@depup/mongodb 7.1.0-depup.0

package/lib/client-side-encryption/state_machine.js

@@ -0,0 +1,427 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StateMachine = void 0;
+const fs = require("fs/promises");
+const net = require("net");
+const process = require("process");
+const tls = require("tls");
+const bson_1 = require("../bson");
+const abstract_cursor_1 = require("../cursor/abstract_cursor");
+const deps_1 = require("../deps");
+const error_1 = require("../error");
+const timeout_1 = require("../timeout");
+const utils_1 = require("../utils");
+const client_encryption_1 = require("./client_encryption");
+const errors_1 = require("./errors");
+let socks = null;
+function loadSocks() {
+    if (socks == null) {
+        const socksImport = (0, deps_1.getSocks)();
+        if ('kModuleError' in socksImport) {
+            throw socksImport.kModuleError;
+        }
+        socks = socksImport;
+    }
+    return socks;
+}
+// libmongocrypt states
+const MONGOCRYPT_CTX_ERROR = 0;
+const MONGOCRYPT_CTX_NEED_MONGO_COLLINFO = 1;
+const MONGOCRYPT_CTX_NEED_MONGO_MARKINGS = 2;
+const MONGOCRYPT_CTX_NEED_MONGO_KEYS = 3;
+const MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS = 7;
+const MONGOCRYPT_CTX_NEED_KMS = 4;
+const MONGOCRYPT_CTX_READY = 5;
+const MONGOCRYPT_CTX_DONE = 6;
+const HTTPS_PORT = 443;
+const stateToString = new Map([
+    [MONGOCRYPT_CTX_ERROR, 'MONGOCRYPT_CTX_ERROR'],
+    [MONGOCRYPT_CTX_NEED_MONGO_COLLINFO, 'MONGOCRYPT_CTX_NEED_MONGO_COLLINFO'],
+    [MONGOCRYPT_CTX_NEED_MONGO_MARKINGS, 'MONGOCRYPT_CTX_NEED_MONGO_MARKINGS'],
+    [MONGOCRYPT_CTX_NEED_MONGO_KEYS, 'MONGOCRYPT_CTX_NEED_MONGO_KEYS'],
+    [MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS, 'MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS'],
+    [MONGOCRYPT_CTX_NEED_KMS, 'MONGOCRYPT_CTX_NEED_KMS'],
+    [MONGOCRYPT_CTX_READY, 'MONGOCRYPT_CTX_READY'],
+    [MONGOCRYPT_CTX_DONE, 'MONGOCRYPT_CTX_DONE']
+]);
+const INSECURE_TLS_OPTIONS = [
+    'tlsInsecure',
+    'tlsAllowInvalidCertificates',
+    'tlsAllowInvalidHostnames'
+];
+/**
+ * Helper function for logging. Enabled by setting the environment flag MONGODB_CRYPT_DEBUG.
+ * @param msg - Anything you want to be logged.
+ */
+function debug(msg) {
+    if (process.env.MONGODB_CRYPT_DEBUG) {
+        // eslint-disable-next-line no-console
+        console.error(msg);
+    }
+}
+/**
+ * This is kind of a hack.  For `rewrapManyDataKey`, we have tests that
+ * guarantee that when there are no matching keys, `rewrapManyDataKey` returns
+ * nothing.  We also have tests for auto encryption that guarantee for `encrypt`
+ * we return an error when there are no matching keys.  This error is generated in
+ * subsequent iterations of the state machine.
+ * Some apis (`encrypt`) throw if there are no filter matches and others (`rewrapManyDataKey`)
+ * do not.  We set the result manually here, and let the state machine continue.  `libmongocrypt`
+ * will inform us if we need to error by setting the state to `MONGOCRYPT_CTX_ERROR` but
+ * otherwise we'll return `{ v: [] }`.
+ */
+let EMPTY_V;
+/**
+ * @internal
+ * An internal class that executes across a MongoCryptContext until either
+ * a finishing state or an error is reached. Do not instantiate directly.
+ */
+// TODO(DRIVERS-2671): clarify CSOT behavior for FLE APIs
+class StateMachine {
+    constructor(options, bsonOptions = (0, bson_1.pluckBSONSerializeOptions)(options)) {
+        this.options = options;
+        this.bsonOptions = bsonOptions;
+    }
+    /**
+     * Executes the state machine according to the specification
+     */
+    async execute(executor, context, options) {
+        const keyVaultNamespace = executor._keyVaultNamespace;
+        const keyVaultClient = executor._keyVaultClient;
+        const metaDataClient = executor._metaDataClient;
+        const mongocryptdClient = executor._mongocryptdClient;
+        const mongocryptdManager = executor._mongocryptdManager;
+        let result = null;
+        // Typescript treats getters just like properties: Once you've tested it for equality
+        // it cannot change. Which is exactly the opposite of what we use state and status for.
+        // Every call to at least `addMongoOperationResponse` and `finalize` can change the state.
+        // These wrappers let us write code more naturally and not add compiler exceptions
+        // to conditions checks inside the state machine.
+        const getStatus = () => context.status;
+        const getState = () => context.state;
+        while (getState() !== MONGOCRYPT_CTX_DONE && getState() !== MONGOCRYPT_CTX_ERROR) {
+            options.signal?.throwIfAborted();
+            debug(`[context#${context.id}] ${stateToString.get(getState()) || getState()}`);
+            switch (getState()) {
+                case MONGOCRYPT_CTX_NEED_MONGO_COLLINFO: {
+                    const filter = (0, bson_1.deserialize)(context.nextMongoOperation());
+                    if (!metaDataClient) {
+                        throw new errors_1.MongoCryptError('unreachable state machine state: entered MONGOCRYPT_CTX_NEED_MONGO_COLLINFO but metadata client is undefined');
+                    }
+                    const collInfoCursor = this.fetchCollectionInfo(metaDataClient, context.ns, filter, options);
+                    for await (const collInfo of collInfoCursor) {
+                        context.addMongoOperationResponse((0, bson_1.serialize)(collInfo));
+                        if (getState() === MONGOCRYPT_CTX_ERROR)
+                            break;
+                    }
+                    if (getState() === MONGOCRYPT_CTX_ERROR)
+                        break;
+                    context.finishMongoOperation();
+                    break;
+                }
+                case MONGOCRYPT_CTX_NEED_MONGO_MARKINGS: {
+                    const command = context.nextMongoOperation();
+                    if (getState() === MONGOCRYPT_CTX_ERROR)
+                        break;
+                    if (!mongocryptdClient) {
+                        throw new errors_1.MongoCryptError('unreachable state machine state: entered MONGOCRYPT_CTX_NEED_MONGO_MARKINGS but mongocryptdClient is undefined');
+                    }
+                    // When we are using the shared library, we don't have a mongocryptd manager.
+                    const markedCommand = mongocryptdManager
+                        ? await mongocryptdManager.withRespawn(this.markCommand.bind(this, mongocryptdClient, context.ns, command, options))
+                        : await this.markCommand(mongocryptdClient, context.ns, command, options);
+                    context.addMongoOperationResponse(markedCommand);
+                    context.finishMongoOperation();
+                    break;
+                }
+                case MONGOCRYPT_CTX_NEED_MONGO_KEYS: {
+                    const filter = context.nextMongoOperation();
+                    const keys = await this.fetchKeys(keyVaultClient, keyVaultNamespace, filter, options);
+                    if (keys.length === 0) {
+                        // See docs on EMPTY_V
+                        result = EMPTY_V ??= (0, bson_1.serialize)({ v: [] });
+                    }
+                    for (const key of keys) {
+                        context.addMongoOperationResponse((0, bson_1.serialize)(key));
+                    }
+                    context.finishMongoOperation();
+                    break;
+                }
+                case MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS: {
+                    const kmsProviders = await executor.askForKMSCredentials();
+                    context.provideKMSProviders((0, bson_1.serialize)(kmsProviders));
+                    break;
+                }
+                case MONGOCRYPT_CTX_NEED_KMS: {
+                    await Promise.all(this.requests(context, options));
+                    context.finishKMSRequests();
+                    break;
+                }
+                case MONGOCRYPT_CTX_READY: {
+                    const finalizedContext = context.finalize();
+                    if (getState() === MONGOCRYPT_CTX_ERROR) {
+                        const message = getStatus().message || 'Finalization error';
+                        throw new errors_1.MongoCryptError(message);
+                    }
+                    result = finalizedContext;
+                    break;
+                }
+                default:
+                    throw new errors_1.MongoCryptError(`Unknown state: ${getState()}`);
+            }
+        }
+        if (getState() === MONGOCRYPT_CTX_ERROR || result == null) {
+            const message = getStatus().message;
+            if (!message) {
+                debug(`unidentifiable error in MongoCrypt - received an error status from \`libmongocrypt\` but received no error message.`);
+            }
+            throw new errors_1.MongoCryptError(message ??
+                'unidentifiable error in MongoCrypt - received an error status from `libmongocrypt` but received no error message.');
+        }
+        return result;
+    }
+    /**
+     * Handles the request to the KMS service. Exposed for testing purposes. Do not directly invoke.
+     * @param kmsContext - A C++ KMS context returned from the bindings
+     * @returns A promise that resolves when the KMS reply has be fully parsed
+     */
+    async kmsRequest(request, options) {
+        const parsedUrl = request.endpoint.split(':');
+        const port = parsedUrl[1] != null ? Number.parseInt(parsedUrl[1], 10) : HTTPS_PORT;
+        const socketOptions = {
+            host: parsedUrl[0],
+            servername: parsedUrl[0],
+            port,
+            ...(0, client_encryption_1.autoSelectSocketOptions)(this.options.socketOptions || {})
+        };
+        const message = request.message;
+        const buffer = new utils_1.BufferPool();
+        let netSocket;
+        let socket;
+        function destroySockets() {
+            for (const sock of [socket, netSocket]) {
+                if (sock) {
+                    sock.destroy();
+                }
+            }
+        }
+        function onerror(cause) {
+            return new errors_1.MongoCryptError('KMS request failed', { cause });
+        }
+        function onclose() {
+            return new errors_1.MongoCryptError('KMS request closed');
+        }
+        const tlsOptions = this.options.tlsOptions;
+        if (tlsOptions) {
+            const kmsProvider = request.kmsProvider;
+            const providerTlsOptions = tlsOptions[kmsProvider];
+            if (providerTlsOptions) {
+                const error = this.validateTlsOptions(kmsProvider, providerTlsOptions);
+                if (error) {
+                    throw error;
+                }
+                try {
+                    await this.setTlsOptions(providerTlsOptions, socketOptions);
+                }
+                catch (err) {
+                    throw onerror(err);
+                }
+            }
+        }
+        let abortListener;
+        try {
+            if (this.options.proxyOptions && this.options.proxyOptions.proxyHost) {
+                netSocket = new net.Socket();
+                const { promise: willConnect, reject: rejectOnNetSocketError, resolve: resolveOnNetSocketConnect } = (0, utils_1.promiseWithResolvers)();
+                netSocket
+                    .once('error', err => rejectOnNetSocketError(onerror(err)))
+                    .once('close', () => rejectOnNetSocketError(onclose()))
+                    .once('connect', () => resolveOnNetSocketConnect());
+                const netSocketOptions = {
+                    ...socketOptions,
+                    host: this.options.proxyOptions.proxyHost,
+                    port: this.options.proxyOptions.proxyPort || 1080
+                };
+                netSocket.connect(netSocketOptions);
+                await willConnect;
+                try {
+                    socks ??= loadSocks();
+                    socketOptions.socket = (await socks.SocksClient.createConnection({
+                        existing_socket: netSocket,
+                        command: 'connect',
+                        destination: { host: socketOptions.host, port: socketOptions.port },
+                        proxy: {
+                            // host and port are ignored because we pass existing_socket
+                            host: 'iLoveJavaScript',
+                            port: 0,
+                            type: 5,
+                            userId: this.options.proxyOptions.proxyUsername,
+                            password: this.options.proxyOptions.proxyPassword
+                        }
+                    })).socket;
+                }
+                catch (err) {
+                    throw onerror(err);
+                }
+            }
+            socket = tls.connect(socketOptions, () => {
+                socket.write(message);
+            });
+            const { promise: willResolveKmsRequest, reject: rejectOnTlsSocketError, resolve } = (0, utils_1.promiseWithResolvers)();
+            abortListener = (0, utils_1.addAbortListener)(options?.signal, function () {
+                destroySockets();
+                rejectOnTlsSocketError(this.reason);
+            });
+            socket
+                .once('error', err => rejectOnTlsSocketError(onerror(err)))
+                .once('close', () => rejectOnTlsSocketError(onclose()))
+                .on('data', data => {
+                buffer.append(data);
+                while (request.bytesNeeded > 0 && buffer.length) {
+                    const bytesNeeded = Math.min(request.bytesNeeded, buffer.length);
+                    request.addResponse(buffer.read(bytesNeeded));
+                }
+                if (request.bytesNeeded <= 0) {
+                    resolve();
+                }
+            });
+            await (options?.timeoutContext?.csotEnabled()
+                ? Promise.all([
+                    willResolveKmsRequest,
+                    timeout_1.Timeout.expires(options.timeoutContext?.remainingTimeMS)
+                ])
+                : willResolveKmsRequest);
+        }
+        catch (error) {
+            if (error instanceof timeout_1.TimeoutError)
+                throw new error_1.MongoOperationTimeoutError('KMS request timed out');
+            throw error;
+        }
+        finally {
+            // There's no need for any more activity on this socket at this point.
+            destroySockets();
+            abortListener?.[utils_1.kDispose]();
+        }
+    }
+    *requests(context, options) {
+        for (let request = context.nextKMSRequest(); request != null; request = context.nextKMSRequest()) {
+            yield this.kmsRequest(request, options);
+        }
+    }
+    /**
+     * Validates the provided TLS options are secure.
+     *
+     * @param kmsProvider - The KMS provider name.
+     * @param tlsOptions - The client TLS options for the provider.
+     *
+     * @returns An error if any option is invalid.
+     */
+    validateTlsOptions(kmsProvider, tlsOptions) {
+        const tlsOptionNames = Object.keys(tlsOptions);
+        for (const option of INSECURE_TLS_OPTIONS) {
+            if (tlsOptionNames.includes(option)) {
+                return new errors_1.MongoCryptError(`Insecure TLS options prohibited for ${kmsProvider}: ${option}`);
+            }
+        }
+    }
+    /**
+     * Sets only the valid secure TLS options.
+     *
+     * @param tlsOptions - The client TLS options for the provider.
+     * @param options - The existing connection options.
+     */
+    async setTlsOptions(tlsOptions, options) {
+        // If a secureContext is provided, ensure it is set.
+        if (tlsOptions.secureContext) {
+            options.secureContext = tlsOptions.secureContext;
+        }
+        if (tlsOptions.tlsCertificateKeyFile) {
+            const cert = await fs.readFile(tlsOptions.tlsCertificateKeyFile);
+            options.cert = options.key = cert;
+        }
+        if (tlsOptions.tlsCAFile) {
+            options.ca = await fs.readFile(tlsOptions.tlsCAFile);
+        }
+        if (tlsOptions.tlsCertificateKeyFilePassword) {
+            options.passphrase = tlsOptions.tlsCertificateKeyFilePassword;
+        }
+    }
+    /**
+     * Fetches collection info for a provided namespace, when libmongocrypt
+     * enters the `MONGOCRYPT_CTX_NEED_MONGO_COLLINFO` state. The result is
+     * used to inform libmongocrypt of the schema associated with this
+     * namespace. Exposed for testing purposes. Do not directly invoke.
+     *
+     * @param client - A MongoClient connected to the topology
+     * @param ns - The namespace to list collections from
+     * @param filter - A filter for the listCollections command
+     * @param callback - Invoked with the info of the requested collection, or with an error
+     */
+    fetchCollectionInfo(client, ns, filter, options) {
+        const { db } = utils_1.MongoDBCollectionNamespace.fromString(ns);
+        const cursor = client.db(db).listCollections(filter, {
+            promoteLongs: false,
+            promoteValues: false,
+            timeoutContext: options?.timeoutContext && new abstract_cursor_1.CursorTimeoutContext(options?.timeoutContext, Symbol()),
+            signal: options?.signal,
+            nameOnly: false
+        });
+        return cursor;
+    }
+    /**
+     * Calls to the mongocryptd to provide markings for a command.
+     * Exposed for testing purposes. Do not directly invoke.
+     * @param client - A MongoClient connected to a mongocryptd
+     * @param ns - The namespace (database.collection) the command is being executed on
+     * @param command - The command to execute.
+     * @param callback - Invoked with the serialized and marked bson command, or with an error
+     */
+    async markCommand(client, ns, command, options) {
+        const { db } = utils_1.MongoDBCollectionNamespace.fromString(ns);
+        const bsonOptions = { promoteLongs: false, promoteValues: false };
+        const rawCommand = (0, bson_1.deserialize)(command, bsonOptions);
+        const commandOptions = {
+            timeoutMS: undefined,
+            signal: undefined
+        };
+        if (options?.timeoutContext?.csotEnabled()) {
+            commandOptions.timeoutMS = options.timeoutContext.remainingTimeMS;
+        }
+        if (options?.signal) {
+            commandOptions.signal = options.signal;
+        }
+        const response = await client.db(db).command(rawCommand, {
+            ...bsonOptions,
+            ...commandOptions
+        });
+        return (0, bson_1.serialize)(response, this.bsonOptions);
+    }
+    /**
+     * Requests keys from the keyVault collection on the topology.
+     * Exposed for testing purposes. Do not directly invoke.
+     * @param client - A MongoClient connected to the topology
+     * @param keyVaultNamespace - The namespace (database.collection) of the keyVault Collection
+     * @param filter - The filter for the find query against the keyVault Collection
+     * @param callback - Invoked with the found keys, or with an error
+     */
+    fetchKeys(client, keyVaultNamespace, filter, options) {
+        const { db: dbName, collection: collectionName } = utils_1.MongoDBCollectionNamespace.fromString(keyVaultNamespace);
+        const commandOptions = {
+            timeoutContext: undefined,
+            signal: undefined
+        };
+        if (options?.timeoutContext != null) {
+            commandOptions.timeoutContext = new abstract_cursor_1.CursorTimeoutContext(options.timeoutContext, Symbol());
+        }
+        if (options?.signal != null) {
+            commandOptions.signal = options.signal;
+        }
+        return client
+            .db(dbName)
+            .collection(collectionName, { readConcern: { level: 'majority' } })
+            .find((0, bson_1.deserialize)(filter), commandOptions)
+            .toArray();
+    }
+}
+exports.StateMachine = StateMachine;
+//# sourceMappingURL=state_machine.js.map

package/lib/client-side-encryption/state_machine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state_machine.js","sourceRoot":"","sources":["../../src/client-side-encryption/state_machine.ts"],"names":[],"mappings":";;;AAAA,kCAAkC;AAElC,2BAA2B;AAC3B,mCAAmC;AACnC,2BAA2B;AAE3B,kCAMiB;AAEjB,+DAAiE;AACjE,kCAAkD;AAClD,oCAAsD;AAItD,wCAAwE;AACxE,oCAMkB;AAClB,2DAA4E;AAC5E,qCAA2C;AAI3C,IAAI,KAAK,GAAoB,IAAI,CAAC;AAClC,SAAS,SAAS;IAChB,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,IAAA,eAAQ,GAAE,CAAC;QAC/B,IAAI,cAAc,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,WAAW,CAAC,YAAY,CAAC;QACjC,CAAC;QACD,KAAK,GAAG,WAAW,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uBAAuB;AACvB,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,kCAAkC,GAAG,CAAC,CAAC;AAC7C,MAAM,kCAAkC,GAAG,CAAC,CAAC;AAC7C,MAAM,8BAA8B,GAAG,CAAC,CAAC;AACzC,MAAM,mCAAmC,GAAG,CAAC,CAAC;AAC9C,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;IAC9C,CAAC,kCAAkC,EAAE,oCAAoC,CAAC;IAC1E,CAAC,kCAAkC,EAAE,oCAAoC,CAAC;IAC1E,CAAC,8BAA8B,EAAE,gCAAgC,CAAC;IAClE,CAAC,mCAAmC,EAAE,qCAAqC,CAAC;IAC5E,CAAC,uBAAuB,EAAE,yBAAyB,CAAC;IACpD,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;IAC9C,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;CAC7C,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG;IAC3B,aAAa;IACb,6BAA6B;IAC7B,0BAA0B;CAC3B,CAAC;AAEF;;;GAGG;AACH,SAAS,KAAK,CAAC,GAAY;IACzB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;QACpC,sCAAsC;QACtC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAkDD;;;;;;;;;;GAUG;AACH,IAAI,OAAO,CAAC;AAiCZ;;;;GAIG;AACH,yDAAyD;AACzD,MAAa,YAAY;IAIvB,YAAY,OAA4B,EAAE,WAAW,GAAG,IAAA,gCAAyB,EAAC,OAAO,CAAC;QACxF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,QAAgC,EAChC,OAA0B,EAC1B,OAAwD;QAExD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,kBAAkB,CAAC;QACtD,MAAM,cAAc,GAAG,QAAQ,CAAC,eAAe,CAAC;QAChD,MAAM,cAAc,GAAG,QAAQ,CAAC,eAAe,CAAC;QAChD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,kBAAkB,CAAC;QACtD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;QACxD,IAAI,MAAM,GAAsB,IAAI,CAAC;QAErC,qFAAqF;QACrF,uFAAuF;QACvF,0FAA0F;QAC1F,kFAAkF;QAClF,iDAAiD;QACjD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;QACvC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAErC,OAAO,QAAQ,EAAE,KAAK,mBAAmB,IAAI,QAAQ,EAAE,KAAK,oBAAoB,EAAE,CAAC;YACjF,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,KAAK,CAAC,YAAY,OAAO,CAAC,EAAE,KAAK,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,QAAQ,EAAE,EAAE,CAAC,CAAC;YAEhF,QAAQ,QAAQ,EAAE,EAAE,CAAC;gBACnB,KAAK,kCAAkC,CAAC,CAAC,CAAC;oBACxC,MAAM,MAAM,GAAG,IAAA,kBAAW,EAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;oBACzD,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,MAAM,IAAI,wBAAe,CACvB,8GAA8G,CAC/G,CAAC;oBACJ,CAAC;oBAED,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAC7C,cAAc,EACd,OAAO,CAAC,EAAE,EACV,MAAM,EACN,OAAO,CACR,CAAC;oBAEF,IAAI,KAAK,EAAE,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;wBAC5C,OAAO,CAAC,yBAAyB,CAAC,IAAA,gBAAS,EAAC,QAAQ,CAAC,CAAC,CAAC;wBACvD,IAAI,QAAQ,EAAE,KAAK,oBAAoB;4BAAE,MAAM;oBACjD,CAAC;oBAED,IAAI,QAAQ,EAAE,KAAK,oBAAoB;wBAAE,MAAM;oBAE/C,OAAO,CAAC,oBAAoB,EAAE,CAAC;oBAC/B,MAAM;gBACR,CAAC;gBAED,KAAK,kCAAkC,CAAC,CAAC,CAAC;oBACxC,MAAM,OAAO,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;oBAC7C,IAAI,QAAQ,EAAE,KAAK,oBAAoB;wBAAE,MAAM;oBAE/C,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,MAAM,IAAI,wBAAe,CACvB,gHAAgH,CACjH,CAAC;oBACJ,CAAC;oBAED,6EAA6E;oBAC7E,MAAM,aAAa,GAAe,kBAAkB;wBAClD,CAAC,CAAC,MAAM,kBAAkB,CAAC,WAAW,CAClC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAC7E;wBACH,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;oBAE5E,OAAO,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAC;oBACjD,OAAO,CAAC,oBAAoB,EAAE,CAAC;oBAC/B,MAAM;gBACR,CAAC;gBAED,KAAK,8BAA8B,CAAC,CAAC,CAAC;oBACpC,MAAM,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;oBAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;oBAEtF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACtB,sBAAsB;wBACtB,MAAM,GAAG,OAAO,KAAK,IAAA,gBAAS,EAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC5C,CAAC;oBACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;wBACvB,OAAO,CAAC,yBAAyB,CAAC,IAAA,gBAAS,EAAC,GAAG,CAAC,CAAC,CAAC;oBACpD,CAAC;oBAED,OAAO,CAAC,oBAAoB,EAAE,CAAC;oBAE/B,MAAM;gBACR,CAAC;gBAED,KAAK,mCAAmC,CAAC,CAAC,CAAC;oBACzC,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,oBAAoB,EAAE,CAAC;oBAC3D,OAAO,CAAC,mBAAmB,CAAC,IAAA,gBAAS,EAAC,YAAY,CAAC,CAAC,CAAC;oBACrD,MAAM;gBACR,CAAC;gBAED,KAAK,uBAAuB,CAAC,CAAC,CAAC;oBAC7B,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;oBACnD,OAAO,CAAC,iBAAiB,EAAE,CAAC;oBAC5B,MAAM;gBACR,CAAC;gBAED,KAAK,oBAAoB,CAAC,CAAC,CAAC;oBAC1B,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;oBAC5C,IAAI,QAAQ,EAAE,KAAK,oBAAoB,EAAE,CAAC;wBACxC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC,OAAO,IAAI,oBAAoB,CAAC;wBAC5D,MAAM,IAAI,wBAAe,CAAC,OAAO,CAAC,CAAC;oBACrC,CAAC;oBACD,MAAM,GAAG,gBAAgB,CAAC;oBAC1B,MAAM;gBACR,CAAC;gBAED;oBACE,MAAM,IAAI,wBAAe,CAAC,kBAAkB,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,EAAE,KAAK,oBAAoB,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC,OAAO,CAAC;YACpC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,KAAK,CACH,qHAAqH,CACtH,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,wBAAe,CACvB,OAAO;gBACL,mHAAmH,CACtH,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CACd,OAA6B,EAC7B,OAAyD;QAEzD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QACnF,MAAM,aAAa,GAKf;YACF,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;YAClB,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;YACxB,IAAI;YACJ,GAAG,IAAA,2CAAuB,EAAC,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;SAC7D,CAAC;QACF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,kBAAU,EAAE,CAAC;QAEhC,IAAI,SAAqB,CAAC;QAC1B,IAAI,MAAqB,CAAC;QAE1B,SAAS,cAAc;YACrB,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;gBACvC,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QAED,SAAS,OAAO,CAAC,KAAY;YAC3B,OAAO,IAAI,wBAAe,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,SAAS,OAAO;YACd,OAAO,IAAI,wBAAe,CAAC,oBAAoB,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QAC3C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;YACxC,MAAM,kBAAkB,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;gBACvE,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;gBAC9D,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,aAAa,CAAC;QAElB,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;gBACrE,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBAE7B,MAAM,EACJ,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,yBAAyB,EACnC,GAAG,IAAA,4BAAoB,GAAQ,CAAC;gBAEjC,SAAS;qBACN,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;qBAC1D,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,CAAC,CAAC;qBACtD,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,yBAAyB,EAAE,CAAC,CAAC;gBAEtD,MAAM,gBAAgB,GAAG;oBACvB,GAAG,aAAa;oBAChB,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS;oBACzC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,IAAI,IAAI;iBAClD,CAAC;gBAEF,SAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;gBAEpC,MAAM,WAAW,CAAC;gBAElB,IAAI,CAAC;oBACH,KAAK,KAAK,SAAS,EAAE,CAAC;oBACtB,aAAa,CAAC,MAAM,GAAG,CACrB,MAAM,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC;wBACvC,eAAe,EAAE,SAAS;wBAC1B,OAAO,EAAE,SAAS;wBAClB,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE;wBACnE,KAAK,EAAE;4BACL,4DAA4D;4BAC5D,IAAI,EAAE,iBAAiB;4BACvB,IAAI,EAAE,CAAC;4BACP,IAAI,EAAE,CAAC;4BACP,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa;4BAC/C,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa;yBAClD;qBACF,CAAC,CACH,CAAC,MAAM,CAAC;gBACX,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;YAED,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE;gBACvC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;YAEH,MAAM,EACJ,OAAO,EAAE,qBAAqB,EAC9B,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EACR,GAAG,IAAA,4BAAoB,GAAQ,CAAC;YAEjC,aAAa,GAAG,IAAA,wBAAgB,EAAC,OAAO,EAAE,MAAM,EAAE;gBAChD,cAAc,EAAE,CAAC;gBACjB,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC;YAEH,MAAM;iBACH,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;iBAC1D,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,CAAC,CAAC;iBACtD,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACpB,OAAO,OAAO,CAAC,WAAW,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBAChD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;oBACjE,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBAChD,CAAC;gBAED,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC;oBAC7B,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;YACL,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE;gBAC3C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;oBACV,qBAAqB;oBACrB,iBAAO,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,eAAe,CAAC;iBACzD,CAAC;gBACJ,CAAC,CAAC,qBAAqB,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAY;gBAC/B,MAAM,IAAI,kCAA0B,CAAC,uBAAuB,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,sEAAsE;YACtE,cAAc,EAAE,CAAC;YACjB,aAAa,EAAE,CAAC,gBAAQ,CAAC,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,CAAC,QAAQ,CAAC,OAA0B,EAAE,OAAyD;QAC7F,KACE,IAAI,OAAO,GAAG,OAAO,CAAC,cAAc,EAAE,EACtC,OAAO,IAAI,IAAI,EACf,OAAO,GAAG,OAAO,CAAC,cAAc,EAAE,EAClC,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAChB,WAAmB,EACnB,UAAsC;QAEtC,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;YAC1C,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,OAAO,IAAI,wBAAe,CAAC,uCAAuC,WAAW,KAAK,MAAM,EAAE,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CACjB,UAAsC,EACtC,OAA8B;QAE9B,oDAAoD;QACpD,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC7B,OAAO,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QACnD,CAAC;QACD,IAAI,UAAU,CAAC,qBAAqB,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;QACpC,CAAC;QACD,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,UAAU,CAAC,6BAA6B,EAAE,CAAC;YAC7C,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC,6BAA6B,CAAC;QAChE,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,mBAAmB,CACjB,MAAmB,EACnB,EAAU,EACV,MAAgB,EAChB,OAAyD;QAEzD,MAAM,EAAE,EAAE,EAAE,GAAG,kCAA0B,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAEzD,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE;YACnD,YAAY,EAAE,KAAK;YACnB,aAAa,EAAE,KAAK;YACpB,cAAc,EACZ,OAAO,EAAE,cAAc,IAAI,IAAI,sCAAoB,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;YACxF,MAAM,EAAE,OAAO,EAAE,MAAM;YACvB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,WAAW,CACf,MAAmB,EACnB,EAAU,EACV,OAAmB,EACnB,OAAyD;QAEzD,MAAM,EAAE,EAAE,EAAE,GAAG,kCAA0B,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAClE,MAAM,UAAU,GAAG,IAAA,kBAAW,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAErD,MAAM,cAAc,GAGhB;YACF,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,SAAS;SAClB,CAAC;QAEF,IAAI,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,CAAC;YAC3C,cAAc,CAAC,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,eAAe,CAAC;QACpE,CAAC;QACD,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE;YACvD,GAAG,WAAW;YACd,GAAG,cAAc;SAClB,CAAC,CAAC;QAEH,OAAO,IAAA,gBAAS,EAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CACP,MAAmB,EACnB,iBAAyB,EACzB,MAAkB,EAClB,OAAyD;QAEzD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAC9C,kCAA0B,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAE3D,MAAM,cAAc,GAGhB;YACF,cAAc,EAAE,SAAS;YACzB,MAAM,EAAE,SAAS;SAClB,CAAC;QAEF,IAAI,OAAO,EAAE,cAAc,IAAI,IAAI,EAAE,CAAC;YACpC,cAAc,CAAC,cAAc,GAAG,IAAI,sCAAoB,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,OAAO,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;YAC5B,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACzC,CAAC;QAED,OAAO,MAAM;aACV,EAAE,CAAC,MAAM,CAAC;aACV,UAAU,CAAU,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;aAC3E,IAAI,CAAC,IAAA,kBAAW,EAAC,MAAM,CAAC,EAAE,cAAc,CAAC;aACzC,OAAO,EAAE,CAAC;IACf,CAAC;CACF;AAndD,oCAmdC"}

package/lib/cmap/auth/auth_provider.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthProvider = exports.AuthContext = void 0;
+const error_1 = require("../../error");
+/**
+ * Context used during authentication
+ * @internal
+ */
+class AuthContext {
+    constructor(connection, credentials, options) {
+        /** If the context is for reauthentication. */
+        this.reauthenticating = false;
+        this.connection = connection;
+        this.credentials = credentials;
+        this.options = options;
+    }
+}
+exports.AuthContext = AuthContext;
+/**
+ * Provider used during authentication.
+ * @internal
+ */
+class AuthProvider {
+    /**
+     * Prepare the handshake document before the initial handshake.
+     *
+     * @param handshakeDoc - The document used for the initial handshake on a connection
+     * @param authContext - Context for authentication flow
+     */
+    async prepare(handshakeDoc, _authContext) {
+        return handshakeDoc;
+    }
+    /**
+     * Reauthenticate.
+     * @param context - The shared auth context.
+     */
+    async reauth(context) {
+        if (context.reauthenticating) {
+            throw new error_1.MongoRuntimeError('Reauthentication already in progress.');
+        }
+        try {
+            context.reauthenticating = true;
+            await this.auth(context);
+        }
+        finally {
+            context.reauthenticating = false;
+        }
+    }
+}
+exports.AuthProvider = AuthProvider;
+//# sourceMappingURL=auth_provider.js.map

package/lib/cmap/auth/auth_provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth_provider.js","sourceRoot":"","sources":["../../../src/cmap/auth/auth_provider.ts"],"names":[],"mappings":";;;AACA,uCAAgD;AAKhD;;;GAGG;AACH,MAAa,WAAW;IAetB,YACE,UAAsB,EACtB,WAAyC,EACzC,OAA0B;QAb5B,8CAA8C;QAC9C,qBAAgB,GAAG,KAAK,CAAC;QAcvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAxBD,kCAwBC;AAED;;;GAGG;AACH,MAAsB,YAAY;IAChC;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CACX,YAA+B,EAC/B,YAAyB;QAEzB,OAAO,YAAY,CAAC;IACtB,CAAC;IASD;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,OAAoB;QAC/B,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7B,MAAM,IAAI,yBAAiB,CAAC,uCAAuC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAChC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,gBAAgB,GAAG,KAAK,CAAC;QACnC,CAAC;IACH,CAAC;CACF;AApCD,oCAoCC"}

package/lib/cmap/auth/aws4.js

@@ -0,0 +1,161 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.aws4Sign = aws4Sign;
+const bson_1 = require("../../bson");
+/**
+ * Calculates the SHA-256 hash of a string.
+ *
+ * @param str - String to hash.
+ * @returns Hexadecimal representation of the hash.
+ */
+const getHexSha256 = async (str) => {
+    const data = stringToBuffer(str);
+    const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+    const hashHex = bson_1.BSON.onDemand.ByteUtils.toHex(new Uint8Array(hashBuffer));
+    return hashHex;
+};
+/**
+ * Calculates the HMAC-SHA256 of a string using the provided key.
+ * @param key - Key to use for HMAC calculation. Can be a string or Uint8Array.
+ * @param str - String to calculate HMAC for.
+ * @returns Uint8Array containing the HMAC-SHA256 digest.
+ */
+const getHmacSha256 = async (key, str) => {
+    let keyData;
+    if (typeof key === 'string') {
+        keyData = stringToBuffer(key);
+    }
+    else {
+        keyData = key;
+    }
+    const importedKey = await crypto.subtle.importKey('raw', keyData, { name: 'HMAC', hash: { name: 'SHA-256' } }, false, ['sign']);
+    const strData = stringToBuffer(str);
+    const signature = await crypto.subtle.sign('HMAC', importedKey, strData);
+    const digest = new Uint8Array(signature);
+    return digest;
+};
+/**
+ * Converts header values according to AWS requirements,
+ * From https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html#create-canonical-request
+ * For values, you must:
+    - trim any leading or trailing spaces.
+    - convert sequential spaces to a single space.
+ * @param value - Header value to convert.
+ * @returns - Converted header value.
+ */
+const convertHeaderValue = (value) => {
+    return value.toString().trim().replace(/\s+/g, ' ');
+};
+/**
+ * Returns a Uint8Array representation of a string, encoded in UTF-8.
+ * @param str - String to convert.
+ * @returns Uint8Array containing the UTF-8 encoded string.
+ */
+function stringToBuffer(str) {
+    const data = new Uint8Array(bson_1.BSON.onDemand.ByteUtils.utf8ByteLength(str));
+    bson_1.BSON.onDemand.ByteUtils.encodeUTF8Into(data, str, 0);
+    return data;
+}
+/**
+ * This method implements AWS Signature 4 logic for a very specific request format.
+ * The signing logic is described here: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
+ */
+async function aws4Sign(options, credentials) {
+    /**
+     * From the spec: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
+     *
+     * Summary of signing steps
+     * 1. Create a canonical request
+     *    Arrange the contents of your request (host, action, headers, etc.) into a standard canonical format. The canonical request is one of the inputs used to create the string to sign.
+     * 2. Create a hash of the canonical request
+     *    Hash the canonical request using the same algorithm that you used to create the hash of the payload. The hash of the canonical request is a string of lowercase hexadecimal characters.
+     * 3. Create a string to sign
+     *    Create a string to sign with the canonical request and extra information such as the algorithm, request date, credential scope, and the hash of the canonical request.
+     * 4. Derive a signing key
+     *    Use the secret access key to derive the key used to sign the request.
+     * 5. Calculate the signature
+     *    Perform a keyed hash operation on the string to sign using the derived signing key as the hash key.
+     * 6. Add the signature to the request
+     *    Add the calculated signature to an HTTP header or to the query string of the request.
+     */
+    // 1: Create a canonical request
+    // Date – The date and time used to sign the request.
+    const date = options.date;
+    // RequestDateTime – The date and time used in the credential scope. This value is the current UTC time in ISO 8601 format (for example, 20130524T000000Z).
+    const requestDateTime = date.toISOString().replace(/[:-]|\.\d{3}/g, '');
+    // RequestDate – The date used in the credential scope. This value is the current UTC date in YYYYMMDD format (for example, 20130524).
+    const requestDate = requestDateTime.substring(0, 8);
+    // Method – The HTTP request method. For us, this is always 'POST'.
+    const method = options.method;
+    // CanonicalUri – The URI-encoded version of the absolute path component URI, starting with the / that follows the domain name and up to the end of the string
+    // For our requests, this is always '/'
+    const canonicalUri = options.path;
+    // CanonicalQueryString – The URI-encoded query string parameters. For our requests, there are no query string parameters, so this is always an empty string.
+    const canonicalQuerystring = '';
+    // CanonicalHeaders – A list of request headers with their values. Individual header name and value pairs are separated by the newline character ("\n").
+    // All of our known/expected headers are included here, there are no extra headers.
+    const headers = new Headers({
+        'content-length': convertHeaderValue(options.headers['Content-Length']),
+        'content-type': convertHeaderValue(options.headers['Content-Type']),
+        host: convertHeaderValue(options.host),
+        'x-amz-date': convertHeaderValue(requestDateTime),
+        'x-mongodb-gs2-cb-flag': convertHeaderValue(options.headers['X-MongoDB-GS2-CB-Flag']),
+        'x-mongodb-server-nonce': convertHeaderValue(options.headers['X-MongoDB-Server-Nonce'])
+    });
+    // If session token is provided, include it in the headers
+    if ('sessionToken' in credentials && credentials.sessionToken) {
+        headers.append('x-amz-security-token', convertHeaderValue(credentials.sessionToken));
+    }
+    // Canonical headers are lowercased and sorted.
+    const canonicalHeaders = Array.from(headers.entries())
+        .map(([key, value]) => `${key.toLowerCase()}:${value}`)
+        .sort()
+        .join('\n');
+    const canonicalHeaderNames = Array.from(headers.keys()).map(header => header.toLowerCase());
+    // SignedHeaders – An alphabetically sorted, semicolon-separated list of lowercase request header names.
+    const signedHeaders = canonicalHeaderNames.sort().join(';');
+    // HashedPayload – A string created using the payload in the body of the HTTP request as input to a hash function. This string uses lowercase hexadecimal characters.
+    const hashedPayload = await getHexSha256(options.body);
+    // CanonicalRequest – A string that includes the above elements, separated by newline characters.
+    const canonicalRequest = [
+        method,
+        canonicalUri,
+        canonicalQuerystring,
+        canonicalHeaders + '\n',
+        signedHeaders,
+        hashedPayload
+    ].join('\n');
+    // 2. Create a hash of the canonical request
+    // HashedCanonicalRequest – A string created by using the canonical request as input to a hash function.
+    const hashedCanonicalRequest = await getHexSha256(canonicalRequest);
+    // 3. Create a string to sign
+    // Algorithm – The algorithm used to create the hash of the canonical request. For SigV4, use AWS4-HMAC-SHA256.
+    const algorithm = 'AWS4-HMAC-SHA256';
+    // CredentialScope – The credential scope, which restricts the resulting signature to the specified Region and service.
+    // Has the following format: YYYYMMDD/region/service/aws4_request.
+    const credentialScope = `${requestDate}/${options.region}/${options.service}/aws4_request`;
+    // StringToSign – A string that includes the above elements, separated by newline characters.
+    const stringToSign = [algorithm, requestDateTime, credentialScope, hashedCanonicalRequest].join('\n');
+    // 4. Derive a signing key
+    // To derive a signing key for SigV4, perform a succession of keyed hash operations (HMAC) on the request date, Region, and service, with your AWS secret access key as the key for the initial hashing operation.
+    const dateKey = await getHmacSha256('AWS4' + credentials.secretAccessKey, requestDate);
+    const dateRegionKey = await getHmacSha256(dateKey, options.region);
+    const dateRegionServiceKey = await getHmacSha256(dateRegionKey, options.service);
+    const signingKey = await getHmacSha256(dateRegionServiceKey, 'aws4_request');
+    // 5. Calculate the signature
+    const signatureBuffer = await getHmacSha256(signingKey, stringToSign);
+    const signature = bson_1.BSON.onDemand.ByteUtils.toHex(signatureBuffer);
+    // 6. Add the signature to the request
+    // Calculate the Authorization header
+    const authorizationHeader = [
+        'AWS4-HMAC-SHA256 Credential=' + credentials.accessKeyId + '/' + credentialScope,
+        'SignedHeaders=' + signedHeaders,
+        'Signature=' + signature
+    ].join(', ');
+    // Return the calculated headers
+    return {
+        Authorization: authorizationHeader,
+        'X-Amz-Date': requestDateTime
+    };
+}
+//# sourceMappingURL=aws4.js.map