AuthenticationFailed) {
+                    this.cache.removeAccessToken();
+                    return await this.execute(connection, credentials);
+                }
+                else {
+                    throw error;
+                }
+            }
+        }
+        const response = await this.fetchAccessToken(credentials);
+        this.cache.put(response);
+        connection.accessToken = response.accessToken;
+        await this.finishAuthentication(connection, credentials, response.accessToken);
+    }
+    /**
+     * Fetches the access token using the callback.
+     */
+    async fetchAccessToken(credentials) {
+        const controller = new AbortController();
+        const params = {
+            timeoutContext: controller.signal,
+            version: mongodb_oidc_1.OIDC_VERSION
+        };
+        if (credentials.username) {
+            params.username = credentials.username;
+        }
+        if (credentials.mechanismProperties.TOKEN_RESOURCE) {
+            params.tokenAudience = credentials.mechanismProperties.TOKEN_RESOURCE;
+        }
+        const timeout = timeout_1.Timeout.expires(callback_workflow_1.AUTOMATED_TIMEOUT_MS);
+        try {
+            return await Promise.race([this.executeAndValidateCallback(params), timeout]);
+        }
+        catch (error) {
+            if (timeout_1.TimeoutError.is(error)) {
+                controller.abort();
+                throw new error_1.MongoOIDCError(`OIDC callback timed out after ${callback_workflow_1.AUTOMATED_TIMEOUT_MS}ms.`);
+            }
+            throw error;
+        }
+        finally {
+            timeout.clear();
+        }
+    }
+}
+exports.AutomatedCallbackWorkflow = AutomatedCallbackWorkflow;
+//# sourceMappingURL=automated_callback_workflow.js.map

package/lib/cmap/auth/mongodb_oidc/automated_callback_workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"automated_callback_workflow.js","sourceRoot":"","sources":["../../../../src/cmap/auth/mongodb_oidc/automated_callback_workflow.ts"],"names":[],"mappings":";;;AAAA,0CAAiF;AACjF,8CAAyD;AAGzD,kDAKyB;AACzB,2DAA6E;AAG7E;;;GAGG;AACH,MAAa,yBAA0B,SAAQ,oCAAgB;IAC7D;;OAEG;IACH,YAAY,KAAiB,EAAE,QAA8B;QAC3D,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,UAAsB,EAAE,WAA6B;QACjE,qEAAqE;QACrE,0DAA0D;QAC1D,iEAAiE;QACjE,yBAAyB;QACzB,oEAAoE;QACpE,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;gBAC5B,UAAU,CAAC,WAAW,GAAG,KAAK,CAAC;YACjC,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IACE,KAAK,YAAY,kBAAU;oBAC3B,KAAK,CAAC,IAAI,KAAK,2BAAmB,CAAC,oBAAoB,EACvD,CAAC;oBACD,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;oBAC/B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;gBACrD,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzB,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;QAC9C,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjF,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,gBAAgB,CAAC,WAA6B;QAC5D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,MAAM,GAAuB;YACjC,cAAc,EAAE,UAAU,CAAC,MAAM;YACjC,OAAO,EAAE,2BAAY;SACtB,CAAC;QACF,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;QACzC,CAAC;QACD,IAAI,WAAW,CAAC,mBAAmB,CAAC,cAAc,EAAE,CAAC;YACnD,MAAM,CAAC,aAAa,GAAG,WAAW,CAAC,mBAAmB,CAAC,cAAc,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,iBAAO,CAAC,OAAO,CAAC,wCAAoB,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,sBAAY,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,sBAAc,CAAC,iCAAiC,wCAAoB,KAAK,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;CACF;AAtED,8DAsEC"}

package/lib/cmap/auth/mongodb_oidc/azure_machine_workflow.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.callback = void 0;
+const azure_1 = require("../../../client-side-encryption/providers/azure");
+const error_1 = require("../../../error");
+const utils_1 = require("../../../utils");
+/** Azure request headers. */
+const AZURE_HEADERS = Object.freeze({ Metadata: 'true', Accept: 'application/json' });
+/** Invalid endpoint result error. */
+const ENDPOINT_RESULT_ERROR = 'Azure endpoint did not return a value with only access_token and expires_in properties';
+/** Error for when the token audience is missing in the environment. */
+const TOKEN_RESOURCE_MISSING_ERROR = 'TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is azure.';
+/**
+ * The callback function to be used in the automated callback workflow.
+ * @param params - The OIDC callback parameters.
+ * @returns The OIDC response.
+ */
+const callback = async (params) => {
+    const tokenAudience = params.tokenAudience;
+    const username = params.username;
+    if (!tokenAudience) {
+        throw new error_1.MongoAzureError(TOKEN_RESOURCE_MISSING_ERROR);
+    }
+    const response = await getAzureTokenData(tokenAudience, username);
+    if (!isEndpointResultValid(response)) {
+        throw new error_1.MongoAzureError(ENDPOINT_RESULT_ERROR);
+    }
+    return response;
+};
+exports.callback = callback;
+/**
+ * Hit the Azure endpoint to get the token data.
+ */
+async function getAzureTokenData(tokenAudience, username) {
+    const url = new URL(azure_1.AZURE_BASE_URL);
+    (0, azure_1.addAzureParams)(url, tokenAudience, username);
+    const response = await (0, utils_1.get)(url, {
+        headers: AZURE_HEADERS
+    });
+    if (response.status !== 200) {
+        throw new error_1.MongoAzureError(`Status code ${response.status} returned from the Azure endpoint. Response body: ${response.body}`);
+    }
+    const result = JSON.parse(response.body);
+    return {
+        accessToken: result.access_token,
+        expiresInSeconds: Number(result.expires_in)
+    };
+}
+/**
+ * Determines if a result returned from the endpoint is valid.
+ * This means the result is not nullish, contains the access_token required field
+ * and the expires_in required field.
+ */
+function isEndpointResultValid(token) {
+    if (token == null || typeof token !== 'object')
+        return false;
+    return ('accessToken' in token &&
+        typeof token.accessToken === 'string' &&
+        'expiresInSeconds' in token &&
+        typeof token.expiresInSeconds === 'number');
+}
+//# sourceMappingURL=azure_machine_workflow.js.map

package/lib/cmap/auth/mongodb_oidc/azure_machine_workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure_machine_workflow.js","sourceRoot":"","sources":["../../../../src/cmap/auth/mongodb_oidc/azure_machine_workflow.ts"],"names":[],"mappings":";;;AAAA,2EAAiG;AACjG,0CAAiD;AACjD,0CAAqC;AAGrC,6BAA6B;AAC7B,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAEtF,qCAAqC;AACrC,MAAM,qBAAqB,GACzB,wFAAwF,CAAC;AAE3F,uEAAuE;AACvE,MAAM,4BAA4B,GAChC,wFAAwF,CAAC;AAE3F;;;;GAIG;AACI,MAAM,QAAQ,GAAyB,KAAK,EACjD,MAA0B,EACH,EAAE;IACzB,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,uBAAe,CAAC,4BAA4B,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAClE,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,uBAAe,CAAC,qBAAqB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAbW,QAAA,QAAQ,YAanB;AAEF;;GAEG;AACH,KAAK,UAAU,iBAAiB,CAAC,aAAqB,EAAE,QAAiB;IACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,sBAAc,CAAC,CAAC;IACpC,IAAA,sBAAc,EAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,IAAA,WAAG,EAAC,GAAG,EAAE;QAC9B,OAAO,EAAE,aAAa;KACvB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAe,CACvB,eAAe,QAAQ,CAAC,MAAM,qDAAqD,QAAQ,CAAC,IAAI,EAAE,CACnG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,KAAc;IAEd,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7D,OAAO,CACL,aAAa,IAAI,KAAK;QACtB,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,kBAAkB,IAAI,KAAK;QAC3B,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ,CAC3C,CAAC;AACJ,CAAC"}

package/lib/cmap/auth/mongodb_oidc/callback_workflow.js

@@ -0,0 +1,141 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CallbackWorkflow = exports.AUTOMATED_TIMEOUT_MS = exports.HUMAN_TIMEOUT_MS = void 0;
+const promises_1 = require("timers/promises");
+const error_1 = require("../../../error");
+const utils_1 = require("../../../utils");
+const command_builders_1 = require("./command_builders");
+/** 5 minutes in milliseconds */
+exports.HUMAN_TIMEOUT_MS = 300000;
+/** 1 minute in milliseconds */
+exports.AUTOMATED_TIMEOUT_MS = 60000;
+/** Properties allowed on results of callbacks. */
+const RESULT_PROPERTIES = ['accessToken', 'expiresInSeconds', 'refreshToken'];
+/** Error message when the callback result is invalid. */
+const CALLBACK_RESULT_ERROR = 'User provided OIDC callbacks must return a valid object with an accessToken.';
+/** The time to throttle callback calls. */
+const THROTTLE_MS = 100;
+/**
+ * OIDC implementation of a callback based workflow.
+ * @internal
+ */
+class CallbackWorkflow {
+    /**
+     * Instantiate the callback workflow.
+     */
+    constructor(cache, callback) {
+        this.cache = cache;
+        this.callback = this.withLock(callback);
+        this.lastExecutionTime = Date.now() - THROTTLE_MS;
+    }
+    /**
+     * Get the document to add for speculative authentication. This also needs
+     * to add a db field from the credentials source.
+     */
+    async speculativeAuth(connection, credentials) {
+        // Check if the Client Cache has an access token.
+        // If it does, cache the access token in the Connection Cache and send a JwtStepRequest
+        // with the cached access token in the speculative authentication SASL payload.
+        if (this.cache.hasAccessToken) {
+            const accessToken = this.cache.getAccessToken();
+            connection.accessToken = accessToken;
+            const document = (0, command_builders_1.finishCommandDocument)(accessToken);
+            document.db = credentials.source;
+            return { speculativeAuthenticate: document };
+        }
+        return {};
+    }
+    /**
+     * Reauthenticate the callback workflow. For this we invalidated the access token
+     * in the cache and run the authentication steps again. No initial handshake needs
+     * to be sent.
+     */
+    async reauthenticate(connection, credentials) {
+        if (this.cache.hasAccessToken) {
+            // Reauthentication implies the token has expired.
+            if (connection.accessToken === this.cache.getAccessToken()) {
+                // If connection's access token is the same as the cache's, remove
+                // the token from the cache and connection.
+                this.cache.removeAccessToken();
+                delete connection.accessToken;
+            }
+            else {
+                // If the connection's access token is different from the cache's, set
+                // the cache's token on the connection and do not remove from the
+                // cache.
+                connection.accessToken = this.cache.getAccessToken();
+            }
+        }
+        await this.execute(connection, credentials);
+    }
+    /**
+     * Starts the callback authentication process. If there is a speculative
+     * authentication document from the initial handshake, then we will use that
+     * value to get the issuer, otherwise we will send the saslStart command.
+     */
+    async startAuthentication(connection, credentials, response) {
+        let result;
+        if (response?.speculativeAuthenticate) {
+            result = response.speculativeAuthenticate;
+        }
+        else {
+            result = await connection.command((0, utils_1.ns)(credentials.source), (0, command_builders_1.startCommandDocument)(credentials), undefined);
+        }
+        return result;
+    }
+    /**
+     * Finishes the callback authentication process.
+     */
+    async finishAuthentication(connection, credentials, token, conversationId) {
+        await connection.command((0, utils_1.ns)(credentials.source), (0, command_builders_1.finishCommandDocument)(token, conversationId), undefined);
+    }
+    /**
+     * Executes the callback and validates the output.
+     */
+    async executeAndValidateCallback(params) {
+        const result = await this.callback(params);
+        // Validate that the result returned by the callback is acceptable. If it is not
+        // we must clear the token result from the cache.
+        if (isCallbackResultInvalid(result)) {
+            throw new error_1.MongoMissingCredentialsError(CALLBACK_RESULT_ERROR);
+        }
+        return result;
+    }
+    /**
+     * Ensure the callback is only executed one at a time and throttles the calls
+     * to every 100ms.
+     */
+    withLock(callback) {
+        let lock = Promise.resolve();
+        return async (params) => {
+            // We do this to ensure that we would never return the result of the
+            // previous lock, only the current callback's value would get returned.
+            await lock;
+            lock = lock
+                .catch(() => null)
+                .then(async () => {
+                const difference = Date.now() - this.lastExecutionTime;
+                if (difference <= THROTTLE_MS) {
+                    await (0, promises_1.setTimeout)(THROTTLE_MS - difference, { signal: params.timeoutContext });
+                }
+                this.lastExecutionTime = Date.now();
+                return await callback(params);
+            });
+            return await lock;
+        };
+    }
+}
+exports.CallbackWorkflow = CallbackWorkflow;
+/**
+ * Determines if a result returned from a request or refresh callback
+ * function is invalid. This means the result is nullish, doesn't contain
+ * the accessToken required field, and does not contain extra fields.
+ */
+function isCallbackResultInvalid(tokenResult) {
+    if (tokenResult == null || typeof tokenResult !== 'object')
+        return true;
+    if (!('accessToken' in tokenResult))
+        return true;
+    return !Object.getOwnPropertyNames(tokenResult).every(prop => RESULT_PROPERTIES.includes(prop));
+}
+//# sourceMappingURL=callback_workflow.js.map

package/lib/cmap/auth/mongodb_oidc/callback_workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback_workflow.js","sourceRoot":"","sources":["../../../../src/cmap/auth/mongodb_oidc/callback_workflow.ts"],"names":[],"mappings":";;;AAAA,8CAA6C;AAG7C,0CAA8D;AAC9D,0CAAoC;AASpC,yDAAiF;AAGjF,gCAAgC;AACnB,QAAA,gBAAgB,GAAG,MAAM,CAAC;AACvC,+BAA+B;AAClB,QAAA,oBAAoB,GAAG,KAAK,CAAC;AAE1C,kDAAkD;AAClD,MAAM,iBAAiB,GAAG,CAAC,aAAa,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;AAE9E,yDAAyD;AACzD,MAAM,qBAAqB,GACzB,8EAA8E,CAAC;AAEjF,2CAA2C;AAC3C,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB;;;GAGG;AACH,MAAsB,gBAAgB;IAKpC;;OAEG;IACH,YAAY,KAAiB,EAAE,QAA8B;QAC3D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,UAAsB,EAAE,WAA6B;QACzE,iDAAiD;QACjD,uFAAuF;QACvF,+EAA+E;QAC/E,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAChD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;YACrC,MAAM,QAAQ,GAAG,IAAA,wCAAqB,EAAC,WAAW,CAAC,CAAC;YACpD,QAAQ,CAAC,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC;YACjC,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,UAAsB,EAAE,WAA6B;QACxE,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC9B,kDAAkD;YAClD,IAAI,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3D,kEAAkE;gBAClE,2CAA2C;gBAC3C,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC/B,OAAO,UAAU,CAAC,WAAW,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,sEAAsE;gBACtE,iEAAiE;gBACjE,SAAS;gBACT,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YACvD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC9C,CAAC;IAWD;;;;OAIG;IACO,KAAK,CAAC,mBAAmB,CACjC,UAAsB,EACtB,WAA6B,EAC7B,QAAmB;QAEnB,IAAI,MAAM,CAAC;QACX,IAAI,QAAQ,EAAE,uBAAuB,EAAE,CAAC;YACtC,MAAM,GAAG,QAAQ,CAAC,uBAAuB,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAC/B,IAAA,UAAE,EAAC,WAAW,CAAC,MAAM,CAAC,EACtB,IAAA,uCAAoB,EAAC,WAAW,CAAC,EACjC,SAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,oBAAoB,CAClC,UAAsB,EACtB,WAA6B,EAC7B,KAAa,EACb,cAAuB;QAEvB,MAAM,UAAU,CAAC,OAAO,CACtB,IAAA,UAAE,EAAC,WAAW,CAAC,MAAM,CAAC,EACtB,IAAA,wCAAqB,EAAC,KAAK,EAAE,cAAc,CAAC,EAC5C,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,0BAA0B,CAAC,MAA0B;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3C,gFAAgF;QAChF,iDAAiD;QACjD,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,oCAA4B,CAAC,qBAAqB,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACO,QAAQ,CAAC,QAA8B;QAC/C,IAAI,IAAI,GAAiB,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3C,OAAO,KAAK,EAAE,MAA0B,EAAyB,EAAE;YACjE,oEAAoE;YACpE,uEAAuE;YACvE,MAAM,IAAI,CAAC;YACX,IAAI,GAAG,IAAI;iBAER,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;iBAEjB,IAAI,CAAC,KAAK,IAAI,EAAE;gBACf,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC;gBACvD,IAAI,UAAU,IAAI,WAAW,EAAE,CAAC;oBAC9B,MAAM,IAAA,qBAAU,EAAC,WAAW,GAAG,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;gBAChF,CAAC;gBACD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACpC,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YACL,OAAO,MAAM,IAAI,CAAC;QACpB,CAAC,CAAC;IACJ,CAAC;CACF;AA7ID,4CA6IC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,WAAoB;IACnD,IAAI,WAAW,IAAI,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,CAAC,CAAC,aAAa,IAAI,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAClG,CAAC"}

package/lib/cmap/auth/mongodb_oidc/command_builders.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.finishCommandDocument = finishCommandDocument;
+exports.startCommandDocument = startCommandDocument;
+const bson_1 = require("../../../bson");
+const providers_1 = require("../providers");
+/**
+ * Generate the finishing command document for authentication. Will be a
+ * saslStart or saslContinue depending on the presence of a conversation id.
+ */
+function finishCommandDocument(token, conversationId) {
+    if (conversationId != null) {
+        return {
+            saslContinue: 1,
+            conversationId: conversationId,
+            payload: new bson_1.Binary(bson_1.BSON.serialize({ jwt: token }))
+        };
+    }
+    // saslContinue requires a conversationId in the command to be valid so in this
+    // case the server allows "step two" to actually be a saslStart with the token
+    // as the jwt since the use of the cached value has no correlating conversating
+    // on the particular connection.
+    return {
+        saslStart: 1,
+        mechanism: providers_1.AuthMechanism.MONGODB_OIDC,
+        payload: new bson_1.Binary(bson_1.BSON.serialize({ jwt: token }))
+    };
+}
+/**
+ * Generate the saslStart command document.
+ */
+function startCommandDocument(credentials) {
+    const payload = {};
+    if (credentials.username) {
+        payload.n = credentials.username;
+    }
+    return {
+        saslStart: 1,
+        autoAuthorize: 1,
+        mechanism: providers_1.AuthMechanism.MONGODB_OIDC,
+        payload: new bson_1.Binary(bson_1.BSON.serialize(payload))
+    };
+}
+//# sourceMappingURL=command_builders.js.map

package/lib/cmap/auth/mongodb_oidc/command_builders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command_builders.js","sourceRoot":"","sources":["../../../../src/cmap/auth/mongodb_oidc/command_builders.ts"],"names":[],"mappings":";;AAmBA,sDAiBC;AAKD,oDAWC;AApDD,wCAA4D;AAE5D,4CAA6C;AAa7C;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,KAAa,EAAE,cAAuB;IAC1E,IAAI,cAAc,IAAI,IAAI,EAAE,CAAC;QAC3B,OAAO;YACL,YAAY,EAAE,CAAC;YACf,cAAc,EAAE,cAAc;YAC9B,OAAO,EAAE,IAAI,aAAM,CAAC,WAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;SACpD,CAAC;IACJ,CAAC;IACD,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,gCAAgC;IAChC,OAAO;QACL,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,yBAAa,CAAC,YAAY;QACrC,OAAO,EAAE,IAAI,aAAM,CAAC,WAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAAC,WAA6B;IAChE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC;IACnC,CAAC;IACD,OAAO;QACL,SAAS,EAAE,CAAC;QACZ,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,yBAAa,CAAC,YAAY;QACrC,OAAO,EAAE,IAAI,aAAM,CAAC,WAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;KAC7C,CAAC;AACJ,CAAC"}

package/lib/cmap/auth/mongodb_oidc/gcp_machine_workflow.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.callback = void 0;
+const error_1 = require("../../../error");
+const utils_1 = require("../../../utils");
+/** GCP base URL. */
+const GCP_BASE_URL = 'http://metadata/computeMetadata/v1/instance/service-accounts/default/identity';
+/** GCP request headers. */
+const GCP_HEADERS = Object.freeze({ 'Metadata-Flavor': 'Google' });
+/** Error for when the token audience is missing in the environment. */
+const TOKEN_RESOURCE_MISSING_ERROR = 'TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is gcp.';
+/**
+ * The callback function to be used in the automated callback workflow.
+ * @param params - The OIDC callback parameters.
+ * @returns The OIDC response.
+ */
+const callback = async (params) => {
+    const tokenAudience = params.tokenAudience;
+    if (!tokenAudience) {
+        throw new error_1.MongoGCPError(TOKEN_RESOURCE_MISSING_ERROR);
+    }
+    return await getGcpTokenData(tokenAudience);
+};
+exports.callback = callback;
+/**
+ * Hit the GCP endpoint to get the token data.
+ */
+async function getGcpTokenData(tokenAudience) {
+    const url = new URL(GCP_BASE_URL);
+    url.searchParams.append('audience', tokenAudience);
+    const response = await (0, utils_1.get)(url, {
+        headers: GCP_HEADERS
+    });
+    if (response.status !== 200) {
+        throw new error_1.MongoGCPError(`Status code ${response.status} returned from the GCP endpoint. Response body: ${response.body}`);
+    }
+    return { accessToken: response.body };
+}
+//# sourceMappingURL=gcp_machine_workflow.js.map

package/lib/cmap/auth/mongodb_oidc/gcp_machine_workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp_machine_workflow.js","sourceRoot":"","sources":["../../../../src/cmap/auth/mongodb_oidc/gcp_machine_workflow.ts"],"names":[],"mappings":";;;AAAA,0CAA+C;AAC/C,0CAAqC;AAGrC,oBAAoB;AACpB,MAAM,YAAY,GAChB,+EAA+E,CAAC;AAElF,2BAA2B;AAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;AAEnE,uEAAuE;AACvE,MAAM,4BAA4B,GAChC,sFAAsF,CAAC;AAEzF;;;;GAIG;AACI,MAAM,QAAQ,GAAyB,KAAK,EACjD,MAA0B,EACH,EAAE;IACzB,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IAC3C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,qBAAa,CAAC,4BAA4B,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;AAC9C,CAAC,CAAC;AARW,QAAA,QAAQ,YAQnB;AAEF;;GAEG;AACH,KAAK,UAAU,eAAe,CAAC,aAAqB;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IAClC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,IAAA,WAAG,EAAC,GAAG,EAAE;QAC9B,OAAO,EAAE,WAAW;KACrB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,qBAAa,CACrB,eAAe,QAAQ,CAAC,MAAM,mDAAmD,QAAQ,CAAC,IAAI,EAAE,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC"}

package/lib/cmap/auth/mongodb_oidc/human_callback_workflow.js

@@ -0,0 +1,122 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HumanCallbackWorkflow = void 0;
+const bson_1 = require("../../../bson");
+const error_1 = require("../../../error");
+const timeout_1 = require("../../../timeout");
+const mongodb_oidc_1 = require("../mongodb_oidc");
+const callback_workflow_1 = require("./callback_workflow");
+/**
+ * Class implementing behaviour for the non human callback workflow.
+ * @internal
+ */
+class HumanCallbackWorkflow extends callback_workflow_1.CallbackWorkflow {
+    /**
+     * Instantiate the human callback workflow.
+     */
+    constructor(cache, callback) {
+        super(cache, callback);
+    }
+    /**
+     * Execute the OIDC human callback workflow.
+     */
+    async execute(connection, credentials) {
+        // Check if the Client Cache has an access token.
+        // If it does, cache the access token in the Connection Cache and perform a One-Step SASL conversation
+        // using the access token. If the server returns an Authentication error (18),
+        // invalidate the access token token from the Client Cache, clear the Connection Cache,
+        // and restart the authentication flow. Raise any other errors to the user. On success, exit the algorithm.
+        if (this.cache.hasAccessToken) {
+            const token = this.cache.getAccessToken();
+            connection.accessToken = token;
+            try {
+                return await this.finishAuthentication(connection, credentials, token);
+            }
+            catch (error) {
+                if (error instanceof error_1.MongoError &&
+                    error.code === error_1.MONGODB_ERROR_CODES.AuthenticationFailed) {
+                    this.cache.removeAccessToken();
+                    delete connection.accessToken;
+                    return await this.execute(connection, credentials);
+                }
+                else {
+                    throw error;
+                }
+            }
+        }
+        // Check if the Client Cache has a refresh token.
+        // If it does, call the OIDC Human Callback with the cached refresh token and IdpInfo to get a
+        // new access token. Cache the new access token in the Client Cache and Connection Cache.
+        // Perform a One-Step SASL conversation using the new access token. If the the server returns
+        // an Authentication error (18), clear the refresh token, invalidate the access token from the
+        // Client Cache, clear the Connection Cache, and restart the authentication flow. Raise any other
+        // errors to the user. On success, exit the algorithm.
+        if (this.cache.hasRefreshToken) {
+            const refreshToken = this.cache.getRefreshToken();
+            const result = await this.fetchAccessToken(this.cache.getIdpInfo(), credentials, refreshToken);
+            this.cache.put(result);
+            connection.accessToken = result.accessToken;
+            try {
+                return await this.finishAuthentication(connection, credentials, result.accessToken);
+            }
+            catch (error) {
+                if (error instanceof error_1.MongoError &&
+                    error.code === error_1.MONGODB_ERROR_CODES.AuthenticationFailed) {
+                    this.cache.removeRefreshToken();
+                    delete connection.accessToken;
+                    return await this.execute(connection, credentials);
+                }
+                else {
+                    throw error;
+                }
+            }
+        }
+        // Start a new Two-Step SASL conversation.
+        // Run a PrincipalStepRequest to get the IdpInfo.
+        // Call the OIDC Human Callback with the new IdpInfo to get a new access token and optional refresh
+        // token. Drivers MUST NOT pass a cached refresh token to the callback when performing
+        // a new Two-Step conversation. Cache the new IdpInfo and refresh token in the Client Cache and the
+        // new access token in the Client Cache and Connection Cache.
+        // Attempt to authenticate using a JwtStepRequest with the new access token. Raise any errors to the user.
+        const startResponse = await this.startAuthentication(connection, credentials);
+        const conversationId = startResponse.conversationId;
+        const idpInfo = bson_1.BSON.deserialize(startResponse.payload.buffer);
+        const callbackResponse = await this.fetchAccessToken(idpInfo, credentials);
+        this.cache.put(callbackResponse, idpInfo);
+        connection.accessToken = callbackResponse.accessToken;
+        return await this.finishAuthentication(connection, credentials, callbackResponse.accessToken, conversationId);
+    }
+    /**
+     * Fetches an access token using the callback.
+     */
+    async fetchAccessToken(idpInfo, credentials, refreshToken) {
+        const controller = new AbortController();
+        const params = {
+            timeoutContext: controller.signal,
+            version: mongodb_oidc_1.OIDC_VERSION,
+            idpInfo: idpInfo
+        };
+        if (credentials.username) {
+            params.username = credentials.username;
+        }
+        if (refreshToken) {
+            params.refreshToken = refreshToken;
+        }
+        const timeout = timeout_1.Timeout.expires(callback_workflow_1.HUMAN_TIMEOUT_MS);
+        try {
+            return await Promise.race([this.executeAndValidateCallback(params), timeout]);
+        }
+        catch (error) {
+            if (timeout_1.TimeoutError.is(error)) {
+                controller.abort();
+                throw new error_1.MongoOIDCError(`OIDC callback timed out after ${callback_workflow_1.HUMAN_TIMEOUT_MS}ms.`);
+            }
+            throw error;
+        }
+        finally {
+            timeout.clear();
+        }
+    }
+}
+exports.HumanCallbackWorkflow = HumanCallbackWorkflow;
+//# sourceMappingURL=human_callback_workflow.js.map

package/lib/cmap/auth/mongodb_oidc/human_callback_workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"human_callback_workflow.js","sourceRoot":"","sources":["../../../../src/cmap/auth/mongodb_oidc/human_callback_workflow.ts"],"names":[],"mappings":";;;AAAA,wCAAqC;AACrC,0CAAiF;AACjF,8CAAyD;AAGzD,kDAMyB;AACzB,2DAAyE;AAGzE;;;GAGG;AACH,MAAa,qBAAsB,SAAQ,oCAAgB;IACzD;;OAEG;IACH,YAAY,KAAiB,EAAE,QAA8B;QAC3D,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,UAAsB,EAAE,WAA6B;QACjE,iDAAiD;QACjD,sGAAsG;QACtG,8EAA8E;QAC9E,uFAAuF;QACvF,2GAA2G;QAC3G,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1C,UAAU,CAAC,WAAW,GAAG,KAAK,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IACE,KAAK,YAAY,kBAAU;oBAC3B,KAAK,CAAC,IAAI,KAAK,2BAAmB,CAAC,oBAAoB,EACvD,CAAC;oBACD,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;oBAC/B,OAAO,UAAU,CAAC,WAAW,CAAC;oBAC9B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;gBACrD,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QACD,iDAAiD;QACjD,8FAA8F;QAC9F,yFAAyF;QACzF,6FAA6F;QAC7F,8FAA8F;QAC9F,iGAAiG;QACjG,sDAAsD;QACtD,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CACxC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EACvB,WAAW,EACX,YAAY,CACb,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvB,UAAU,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;YAC5C,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YACtF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IACE,KAAK,YAAY,kBAAU;oBAC3B,KAAK,CAAC,IAAI,KAAK,2BAAmB,CAAC,oBAAoB,EACvD,CAAC;oBACD,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;oBAChC,OAAO,UAAU,CAAC,WAAW,CAAC;oBAC9B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;gBACrD,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,iDAAiD;QACjD,mGAAmG;QACnG,sFAAsF;QACtF,mGAAmG;QACnG,6DAA6D;QAC7D,0GAA0G;QAC1G,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC9E,MAAM,cAAc,GAAG,aAAa,CAAC,cAAc,CAAC;QACpD,MAAM,OAAO,GAAG,WAAI,CAAC,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAY,CAAC;QAC1E,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC1C,UAAU,CAAC,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC;QACtD,OAAO,MAAM,IAAI,CAAC,oBAAoB,CACpC,UAAU,EACV,WAAW,EACX,gBAAgB,CAAC,WAAW,EAC5B,cAAc,CACf,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAC5B,OAAgB,EAChB,WAA6B,EAC7B,YAAqB;QAErB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,MAAM,GAAuB;YACjC,cAAc,EAAE,UAAU,CAAC,MAAM;YACjC,OAAO,EAAE,2BAAY;YACrB,OAAO,EAAE,OAAO;SACjB,CAAC;QACF,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;QACzC,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;QACrC,CAAC;QACD,MAAM,OAAO,GAAG,iBAAO,CAAC,OAAO,CAAC,oCAAgB,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,sBAAY,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,sBAAc,CAAC,iCAAiC,oCAAgB,KAAK,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;CACF;AAzHD,sDAyHC"}

package/lib/cmap/auth/mongodb_oidc/k8s_machine_workflow.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.callback = void 0;
+const promises_1 = require("fs/promises");
+const process = require("process");
+/** The fallback file name */
+const FALLBACK_FILENAME = '/var/run/secrets/kubernetes.io/serviceaccount/token';
+/** The azure environment variable for the file name. */
+const AZURE_FILENAME = 'AZURE_FEDERATED_TOKEN_FILE';
+/** The AWS environment variable for the file name. */
+const AWS_FILENAME = 'AWS_WEB_IDENTITY_TOKEN_FILE';
+/**
+ * The callback function to be used in the automated callback workflow.
+ * @param params - The OIDC callback parameters.
+ * @returns The OIDC response.
+ */
+const callback = async () => {
+    let filename;
+    if (process.env[AZURE_FILENAME]) {
+        filename = process.env[AZURE_FILENAME];
+    }
+    else if (process.env[AWS_FILENAME]) {
+        filename = process.env[AWS_FILENAME];
+    }
+    else {
+        filename = FALLBACK_FILENAME;
+    }
+    const token = await (0, promises_1.readFile)(filename, 'utf8');
+    return { accessToken: token };
+};
+exports.callback = callback;
+//# sourceMappingURL=k8s_machine_workflow.js.map

package/lib/cmap/auth/mongodb_oidc/k8s_machine_workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"k8s_machine_workflow.js","sourceRoot":"","sources":["../../../../src/cmap/auth/mongodb_oidc/k8s_machine_workflow.ts"],"names":[],"mappings":";;;AAAA,0CAAuC;AACvC,mCAAmC;AAInC,6BAA6B;AAC7B,MAAM,iBAAiB,GAAG,qDAAqD,CAAC;AAEhF,wDAAwD;AACxD,MAAM,cAAc,GAAG,4BAA4B,CAAC;AAEpD,sDAAsD;AACtD,MAAM,YAAY,GAAG,6BAA6B,CAAC;AAEnD;;;;GAIG;AACI,MAAM,QAAQ,GAAyB,KAAK,IAA2B,EAAE;IAC9E,IAAI,QAAgB,CAAC;IACrB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzC,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QACrC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,iBAAiB,CAAC;IAC/B,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAQ,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC,CAAC;AAXW,QAAA,QAAQ,YAWnB"}

package/lib/cmap/auth/mongodb_oidc/token_cache.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenCache = void 0;
+const error_1 = require("../../../error");
+class MongoOIDCError extends error_1.MongoDriverError {
+}
+/** @internal */
+class TokenCache {
+    get hasAccessToken() {
+        return !!this.accessToken;
+    }
+    get hasRefreshToken() {
+        return !!this.refreshToken;
+    }
+    get hasIdpInfo() {
+        return !!this.idpInfo;
+    }
+    getAccessToken() {
+        if (!this.accessToken) {
+            throw new MongoOIDCError('Attempted to get an access token when none exists.');
+        }
+        return this.accessToken;
+    }
+    getRefreshToken() {
+        if (!this.refreshToken) {
+            throw new MongoOIDCError('Attempted to get a refresh token when none exists.');
+        }
+        return this.refreshToken;
+    }
+    getIdpInfo() {
+        if (!this.idpInfo) {
+            throw new MongoOIDCError('Attempted to get IDP information when none exists.');
+        }
+        return this.idpInfo;
+    }
+    put(response, idpInfo) {
+        this.accessToken = response.accessToken;
+        this.refreshToken = response.refreshToken;
+        this.expiresInSeconds = response.expiresInSeconds;
+        if (idpInfo) {
+            this.idpInfo = idpInfo;
+        }
+    }
+    removeAccessToken() {
+        this.accessToken = undefined;
+    }
+    removeRefreshToken() {
+        this.refreshToken = undefined;
+    }
+}
+exports.TokenCache = TokenCache;
+//# sourceMappingURL=token_cache.js.map

package/lib/cmap/auth/mongodb_oidc/token_cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token_cache.js","sourceRoot":"","sources":["../../../../src/cmap/auth/mongodb_oidc/token_cache.ts"],"names":[],"mappings":";;;AAAA,0CAAkD;AAGlD,MAAM,cAAe,SAAQ,wBAAgB;CAAG;AAEhD,gBAAgB;AAChB,MAAa,UAAU;IAMrB,IAAI,cAAc;QAChB,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,cAAc;QACZ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CAAC,oDAAoD,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,eAAe;QACb,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,cAAc,CAAC,oDAAoD,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,UAAU;QACR,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,cAAc,CAAC,oDAAoD,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,GAAG,CAAC,QAAsB,EAAE,OAAiB;QAC3C,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,CAAC;IACH,CAAC;IAED,iBAAiB;QACf,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;IAC/B,CAAC;IAED,kBAAkB;QAChB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;IAChC,CAAC;CACF;AAvDD,gCAuDC"}

package/lib/cmap/auth/mongodb_oidc/token_machine_workflow.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.callback = void 0;
+const fs = require("fs");
+const process = require("process");
+const error_1 = require("../../../error");
+/** Error for when the token is missing in the environment. */
+const TOKEN_MISSING_ERROR = 'OIDC_TOKEN_FILE must be set in the environment.';
+/**
+ * The callback function to be used in the automated callback workflow.
+ * @param params - The OIDC callback parameters.
+ * @returns The OIDC response.
+ */
+const callback = async () => {
+    const tokenFile = process.env.OIDC_TOKEN_FILE;
+    if (!tokenFile) {
+        throw new error_1.MongoAWSError(TOKEN_MISSING_ERROR);
+    }
+    const token = await fs.promises.readFile(tokenFile, 'utf8');
+    return { accessToken: token };
+};
+exports.callback = callback;
+//# sourceMappingURL=token_machine_workflow.js.map