@depup/mongodb 7.1.0-depup.0

package/src/cmap/auth/auth_provider.ts

@@ -0,0 +1,77 @@
+import type { Document } from '../../bson';
+import { MongoRuntimeError } from '../../error';
+import type { HandshakeDocument } from '../connect';
+import type { Connection, ConnectionOptions } from '../connection';
+import type { MongoCredentials } from './mongo_credentials';
+
+/**
+ * Context used during authentication
+ * @internal
+ */
+export class AuthContext {
+  /** The connection to authenticate */
+  connection: Connection;
+  /** The credentials to use for authentication */
+  credentials?: MongoCredentials;
+  /** If the context is for reauthentication. */
+  reauthenticating = false;
+  /** The options passed to the `connect` method */
+  options: ConnectionOptions;
+
+  /** A response from an initial auth attempt, only some mechanisms use this (e.g, SCRAM) */
+  response?: Document;
+  /** A random nonce generated for use in an authentication conversation */
+  nonce?: Buffer;
+
+  constructor(
+    connection: Connection,
+    credentials: MongoCredentials | undefined,
+    options: ConnectionOptions
+  ) {
+    this.connection = connection;
+    this.credentials = credentials;
+    this.options = options;
+  }
+}
+
+/**
+ * Provider used during authentication.
+ * @internal
+ */
+export abstract class AuthProvider {
+  /**
+   * Prepare the handshake document before the initial handshake.
+   *
+   * @param handshakeDoc - The document used for the initial handshake on a connection
+   * @param authContext - Context for authentication flow
+   */
+  async prepare(
+    handshakeDoc: HandshakeDocument,
+    _authContext: AuthContext
+  ): Promise<HandshakeDocument> {
+    return handshakeDoc;
+  }
+
+  /**
+   * Authenticate
+   *
+   * @param context - A shared context for authentication flow
+   */
+  abstract auth(context: AuthContext): Promise<void>;
+
+  /**
+   * Reauthenticate.
+   * @param context - The shared auth context.
+   */
+  async reauth(context: AuthContext): Promise<void> {
+    if (context.reauthenticating) {
+      throw new MongoRuntimeError('Reauthentication already in progress.');
+    }
+    try {
+      context.reauthenticating = true;
+      await this.auth(context);
+    } finally {
+      context.reauthenticating = false;
+    }
+  }
+}

package/src/cmap/auth/aws4.ts

@@ -0,0 +1,207 @@
+import { BSON } from '../../bson';
+import { type AWSCredentials } from '../../deps';
+
+export type AwsSigv4Options = {
+  path: '/';
+  body: string;
+  host: string;
+  method: 'POST';
+  headers: {
+    'Content-Type': 'application/x-www-form-urlencoded';
+    'Content-Length': number;
+    'X-MongoDB-Server-Nonce': string;
+    'X-MongoDB-GS2-CB-Flag': 'n';
+  };
+  service: string;
+  region: string;
+  date: Date;
+};
+
+export type SignedHeaders = {
+  Authorization: string;
+  'X-Amz-Date': string;
+};
+
+/**
+ * Calculates the SHA-256 hash of a string.
+ *
+ * @param str - String to hash.
+ * @returns Hexadecimal representation of the hash.
+ */
+const getHexSha256 = async (str: string): Promise<string> => {
+  const data = stringToBuffer(str);
+  const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+  const hashHex = BSON.onDemand.ByteUtils.toHex(new Uint8Array(hashBuffer));
+  return hashHex;
+};
+
+/**
+ * Calculates the HMAC-SHA256 of a string using the provided key.
+ * @param key - Key to use for HMAC calculation. Can be a string or Uint8Array.
+ * @param str - String to calculate HMAC for.
+ * @returns Uint8Array containing the HMAC-SHA256 digest.
+ */
+const getHmacSha256 = async (key: string | Uint8Array, str: string): Promise<Uint8Array> => {
+  let keyData: Uint8Array;
+  if (typeof key === 'string') {
+    keyData = stringToBuffer(key);
+  } else {
+    keyData = key;
+  }
+
+  const importedKey = await crypto.subtle.importKey(
+    'raw',
+    keyData,
+    { name: 'HMAC', hash: { name: 'SHA-256' } },
+    false,
+    ['sign']
+  );
+  const strData = stringToBuffer(str);
+  const signature = await crypto.subtle.sign('HMAC', importedKey, strData);
+  const digest = new Uint8Array(signature);
+  return digest;
+};
+
+/**
+ * Converts header values according to AWS requirements,
+ * From https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html#create-canonical-request
+ * For values, you must:
+    - trim any leading or trailing spaces.
+    - convert sequential spaces to a single space.
+ * @param value - Header value to convert.
+ * @returns - Converted header value.
+ */
+const convertHeaderValue = (value: string | number) => {
+  return value.toString().trim().replace(/\s+/g, ' ');
+};
+
+/**
+ * Returns a Uint8Array representation of a string, encoded in UTF-8.
+ * @param str - String to convert.
+ * @returns Uint8Array containing the UTF-8 encoded string.
+ */
+function stringToBuffer(str: string): Uint8Array {
+  const data = new Uint8Array(BSON.onDemand.ByteUtils.utf8ByteLength(str));
+  BSON.onDemand.ByteUtils.encodeUTF8Into(data, str, 0);
+  return data;
+}
+
+/**
+ * This method implements AWS Signature 4 logic for a very specific request format.
+ * The signing logic is described here: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
+ */
+export async function aws4Sign(
+  options: AwsSigv4Options,
+  credentials: AWSCredentials
+): Promise<SignedHeaders> {
+  /**
+   * From the spec: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
+   *
+   * Summary of signing steps
+   * 1. Create a canonical request
+   *    Arrange the contents of your request (host, action, headers, etc.) into a standard canonical format. The canonical request is one of the inputs used to create the string to sign.
+   * 2. Create a hash of the canonical request
+   *    Hash the canonical request using the same algorithm that you used to create the hash of the payload. The hash of the canonical request is a string of lowercase hexadecimal characters.
+   * 3. Create a string to sign
+   *    Create a string to sign with the canonical request and extra information such as the algorithm, request date, credential scope, and the hash of the canonical request.
+   * 4. Derive a signing key
+   *    Use the secret access key to derive the key used to sign the request.
+   * 5. Calculate the signature
+   *    Perform a keyed hash operation on the string to sign using the derived signing key as the hash key.
+   * 6. Add the signature to the request
+   *    Add the calculated signature to an HTTP header or to the query string of the request.
+   */
+
+  // 1: Create a canonical request
+
+  // Date – The date and time used to sign the request.
+  const date = options.date;
+  // RequestDateTime – The date and time used in the credential scope. This value is the current UTC time in ISO 8601 format (for example, 20130524T000000Z).
+  const requestDateTime = date.toISOString().replace(/[:-]|\.\d{3}/g, '');
+  // RequestDate – The date used in the credential scope. This value is the current UTC date in YYYYMMDD format (for example, 20130524).
+  const requestDate = requestDateTime.substring(0, 8);
+  // Method – The HTTP request method. For us, this is always 'POST'.
+  const method = options.method;
+  // CanonicalUri – The URI-encoded version of the absolute path component URI, starting with the / that follows the domain name and up to the end of the string
+  // For our requests, this is always '/'
+  const canonicalUri = options.path;
+  // CanonicalQueryString – The URI-encoded query string parameters. For our requests, there are no query string parameters, so this is always an empty string.
+  const canonicalQuerystring = '';
+
+  // CanonicalHeaders – A list of request headers with their values. Individual header name and value pairs are separated by the newline character ("\n").
+  // All of our known/expected headers are included here, there are no extra headers.
+  const headers = new Headers({
+    'content-length': convertHeaderValue(options.headers['Content-Length']),
+    'content-type': convertHeaderValue(options.headers['Content-Type']),
+    host: convertHeaderValue(options.host),
+    'x-amz-date': convertHeaderValue(requestDateTime),
+    'x-mongodb-gs2-cb-flag': convertHeaderValue(options.headers['X-MongoDB-GS2-CB-Flag']),
+    'x-mongodb-server-nonce': convertHeaderValue(options.headers['X-MongoDB-Server-Nonce'])
+  });
+  // If session token is provided, include it in the headers
+  if ('sessionToken' in credentials && credentials.sessionToken) {
+    headers.append('x-amz-security-token', convertHeaderValue(credentials.sessionToken));
+  }
+
+  // Canonical headers are lowercased and sorted.
+  const canonicalHeaders = Array.from(headers.entries())
+    .map(([key, value]) => `${key.toLowerCase()}:${value}`)
+    .sort()
+    .join('\n');
+  const canonicalHeaderNames = Array.from(headers.keys()).map(header => header.toLowerCase());
+  // SignedHeaders – An alphabetically sorted, semicolon-separated list of lowercase request header names.
+  const signedHeaders = canonicalHeaderNames.sort().join(';');
+
+  // HashedPayload – A string created using the payload in the body of the HTTP request as input to a hash function. This string uses lowercase hexadecimal characters.
+  const hashedPayload = await getHexSha256(options.body);
+
+  // CanonicalRequest – A string that includes the above elements, separated by newline characters.
+  const canonicalRequest = [
+    method,
+    canonicalUri,
+    canonicalQuerystring,
+    canonicalHeaders + '\n',
+    signedHeaders,
+    hashedPayload
+  ].join('\n');
+
+  // 2. Create a hash of the canonical request
+  // HashedCanonicalRequest – A string created by using the canonical request as input to a hash function.
+  const hashedCanonicalRequest = await getHexSha256(canonicalRequest);
+
+  // 3. Create a string to sign
+  // Algorithm – The algorithm used to create the hash of the canonical request. For SigV4, use AWS4-HMAC-SHA256.
+  const algorithm = 'AWS4-HMAC-SHA256';
+  // CredentialScope – The credential scope, which restricts the resulting signature to the specified Region and service.
+  // Has the following format: YYYYMMDD/region/service/aws4_request.
+  const credentialScope = `${requestDate}/${options.region}/${options.service}/aws4_request`;
+  // StringToSign – A string that includes the above elements, separated by newline characters.
+  const stringToSign = [algorithm, requestDateTime, credentialScope, hashedCanonicalRequest].join(
+    '\n'
+  );
+
+  // 4. Derive a signing key
+  // To derive a signing key for SigV4, perform a succession of keyed hash operations (HMAC) on the request date, Region, and service, with your AWS secret access key as the key for the initial hashing operation.
+  const dateKey = await getHmacSha256('AWS4' + credentials.secretAccessKey, requestDate);
+  const dateRegionKey = await getHmacSha256(dateKey, options.region);
+  const dateRegionServiceKey = await getHmacSha256(dateRegionKey, options.service);
+  const signingKey = await getHmacSha256(dateRegionServiceKey, 'aws4_request');
+
+  // 5. Calculate the signature
+  const signatureBuffer = await getHmacSha256(signingKey, stringToSign);
+  const signature = BSON.onDemand.ByteUtils.toHex(signatureBuffer);
+
+  // 6. Add the signature to the request
+  // Calculate the Authorization header
+  const authorizationHeader = [
+    'AWS4-HMAC-SHA256 Credential=' + credentials.accessKeyId + '/' + credentialScope,
+    'SignedHeaders=' + signedHeaders,
+    'Signature=' + signature
+  ].join(', ');
+
+  // Return the calculated headers
+  return {
+    Authorization: authorizationHeader,
+    'X-Amz-Date': requestDateTime
+  };
+}

package/src/cmap/auth/aws_temporary_credentials.ts

@@ -0,0 +1,129 @@
+import * as process from 'process';
+
+import { type AWSCredentials, getAwsCredentialProvider } from '../../deps';
+import { MongoAWSError } from '../../error';
+
+/**
+ * @internal
+ * This interface matches the final result of fetching temporary credentials manually, outlined
+ * in the spec [here](https://github.com/mongodb/specifications/blob/master/source/auth/auth.md#ec2-endpoint).
+ *
+ * When we use the AWS SDK, we map the response from the SDK to conform to this interface.
+ */
+export interface AWSTempCredentials {
+  AccessKeyId?: string;
+  SecretAccessKey?: string;
+  Token?: string;
+  RoleArn?: string;
+  Expiration?: Date;
+}
+
+/** @public **/
+export type AWSCredentialProvider = () => Promise<AWSCredentials>;
+
+/** @internal */
+export class AWSSDKCredentialProvider {
+  private static _awsSDK: ReturnType<typeof getAwsCredentialProvider>;
+  private _provider?: AWSCredentialProvider;
+
+  /**
+   * Create the SDK credentials provider.
+   * @param credentialsProvider - The credentials provider.
+   */
+  constructor(credentialsProvider?: AWSCredentialProvider) {
+    if (credentialsProvider) {
+      this._provider = credentialsProvider;
+    }
+  }
+
+  static get awsSDK() {
+    AWSSDKCredentialProvider._awsSDK ??= getAwsCredentialProvider();
+    return AWSSDKCredentialProvider._awsSDK;
+  }
+
+  /**
+   * The AWS SDK caches credentials automatically and handles refresh when the credentials have expired.
+   * To ensure this occurs, we need to cache the `provider` returned by the AWS sdk and re-use it when fetching credentials.
+   */
+  private get provider(): () => Promise<AWSCredentials> {
+    if ('kModuleError' in AWSSDKCredentialProvider.awsSDK) {
+      throw AWSSDKCredentialProvider.awsSDK.kModuleError;
+    }
+    if (this._provider) {
+      return this._provider;
+    }
+    let { AWS_STS_REGIONAL_ENDPOINTS = '', AWS_REGION = '' } = process.env;
+    AWS_STS_REGIONAL_ENDPOINTS = AWS_STS_REGIONAL_ENDPOINTS.toLowerCase();
+    AWS_REGION = AWS_REGION.toLowerCase();
+
+    /** The option setting should work only for users who have explicit settings in their environment, the driver should not encode "defaults" */
+    const awsRegionSettingsExist =
+      AWS_REGION.length !== 0 && AWS_STS_REGIONAL_ENDPOINTS.length !== 0;
+
+    /**
+     * The following regions use the global AWS STS endpoint, sts.amazonaws.com, by default
+     * https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html
+     */
+    const LEGACY_REGIONS = new Set([
+      'ap-northeast-1',
+      'ap-south-1',
+      'ap-southeast-1',
+      'ap-southeast-2',
+      'aws-global',
+      'ca-central-1',
+      'eu-central-1',
+      'eu-north-1',
+      'eu-west-1',
+      'eu-west-2',
+      'eu-west-3',
+      'sa-east-1',
+      'us-east-1',
+      'us-east-2',
+      'us-west-1',
+      'us-west-2'
+    ]);
+    /**
+     * If AWS_STS_REGIONAL_ENDPOINTS is set to regional, users are opting into the new behavior of respecting the region settings
+     *
+     * If AWS_STS_REGIONAL_ENDPOINTS is set to legacy, then "old" regions need to keep using the global setting.
+     * Technically the SDK gets this wrong, it reaches out to 'sts.us-east-1.amazonaws.com' when it should be 'sts.amazonaws.com'.
+     * That is not our bug to fix here. We leave that up to the SDK.
+     */
+    const useRegionalSts =
+      AWS_STS_REGIONAL_ENDPOINTS === 'regional' ||
+      (AWS_STS_REGIONAL_ENDPOINTS === 'legacy' && !LEGACY_REGIONS.has(AWS_REGION));
+
+    this._provider =
+      awsRegionSettingsExist && useRegionalSts
+        ? AWSSDKCredentialProvider.awsSDK.fromNodeProviderChain({
+            clientConfig: { region: AWS_REGION }
+          })
+        : AWSSDKCredentialProvider.awsSDK.fromNodeProviderChain();
+
+    return this._provider;
+  }
+
+  async getCredentials(): Promise<AWSTempCredentials> {
+    /*
+     * Creates a credential provider that will attempt to find credentials from the
+     * following sources (listed in order of precedence):
+     *
+     * - Environment variables exposed via process.env
+     * - SSO credentials from token cache
+     * - Web identity token credentials
+     * - Shared credentials and config ini files
+     * - The EC2/ECS Instance Metadata Service
+     */
+    try {
+      const creds = await this.provider();
+      return {
+        AccessKeyId: creds.accessKeyId,
+        SecretAccessKey: creds.secretAccessKey,
+        Token: creds.sessionToken,
+        Expiration: creds.expiration
+      };
+    } catch (error) {
+      throw new MongoAWSError(error.message, { cause: error });
+    }
+  }
+}

package/src/cmap/auth/gssapi.ts

@@ -0,0 +1,203 @@
+import * as dns from 'dns';
+import * as os from 'os';
+
+import { getKerberos, type Kerberos, type KerberosClient } from '../../deps';
+import { MongoInvalidArgumentError, MongoMissingCredentialsError } from '../../error';
+import { ns } from '../../utils';
+import type { Connection } from '../connection';
+import { type AuthContext, AuthProvider } from './auth_provider';
+
+/** @public */
+export const GSSAPICanonicalizationValue = Object.freeze({
+  on: true,
+  off: false,
+  none: 'none',
+  forward: 'forward',
+  forwardAndReverse: 'forwardAndReverse'
+} as const);
+
+/** @public */
+export type GSSAPICanonicalizationValue =
+  (typeof GSSAPICanonicalizationValue)[keyof typeof GSSAPICanonicalizationValue];
+
+type MechanismProperties = {
+  CANONICALIZE_HOST_NAME?: GSSAPICanonicalizationValue;
+  SERVICE_HOST?: string;
+  SERVICE_NAME?: string;
+  SERVICE_REALM?: string;
+};
+
+async function externalCommand(
+  connection: Connection,
+  command: ReturnType<typeof saslStart> | ReturnType<typeof saslContinue>
+): Promise<{ payload: string; conversationId: number }> {
+  const response = await connection.command(ns('$external.$cmd'), command);
+  return response as { payload: string; conversationId: number };
+}
+
+let krb: Kerberos;
+
+export class GSSAPI extends AuthProvider {
+  override async auth(authContext: AuthContext): Promise<void> {
+    const { connection, credentials } = authContext;
+    if (credentials == null) {
+      throw new MongoMissingCredentialsError('Credentials required for GSSAPI authentication');
+    }
+
+    const { username } = credentials;
+
+    const client = await makeKerberosClient(authContext);
+
+    const payload = await client.step('');
+
+    const saslStartResponse = await externalCommand(connection, saslStart(payload));
+
+    const negotiatedPayload = await negotiate(client, 10, saslStartResponse.payload);
+
+    const saslContinueResponse = await externalCommand(
+      connection,
+      saslContinue(negotiatedPayload, saslStartResponse.conversationId)
+    );
+
+    const finalizePayload = await finalize(client, username, saslContinueResponse.payload);
+
+    await externalCommand(connection, {
+      saslContinue: 1,
+      conversationId: saslContinueResponse.conversationId,
+      payload: finalizePayload
+    });
+  }
+}
+
+async function makeKerberosClient(authContext: AuthContext): Promise<KerberosClient> {
+  const { hostAddress } = authContext.options;
+  const { credentials } = authContext;
+  if (!hostAddress || typeof hostAddress.host !== 'string' || !credentials) {
+    throw new MongoInvalidArgumentError(
+      'Connection must have host and port and credentials defined.'
+    );
+  }
+
+  loadKrb();
+  if ('kModuleError' in krb) {
+    throw krb['kModuleError'];
+  }
+  const { initializeClient } = krb;
+
+  const { username, password } = credentials;
+  const mechanismProperties = credentials.mechanismProperties as MechanismProperties;
+
+  const serviceName = mechanismProperties.SERVICE_NAME ?? 'mongodb';
+
+  const host = await performGSSAPICanonicalizeHostName(hostAddress.host, mechanismProperties);
+
+  const initOptions = {};
+  if (password != null) {
+    // TODO(NODE-5139): These do not match the typescript options in initializeClient
+    Object.assign(initOptions, { user: username, password: password });
+  }
+
+  const spnHost = mechanismProperties.SERVICE_HOST ?? host;
+  let spn = `${serviceName}${os.platform() === 'win32' ? '/' : '@'}${spnHost}`;
+  if ('SERVICE_REALM' in mechanismProperties) {
+    spn = `${spn}@${mechanismProperties.SERVICE_REALM}`;
+  }
+
+  return await initializeClient(spn, initOptions);
+}
+
+function saslStart(payload: string) {
+  return {
+    saslStart: 1,
+    mechanism: 'GSSAPI',
+    payload,
+    autoAuthorize: 1
+  } as const;
+}
+
+function saslContinue(payload: string, conversationId: number) {
+  return {
+    saslContinue: 1,
+    conversationId,
+    payload
+  } as const;
+}
+
+async function negotiate(
+  client: KerberosClient,
+  retries: number,
+  payload: string
+): Promise<string> {
+  try {
+    const response = await client.step(payload);
+    return response || '';
+  } catch (error) {
+    if (retries === 0) {
+      // Retries exhausted, raise error
+      throw error;
+    }
+    // Adjust number of retries and call step again
+    return await negotiate(client, retries - 1, payload);
+  }
+}
+
+async function finalize(client: KerberosClient, user: string, payload: string): Promise<string> {
+  // GSS Client Unwrap
+  const response = await client.unwrap(payload);
+  return await client.wrap(response || '', { user });
+}
+
+export async function performGSSAPICanonicalizeHostName(
+  host: string,
+  mechanismProperties: MechanismProperties
+): Promise<string> {
+  const mode = mechanismProperties.CANONICALIZE_HOST_NAME;
+  if (!mode || mode === GSSAPICanonicalizationValue.none) {
+    return host;
+  }
+
+  // If forward and reverse or true
+  if (
+    mode === GSSAPICanonicalizationValue.on ||
+    mode === GSSAPICanonicalizationValue.forwardAndReverse
+  ) {
+    // Perform the lookup of the ip address.
+    const { address } = await dns.promises.lookup(host);
+
+    try {
+      // Perform a reverse ptr lookup on the ip address.
+      const results = await dns.promises.resolvePtr(address);
+      // If the ptr did not error but had no results, return the host.
+      return results.length > 0 ? results[0] : host;
+    } catch {
+      // This can error as ptr records may not exist for all ips. In this case
+      // fallback to a cname lookup as dns.lookup() does not return the
+      // cname.
+      return await resolveCname(host);
+    }
+  } else {
+    // The case for forward is just to resolve the cname as dns.lookup()
+    // will not return it.
+    return await resolveCname(host);
+  }
+}
+
+export async function resolveCname(host: string): Promise<string> {
+  // Attempt to resolve the host name
+  try {
+    const results = await dns.promises.resolveCname(host);
+    // Get the first resolved host id
+    return results.length > 0 ? results[0] : host;
+  } catch {
+    return host;
+  }
+}
+
+/**
+ * Load the Kerberos library.
+ */
+function loadKrb() {
+  if (!krb) {
+    krb = getKerberos();
+  }
+}