@depup/mongodb 7.1.0-depup.0

package/lib/cmap/auth/aws4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws4.js","sourceRoot":"","sources":["../../../src/cmap/auth/aws4.ts"],"names":[],"mappings":";;AA4FA,4BAkHC;AA9MD,qCAAkC;AAwBlC;;;;;GAKG;AACH,MAAM,YAAY,GAAG,KAAK,EAAE,GAAW,EAAmB,EAAE;IAC1D,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1E,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,aAAa,GAAG,KAAK,EAAE,GAAwB,EAAE,GAAW,EAAuB,EAAE;IACzF,IAAI,OAAmB,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,GAAG,CAAC;IAChB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC/C,KAAK,EACL,OAAO,EACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAC3C,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,CAAC,KAAsB,EAAE,EAAE;IACpD,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC,CAAC;AAEF;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,WAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,WAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,QAAQ,CAC5B,OAAwB,EACxB,WAA2B;IAE3B;;;;;;;;;;;;;;;;OAgBG;IAEH,gCAAgC;IAEhC,qDAAqD;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,2JAA2J;IAC3J,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACxE,sIAAsI;IACtI,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,mEAAmE;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,8JAA8J;IAC9J,uCAAuC;IACvC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAClC,6JAA6J;IAC7J,MAAM,oBAAoB,GAAG,EAAE,CAAC;IAEhC,wJAAwJ;IACxJ,mFAAmF;IACnF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,gBAAgB,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACvE,cAAc,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACnE,IAAI,EAAE,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,YAAY,EAAE,kBAAkB,CAAC,eAAe,CAAC;QACjD,uBAAuB,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACrF,wBAAwB,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;KACxF,CAAC,CAAC;IACH,0DAA0D;IAC1D,IAAI,cAAc,IAAI,WAAW,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;QAC9D,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,+CAA+C;IAC/C,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;SACnD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,EAAE,CAAC;SACtD,IAAI,EAAE;SACN,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,oBAAoB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5F,wGAAwG;IACxG,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE5D,qKAAqK;IACrK,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD,iGAAiG;IACjG,MAAM,gBAAgB,GAAG;QACvB,MAAM;QACN,YAAY;QACZ,oBAAoB;QACpB,gBAAgB,GAAG,IAAI;QACvB,aAAa;QACb,aAAa;KACd,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,4CAA4C;IAC5C,wGAAwG;IACxG,MAAM,sBAAsB,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAEpE,6BAA6B;IAC7B,+GAA+G;IAC/G,MAAM,SAAS,GAAG,kBAAkB,CAAC;IACrC,uHAAuH;IACvH,kEAAkE;IAClE,MAAM,eAAe,GAAG,GAAG,WAAW,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,eAAe,CAAC;IAC3F,6FAA6F;IAC7F,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,eAAe,EAAE,sBAAsB,CAAC,CAAC,IAAI,CAC7F,IAAI,CACL,CAAC;IAEF,0BAA0B;IAC1B,kNAAkN;IAClN,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,GAAG,WAAW,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACvF,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,MAAM,oBAAoB,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IAE7E,6BAA6B;IAC7B,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,WAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAEjE,sCAAsC;IACtC,qCAAqC;IACrC,MAAM,mBAAmB,GAAG;QAC1B,8BAA8B,GAAG,WAAW,CAAC,WAAW,GAAG,GAAG,GAAG,eAAe;QAChF,gBAAgB,GAAG,aAAa;QAChC,YAAY,GAAG,SAAS;KACzB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,gCAAgC;IAChC,OAAO;QACL,aAAa,EAAE,mBAAmB;QAClC,YAAY,EAAE,eAAe;KAC9B,CAAC;AACJ,CAAC"}

package/lib/cmap/auth/aws_temporary_credentials.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AWSSDKCredentialProvider = void 0;
+const process = require("process");
+const deps_1 = require("../../deps");
+const error_1 = require("../../error");
+/** @internal */
+class AWSSDKCredentialProvider {
+    /**
+     * Create the SDK credentials provider.
+     * @param credentialsProvider - The credentials provider.
+     */
+    constructor(credentialsProvider) {
+        if (credentialsProvider) {
+            this._provider = credentialsProvider;
+        }
+    }
+    static get awsSDK() {
+        AWSSDKCredentialProvider._awsSDK ??= (0, deps_1.getAwsCredentialProvider)();
+        return AWSSDKCredentialProvider._awsSDK;
+    }
+    /**
+     * The AWS SDK caches credentials automatically and handles refresh when the credentials have expired.
+     * To ensure this occurs, we need to cache the `provider` returned by the AWS sdk and re-use it when fetching credentials.
+     */
+    get provider() {
+        if ('kModuleError' in AWSSDKCredentialProvider.awsSDK) {
+            throw AWSSDKCredentialProvider.awsSDK.kModuleError;
+        }
+        if (this._provider) {
+            return this._provider;
+        }
+        let { AWS_STS_REGIONAL_ENDPOINTS = '', AWS_REGION = '' } = process.env;
+        AWS_STS_REGIONAL_ENDPOINTS = AWS_STS_REGIONAL_ENDPOINTS.toLowerCase();
+        AWS_REGION = AWS_REGION.toLowerCase();
+        /** The option setting should work only for users who have explicit settings in their environment, the driver should not encode "defaults" */
+        const awsRegionSettingsExist = AWS_REGION.length !== 0 && AWS_STS_REGIONAL_ENDPOINTS.length !== 0;
+        /**
+         * The following regions use the global AWS STS endpoint, sts.amazonaws.com, by default
+         * https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html
+         */
+        const LEGACY_REGIONS = new Set([
+            'ap-northeast-1',
+            'ap-south-1',
+            'ap-southeast-1',
+            'ap-southeast-2',
+            'aws-global',
+            'ca-central-1',
+            'eu-central-1',
+            'eu-north-1',
+            'eu-west-1',
+            'eu-west-2',
+            'eu-west-3',
+            'sa-east-1',
+            'us-east-1',
+            'us-east-2',
+            'us-west-1',
+            'us-west-2'
+        ]);
+        /**
+         * If AWS_STS_REGIONAL_ENDPOINTS is set to regional, users are opting into the new behavior of respecting the region settings
+         *
+         * If AWS_STS_REGIONAL_ENDPOINTS is set to legacy, then "old" regions need to keep using the global setting.
+         * Technically the SDK gets this wrong, it reaches out to 'sts.us-east-1.amazonaws.com' when it should be 'sts.amazonaws.com'.
+         * That is not our bug to fix here. We leave that up to the SDK.
+         */
+        const useRegionalSts = AWS_STS_REGIONAL_ENDPOINTS === 'regional' ||
+            (AWS_STS_REGIONAL_ENDPOINTS === 'legacy' && !LEGACY_REGIONS.has(AWS_REGION));
+        this._provider =
+            awsRegionSettingsExist && useRegionalSts
+                ? AWSSDKCredentialProvider.awsSDK.fromNodeProviderChain({
+                    clientConfig: { region: AWS_REGION }
+                })
+                : AWSSDKCredentialProvider.awsSDK.fromNodeProviderChain();
+        return this._provider;
+    }
+    async getCredentials() {
+        /*
+         * Creates a credential provider that will attempt to find credentials from the
+         * following sources (listed in order of precedence):
+         *
+         * - Environment variables exposed via process.env
+         * - SSO credentials from token cache
+         * - Web identity token credentials
+         * - Shared credentials and config ini files
+         * - The EC2/ECS Instance Metadata Service
+         */
+        try {
+            const creds = await this.provider();
+            return {
+                AccessKeyId: creds.accessKeyId,
+                SecretAccessKey: creds.secretAccessKey,
+                Token: creds.sessionToken,
+                Expiration: creds.expiration
+            };
+        }
+        catch (error) {
+            throw new error_1.MongoAWSError(error.message, { cause: error });
+        }
+    }
+}
+exports.AWSSDKCredentialProvider = AWSSDKCredentialProvider;
+//# sourceMappingURL=aws_temporary_credentials.js.map

package/lib/cmap/auth/aws_temporary_credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws_temporary_credentials.js","sourceRoot":"","sources":["../../../src/cmap/auth/aws_temporary_credentials.ts"],"names":[],"mappings":";;;AAAA,mCAAmC;AAEnC,qCAA2E;AAC3E,uCAA4C;AAoB5C,gBAAgB;AAChB,MAAa,wBAAwB;IAInC;;;OAGG;IACH,YAAY,mBAA2C;QACrD,IAAI,mBAAmB,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,GAAG,mBAAmB,CAAC;QACvC,CAAC;IACH,CAAC;IAED,MAAM,KAAK,MAAM;QACf,wBAAwB,CAAC,OAAO,KAAK,IAAA,+BAAwB,GAAE,CAAC;QAChE,OAAO,wBAAwB,CAAC,OAAO,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,IAAY,QAAQ;QAClB,IAAI,cAAc,IAAI,wBAAwB,CAAC,MAAM,EAAE,CAAC;YACtD,MAAM,wBAAwB,CAAC,MAAM,CAAC,YAAY,CAAC;QACrD,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;QACD,IAAI,EAAE,0BAA0B,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;QACvE,0BAA0B,GAAG,0BAA0B,CAAC,WAAW,EAAE,CAAC;QACtE,UAAU,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QAEtC,6IAA6I;QAC7I,MAAM,sBAAsB,GAC1B,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,0BAA0B,CAAC,MAAM,KAAK,CAAC,CAAC;QAErE;;;WAGG;QACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;YAC7B,gBAAgB;YAChB,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,YAAY;YACZ,cAAc;YACd,cAAc;YACd,YAAY;YACZ,WAAW;YACX,WAAW;YACX,WAAW;YACX,WAAW;YACX,WAAW;YACX,WAAW;YACX,WAAW;YACX,WAAW;SACZ,CAAC,CAAC;QACH;;;;;;WAMG;QACH,MAAM,cAAc,GAClB,0BAA0B,KAAK,UAAU;YACzC,CAAC,0BAA0B,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QAE/E,IAAI,CAAC,SAAS;YACZ,sBAAsB,IAAI,cAAc;gBACtC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,qBAAqB,CAAC;oBACpD,YAAY,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE;iBACrC,CAAC;gBACJ,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAE9D,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB;;;;;;;;;WASG;QACH,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,OAAO;gBACL,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,KAAK,EAAE,KAAK,CAAC,YAAY;gBACzB,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAa,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF;AAxGD,4DAwGC"}

package/lib/cmap/auth/gssapi.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GSSAPI = exports.GSSAPICanonicalizationValue = void 0;
+exports.performGSSAPICanonicalizeHostName = performGSSAPICanonicalizeHostName;
+exports.resolveCname = resolveCname;
+const dns = require("dns");
+const os = require("os");
+const deps_1 = require("../../deps");
+const error_1 = require("../../error");
+const utils_1 = require("../../utils");
+const auth_provider_1 = require("./auth_provider");
+/** @public */
+exports.GSSAPICanonicalizationValue = Object.freeze({
+    on: true,
+    off: false,
+    none: 'none',
+    forward: 'forward',
+    forwardAndReverse: 'forwardAndReverse'
+});
+async function externalCommand(connection, command) {
+    const response = await connection.command((0, utils_1.ns)('$external.$cmd'), command);
+    return response;
+}
+let krb;
+class GSSAPI extends auth_provider_1.AuthProvider {
+    async auth(authContext) {
+        const { connection, credentials } = authContext;
+        if (credentials == null) {
+            throw new error_1.MongoMissingCredentialsError('Credentials required for GSSAPI authentication');
+        }
+        const { username } = credentials;
+        const client = await makeKerberosClient(authContext);
+        const payload = await client.step('');
+        const saslStartResponse = await externalCommand(connection, saslStart(payload));
+        const negotiatedPayload = await negotiate(client, 10, saslStartResponse.payload);
+        const saslContinueResponse = await externalCommand(connection, saslContinue(negotiatedPayload, saslStartResponse.conversationId));
+        const finalizePayload = await finalize(client, username, saslContinueResponse.payload);
+        await externalCommand(connection, {
+            saslContinue: 1,
+            conversationId: saslContinueResponse.conversationId,
+            payload: finalizePayload
+        });
+    }
+}
+exports.GSSAPI = GSSAPI;
+async function makeKerberosClient(authContext) {
+    const { hostAddress } = authContext.options;
+    const { credentials } = authContext;
+    if (!hostAddress || typeof hostAddress.host !== 'string' || !credentials) {
+        throw new error_1.MongoInvalidArgumentError('Connection must have host and port and credentials defined.');
+    }
+    loadKrb();
+    if ('kModuleError' in krb) {
+        throw krb['kModuleError'];
+    }
+    const { initializeClient } = krb;
+    const { username, password } = credentials;
+    const mechanismProperties = credentials.mechanismProperties;
+    const serviceName = mechanismProperties.SERVICE_NAME ?? 'mongodb';
+    const host = await performGSSAPICanonicalizeHostName(hostAddress.host, mechanismProperties);
+    const initOptions = {};
+    if (password != null) {
+        // TODO(NODE-5139): These do not match the typescript options in initializeClient
+        Object.assign(initOptions, { user: username, password: password });
+    }
+    const spnHost = mechanismProperties.SERVICE_HOST ?? host;
+    let spn = `${serviceName}${os.platform() === 'win32' ? '/' : '@'}${spnHost}`;
+    if ('SERVICE_REALM' in mechanismProperties) {
+        spn = `${spn}@${mechanismProperties.SERVICE_REALM}`;
+    }
+    return await initializeClient(spn, initOptions);
+}
+function saslStart(payload) {
+    return {
+        saslStart: 1,
+        mechanism: 'GSSAPI',
+        payload,
+        autoAuthorize: 1
+    };
+}
+function saslContinue(payload, conversationId) {
+    return {
+        saslContinue: 1,
+        conversationId,
+        payload
+    };
+}
+async function negotiate(client, retries, payload) {
+    try {
+        const response = await client.step(payload);
+        return response || '';
+    }
+    catch (error) {
+        if (retries === 0) {
+            // Retries exhausted, raise error
+            throw error;
+        }
+        // Adjust number of retries and call step again
+        return await negotiate(client, retries - 1, payload);
+    }
+}
+async function finalize(client, user, payload) {
+    // GSS Client Unwrap
+    const response = await client.unwrap(payload);
+    return await client.wrap(response || '', { user });
+}
+async function performGSSAPICanonicalizeHostName(host, mechanismProperties) {
+    const mode = mechanismProperties.CANONICALIZE_HOST_NAME;
+    if (!mode || mode === exports.GSSAPICanonicalizationValue.none) {
+        return host;
+    }
+    // If forward and reverse or true
+    if (mode === exports.GSSAPICanonicalizationValue.on ||
+        mode === exports.GSSAPICanonicalizationValue.forwardAndReverse) {
+        // Perform the lookup of the ip address.
+        const { address } = await dns.promises.lookup(host);
+        try {
+            // Perform a reverse ptr lookup on the ip address.
+            const results = await dns.promises.resolvePtr(address);
+            // If the ptr did not error but had no results, return the host.
+            return results.length > 0 ? results[0] : host;
+        }
+        catch {
+            // This can error as ptr records may not exist for all ips. In this case
+            // fallback to a cname lookup as dns.lookup() does not return the
+            // cname.
+            return await resolveCname(host);
+        }
+    }
+    else {
+        // The case for forward is just to resolve the cname as dns.lookup()
+        // will not return it.
+        return await resolveCname(host);
+    }
+}
+async function resolveCname(host) {
+    // Attempt to resolve the host name
+    try {
+        const results = await dns.promises.resolveCname(host);
+        // Get the first resolved host id
+        return results.length > 0 ? results[0] : host;
+    }
+    catch {
+        return host;
+    }
+}
+/**
+ * Load the Kerberos library.
+ */
+function loadKrb() {
+    if (!krb) {
+        krb = (0, deps_1.getKerberos)();
+    }
+}
+//# sourceMappingURL=gssapi.js.map

package/lib/cmap/auth/gssapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gssapi.js","sourceRoot":"","sources":["../../../src/cmap/auth/gssapi.ts"],"names":[],"mappings":";;;AAqJA,8EAiCC;AAED,oCASC;AAjMD,2BAA2B;AAC3B,yBAAyB;AAEzB,qCAA6E;AAC7E,uCAAsF;AACtF,uCAAiC;AAEjC,mDAAiE;AAEjE,cAAc;AACD,QAAA,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC;IACvD,EAAE,EAAE,IAAI;IACR,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,iBAAiB,EAAE,mBAAmB;CAC9B,CAAC,CAAC;AAaZ,KAAK,UAAU,eAAe,CAC5B,UAAsB,EACtB,OAAuE;IAEvE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAA,UAAE,EAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC,CAAC;IACzE,OAAO,QAAuD,CAAC;AACjE,CAAC;AAED,IAAI,GAAa,CAAC;AAElB,MAAa,MAAO,SAAQ,4BAAY;IAC7B,KAAK,CAAC,IAAI,CAAC,WAAwB;QAC1C,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC;QAChD,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,oCAA4B,CAAC,gDAAgD,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC;QAEjC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEtC,MAAM,iBAAiB,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAEhF,MAAM,iBAAiB,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEjF,MAAM,oBAAoB,GAAG,MAAM,eAAe,CAChD,UAAU,EACV,YAAY,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAClE,CAAC;QAEF,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAEvF,MAAM,eAAe,CAAC,UAAU,EAAE;YAChC,YAAY,EAAE,CAAC;YACf,cAAc,EAAE,oBAAoB,CAAC,cAAc;YACnD,OAAO,EAAE,eAAe;SACzB,CAAC,CAAC;IACL,CAAC;CACF;AA9BD,wBA8BC;AAED,KAAK,UAAU,kBAAkB,CAAC,WAAwB;IACxD,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC;IAC5C,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC;IACpC,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACzE,MAAM,IAAI,iCAAyB,CACjC,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC;IACV,IAAI,cAAc,IAAI,GAAG,EAAE,CAAC;QAC1B,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,GAAG,GAAG,CAAC;IAEjC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC;IAC3C,MAAM,mBAAmB,GAAG,WAAW,CAAC,mBAA0C,CAAC;IAEnF,MAAM,WAAW,GAAG,mBAAmB,CAAC,YAAY,IAAI,SAAS,CAAC;IAElE,MAAM,IAAI,GAAG,MAAM,iCAAiC,CAAC,WAAW,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAE5F,MAAM,WAAW,GAAG,EAAE,CAAC;IACvB,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,iFAAiF;QACjF,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,YAAY,IAAI,IAAI,CAAC;IACzD,IAAI,GAAG,GAAG,GAAG,WAAW,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,OAAO,EAAE,CAAC;IAC7E,IAAI,eAAe,IAAI,mBAAmB,EAAE,CAAC;QAC3C,GAAG,GAAG,GAAG,GAAG,IAAI,mBAAmB,CAAC,aAAa,EAAE,CAAC;IACtD,CAAC;IAED,OAAO,MAAM,gBAAgB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO;QACL,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,QAAQ;QACnB,OAAO;QACP,aAAa,EAAE,CAAC;KACR,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,cAAsB;IAC3D,OAAO;QACL,YAAY,EAAE,CAAC;QACf,cAAc;QACd,OAAO;KACC,CAAC;AACb,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,MAAsB,EACtB,OAAe,EACf,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,QAAQ,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,iCAAiC;YACjC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,+CAA+C;QAC/C,OAAO,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAsB,EAAE,IAAY,EAAE,OAAe;IAC3E,oBAAoB;IACpB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAEM,KAAK,UAAU,iCAAiC,CACrD,IAAY,EACZ,mBAAwC;IAExC,MAAM,IAAI,GAAG,mBAAmB,CAAC,sBAAsB,CAAC;IACxD,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,mCAA2B,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iCAAiC;IACjC,IACE,IAAI,KAAK,mCAA2B,CAAC,EAAE;QACvC,IAAI,KAAK,mCAA2B,CAAC,iBAAiB,EACtD,CAAC;QACD,wCAAwC;QACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEpD,IAAI,CAAC;YACH,kDAAkD;YAClD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACvD,gEAAgE;YAChE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,iEAAiE;YACjE,SAAS;YACT,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,oEAAoE;QACpE,sBAAsB;QACtB,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,mCAAmC;IACnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACtD,iCAAiC;QACjC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,OAAO;IACd,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,IAAA,kBAAW,GAAE,CAAC;IACtB,CAAC;AACH,CAAC"}

package/lib/cmap/auth/mongo_credentials.js

@@ -0,0 +1,169 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MongoCredentials = exports.DEFAULT_ALLOWED_HOSTS = void 0;
+const error_1 = require("../../error");
+const gssapi_1 = require("./gssapi");
+const providers_1 = require("./providers");
+/**
+ * @see https://github.com/mongodb/specifications/blob/master/source/auth/auth.md
+ */
+function getDefaultAuthMechanism(hello) {
+    if (hello) {
+        // If hello contains saslSupportedMechs, use scram-sha-256
+        // if it is available, else scram-sha-1
+        if (Array.isArray(hello.saslSupportedMechs)) {
+            return hello.saslSupportedMechs.includes(providers_1.AuthMechanism.MONGODB_SCRAM_SHA256)
+                ? providers_1.AuthMechanism.MONGODB_SCRAM_SHA256
+                : providers_1.AuthMechanism.MONGODB_SCRAM_SHA1;
+        }
+    }
+    // Default auth mechanism for 4.0 and higher.
+    return providers_1.AuthMechanism.MONGODB_SCRAM_SHA256;
+}
+const ALLOWED_ENVIRONMENT_NAMES = [
+    'test',
+    'azure',
+    'gcp',
+    'k8s'
+];
+const ALLOWED_HOSTS_ERROR = 'Auth mechanism property ALLOWED_HOSTS must be an array of strings.';
+/** @internal */
+exports.DEFAULT_ALLOWED_HOSTS = [
+    '*.mongodb.net',
+    '*.mongodb-qa.net',
+    '*.mongodb-dev.net',
+    '*.mongodbgov.net',
+    'localhost',
+    '127.0.0.1',
+    '::1',
+    '*.mongo.com'
+];
+/** Error for when the token audience is missing in the environment. */
+const TOKEN_RESOURCE_MISSING_ERROR = 'TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is azure or gcp.';
+/**
+ * A representation of the credentials used by MongoDB
+ * @public
+ */
+class MongoCredentials {
+    constructor(options) {
+        this.username = options.username ?? '';
+        this.password = options.password;
+        this.source = options.source;
+        if (!this.source && options.db) {
+            this.source = options.db;
+        }
+        this.mechanism = options.mechanism || providers_1.AuthMechanism.MONGODB_DEFAULT;
+        this.mechanismProperties = options.mechanismProperties || {};
+        if (this.mechanism === providers_1.AuthMechanism.MONGODB_OIDC && !this.mechanismProperties.ALLOWED_HOSTS) {
+            this.mechanismProperties = {
+                ...this.mechanismProperties,
+                ALLOWED_HOSTS: exports.DEFAULT_ALLOWED_HOSTS
+            };
+        }
+        Object.freeze(this.mechanismProperties);
+        Object.freeze(this);
+    }
+    /** Determines if two MongoCredentials objects are equivalent */
+    equals(other) {
+        return (this.mechanism === other.mechanism &&
+            this.username === other.username &&
+            this.password === other.password &&
+            this.source === other.source);
+    }
+    /**
+     * If the authentication mechanism is set to "default", resolves the authMechanism
+     * based on the server version and server supported sasl mechanisms.
+     *
+     * @param hello - A hello response from the server
+     */
+    resolveAuthMechanism(hello) {
+        // If the mechanism is not "default", then it does not need to be resolved
+        if (this.mechanism.match(/DEFAULT/i)) {
+            return new MongoCredentials({
+                username: this.username,
+                password: this.password,
+                source: this.source,
+                mechanism: getDefaultAuthMechanism(hello),
+                mechanismProperties: this.mechanismProperties
+            });
+        }
+        return this;
+    }
+    validate() {
+        if ((this.mechanism === providers_1.AuthMechanism.MONGODB_GSSAPI ||
+            this.mechanism === providers_1.AuthMechanism.MONGODB_PLAIN ||
+            this.mechanism === providers_1.AuthMechanism.MONGODB_SCRAM_SHA1 ||
+            this.mechanism === providers_1.AuthMechanism.MONGODB_SCRAM_SHA256) &&
+            !this.username) {
+            throw new error_1.MongoMissingCredentialsError(`Username required for mechanism '${this.mechanism}'`);
+        }
+        if (this.mechanism === providers_1.AuthMechanism.MONGODB_OIDC) {
+            if (this.username &&
+                this.mechanismProperties.ENVIRONMENT &&
+                this.mechanismProperties.ENVIRONMENT !== 'azure') {
+                throw new error_1.MongoInvalidArgumentError(`username and ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' may not be used together for mechanism '${this.mechanism}'.`);
+            }
+            if (this.username && this.password) {
+                throw new error_1.MongoInvalidArgumentError(`No password is allowed in ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' for '${this.mechanism}'.`);
+            }
+            if ((this.mechanismProperties.ENVIRONMENT === 'azure' ||
+                this.mechanismProperties.ENVIRONMENT === 'gcp') &&
+                !this.mechanismProperties.TOKEN_RESOURCE) {
+                throw new error_1.MongoInvalidArgumentError(TOKEN_RESOURCE_MISSING_ERROR);
+            }
+            if (this.mechanismProperties.ENVIRONMENT &&
+                !ALLOWED_ENVIRONMENT_NAMES.includes(this.mechanismProperties.ENVIRONMENT)) {
+                throw new error_1.MongoInvalidArgumentError(`Currently only a ENVIRONMENT in ${ALLOWED_ENVIRONMENT_NAMES.join(',')} is supported for mechanism '${this.mechanism}'.`);
+            }
+            if (!this.mechanismProperties.ENVIRONMENT &&
+                !this.mechanismProperties.OIDC_CALLBACK &&
+                !this.mechanismProperties.OIDC_HUMAN_CALLBACK) {
+                throw new error_1.MongoInvalidArgumentError(`Either a ENVIRONMENT, OIDC_CALLBACK, or OIDC_HUMAN_CALLBACK must be specified for mechanism '${this.mechanism}'.`);
+            }
+            if (this.mechanismProperties.ALLOWED_HOSTS) {
+                const hosts = this.mechanismProperties.ALLOWED_HOSTS;
+                if (!Array.isArray(hosts)) {
+                    throw new error_1.MongoInvalidArgumentError(ALLOWED_HOSTS_ERROR);
+                }
+                for (const host of hosts) {
+                    if (typeof host !== 'string') {
+                        throw new error_1.MongoInvalidArgumentError(ALLOWED_HOSTS_ERROR);
+                    }
+                }
+            }
+        }
+        if (providers_1.AUTH_MECHS_AUTH_SRC_EXTERNAL.has(this.mechanism)) {
+            if (this.source != null && this.source !== '$external') {
+                // TODO(NODE-3485): Replace this with a MongoAuthValidationError
+                throw new error_1.MongoAPIError(`Invalid source '${this.source}' for mechanism '${this.mechanism}' specified.`);
+            }
+        }
+        if (this.mechanism === providers_1.AuthMechanism.MONGODB_PLAIN && this.source == null) {
+            // TODO(NODE-3485): Replace this with a MongoAuthValidationError
+            throw new error_1.MongoAPIError('PLAIN Authentication Mechanism needs an auth source');
+        }
+        if (this.mechanism === providers_1.AuthMechanism.MONGODB_X509 && this.password != null) {
+            if (this.password === '') {
+                Reflect.set(this, 'password', undefined);
+                return;
+            }
+            // TODO(NODE-3485): Replace this with a MongoAuthValidationError
+            throw new error_1.MongoAPIError(`Password not allowed for mechanism MONGODB-X509`);
+        }
+        const canonicalization = this.mechanismProperties.CANONICALIZE_HOST_NAME ?? false;
+        if (!Object.values(gssapi_1.GSSAPICanonicalizationValue).includes(canonicalization)) {
+            throw new error_1.MongoAPIError(`Invalid CANONICALIZE_HOST_NAME value: ${canonicalization}`);
+        }
+    }
+    static merge(creds, options) {
+        return new MongoCredentials({
+            username: options.username ?? creds?.username ?? '',
+            password: options.password ?? creds?.password ?? '',
+            mechanism: options.mechanism ?? creds?.mechanism ?? providers_1.AuthMechanism.MONGODB_DEFAULT,
+            mechanismProperties: options.mechanismProperties ?? creds?.mechanismProperties ?? {},
+            source: options.source ?? options.db ?? creds?.source ?? 'admin'
+        });
+    }
+}
+exports.MongoCredentials = MongoCredentials;
+//# sourceMappingURL=mongo_credentials.js.map

package/lib/cmap/auth/mongo_credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongo_credentials.js","sourceRoot":"","sources":["../../../src/cmap/auth/mongo_credentials.ts"],"names":[],"mappings":";;;AAGA,uCAIqB;AAErB,qCAAuD;AAEvD,2CAA0E;AAE1E;;GAEG;AACH,SAAS,uBAAuB,CAAC,KAAsB;IACrD,IAAI,KAAK,EAAE,CAAC;QACV,0DAA0D;QAC1D,uCAAuC;QACvC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,yBAAa,CAAC,oBAAoB,CAAC;gBAC1E,CAAC,CAAC,yBAAa,CAAC,oBAAoB;gBACpC,CAAC,CAAC,yBAAa,CAAC,kBAAkB,CAAC;QACvC,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,OAAO,yBAAa,CAAC,oBAAoB,CAAC;AAC5C,CAAC;AAED,MAAM,yBAAyB,GAA6C;IAC1E,MAAM;IACN,OAAO;IACP,KAAK;IACL,KAAK;CACN,CAAC;AACF,MAAM,mBAAmB,GAAG,oEAAoE,CAAC;AAEjG,gBAAgB;AACH,QAAA,qBAAqB,GAAG;IACnC,eAAe;IACf,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;IAClB,WAAW;IACX,WAAW;IACX,KAAK;IACL,aAAa;CACd,CAAC;AAEF,uEAAuE;AACvE,MAAM,4BAA4B,GAChC,+FAA+F,CAAC;AA2DlG;;;GAGG;AACH,MAAa,gBAAgB;IAY3B,YAAY,OAAgC;QAC1C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,yBAAa,CAAC,eAAe,CAAC;QACpE,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAE7D,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,CAAC;YAC7F,IAAI,CAAC,mBAAmB,GAAG;gBACzB,GAAG,IAAI,CAAC,mBAAmB;gBAC3B,aAAa,EAAE,6BAAqB;aACrC,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,gEAAgE;IAChE,MAAM,CAAC,KAAuB;QAC5B,OAAO,CACL,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;YAClC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YAChC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YAChC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAC7B,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAAC,KAAsB;QACzC,0EAA0E;QAC1E,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,gBAAgB,CAAC;gBAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS,EAAE,uBAAuB,CAAC,KAAK,CAAC;gBACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ;QACN,IACE,CAAC,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,cAAc;YAC9C,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,aAAa;YAC9C,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,kBAAkB;YACnD,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,oBAAoB,CAAC;YACxD,CAAC,IAAI,CAAC,QAAQ,EACd,CAAC;YACD,MAAM,IAAI,oCAA4B,CAAC,oCAAoC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,YAAY,EAAE,CAAC;YAClD,IACE,IAAI,CAAC,QAAQ;gBACb,IAAI,CAAC,mBAAmB,CAAC,WAAW;gBACpC,IAAI,CAAC,mBAAmB,CAAC,WAAW,KAAK,OAAO,EAChD,CAAC;gBACD,MAAM,IAAI,iCAAyB,CACjC,6BAA6B,IAAI,CAAC,mBAAmB,CAAC,WAAW,6CAA6C,IAAI,CAAC,SAAS,IAAI,CACjI,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnC,MAAM,IAAI,iCAAyB,CACjC,0CAA0C,IAAI,CAAC,mBAAmB,CAAC,WAAW,UAAU,IAAI,CAAC,SAAS,IAAI,CAC3G,CAAC;YACJ,CAAC;YAED,IACE,CAAC,IAAI,CAAC,mBAAmB,CAAC,WAAW,KAAK,OAAO;gBAC/C,IAAI,CAAC,mBAAmB,CAAC,WAAW,KAAK,KAAK,CAAC;gBACjD,CAAC,IAAI,CAAC,mBAAmB,CAAC,cAAc,EACxC,CAAC;gBACD,MAAM,IAAI,iCAAyB,CAAC,4BAA4B,CAAC,CAAC;YACpE,CAAC;YAED,IACE,IAAI,CAAC,mBAAmB,CAAC,WAAW;gBACpC,CAAC,yBAAyB,CAAC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,EACzE,CAAC;gBACD,MAAM,IAAI,iCAAyB,CACjC,mCAAmC,yBAAyB,CAAC,IAAI,CAC/D,GAAG,CACJ,gCAAgC,IAAI,CAAC,SAAS,IAAI,CACpD,CAAC;YACJ,CAAC;YAED,IACE,CAAC,IAAI,CAAC,mBAAmB,CAAC,WAAW;gBACrC,CAAC,IAAI,CAAC,mBAAmB,CAAC,aAAa;gBACvC,CAAC,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,EAC7C,CAAC;gBACD,MAAM,IAAI,iCAAyB,CACjC,gGAAgG,IAAI,CAAC,SAAS,IAAI,CACnH,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC;gBACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,iCAAyB,CAAC,mBAAmB,CAAC,CAAC;gBAC3D,CAAC;gBACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAC7B,MAAM,IAAI,iCAAyB,CAAC,mBAAmB,CAAC,CAAC;oBAC3D,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,wCAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBACvD,gEAAgE;gBAChE,MAAM,IAAI,qBAAa,CACrB,mBAAmB,IAAI,CAAC,MAAM,oBAAoB,IAAI,CAAC,SAAS,cAAc,CAC/E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1E,gEAAgE;YAChE,MAAM,IAAI,qBAAa,CAAC,qDAAqD,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,YAAY,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC3E,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YACD,gEAAgE;YAChE,MAAM,IAAI,qBAAa,CAAC,iDAAiD,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,IAAI,KAAK,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,oCAA2B,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,qBAAa,CAAC,yCAAyC,gBAAgB,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CACV,KAAmC,EACnC,OAAyC;QAEzC,OAAO,IAAI,gBAAgB,CAAC;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK,EAAE,QAAQ,IAAI,EAAE;YACnD,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK,EAAE,QAAQ,IAAI,EAAE;YACnD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK,EAAE,SAAS,IAAI,yBAAa,CAAC,eAAe;YACjF,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,KAAK,EAAE,mBAAmB,IAAI,EAAE;YACpF,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,EAAE,MAAM,IAAI,OAAO;SACjE,CAAC,CAAC;IACL,CAAC;CACF;AA/KD,4CA+KC"}

package/lib/cmap/auth/mongodb_aws.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MongoDBAWS = void 0;
+const BSON = require("../../bson");
+const error_1 = require("../../error");
+const utils_1 = require("../../utils");
+const auth_provider_1 = require("./auth_provider");
+const aws_temporary_credentials_1 = require("./aws_temporary_credentials");
+const aws4_1 = require("./aws4");
+const mongo_credentials_1 = require("./mongo_credentials");
+const providers_1 = require("./providers");
+const ASCII_N = 110;
+const bsonOptions = {
+    useBigInt64: false,
+    promoteLongs: true,
+    promoteValues: true,
+    promoteBuffers: false,
+    bsonRegExp: false
+};
+class MongoDBAWS extends auth_provider_1.AuthProvider {
+    constructor(credentialProvider) {
+        super();
+        this.credentialFetcher = new aws_temporary_credentials_1.AWSSDKCredentialProvider(credentialProvider);
+    }
+    async auth(authContext) {
+        const { connection } = authContext;
+        if (!authContext.credentials) {
+            throw new error_1.MongoMissingCredentialsError('AuthContext must provide credentials.');
+        }
+        if ((0, utils_1.maxWireVersion)(connection) < 9) {
+            throw new error_1.MongoCompatibilityError('MONGODB-AWS authentication requires MongoDB version 4.4 or later');
+        }
+        authContext.credentials = await makeTempCredentials(authContext.credentials, this.credentialFetcher);
+        const { credentials } = authContext;
+        const accessKeyId = credentials.username;
+        const secretAccessKey = credentials.password;
+        // Allow the user to specify an AWS session token for authentication with temporary credentials.
+        const sessionToken = credentials.mechanismProperties.AWS_SESSION_TOKEN;
+        // If all three defined, include sessionToken, else only include username and pass
+        const awsCredentials = sessionToken
+            ? { accessKeyId, secretAccessKey, sessionToken }
+            : { accessKeyId, secretAccessKey };
+        const db = credentials.source;
+        const nonce = await (0, utils_1.randomBytes)(32);
+        // All messages between MongoDB clients and servers are sent as BSON objects
+        // in the payload field of saslStart and saslContinue.
+        const saslStart = {
+            saslStart: 1,
+            mechanism: 'MONGODB-AWS',
+            payload: BSON.serialize({ r: nonce, p: ASCII_N }, bsonOptions)
+        };
+        const saslStartResponse = await connection.command((0, utils_1.ns)(`${db}.$cmd`), saslStart, undefined);
+        const serverResponse = BSON.deserialize(saslStartResponse.payload.buffer, bsonOptions);
+        const host = serverResponse.h;
+        const serverNonce = serverResponse.s.buffer;
+        if (serverNonce.length !== 64) {
+            // TODO(NODE-3483)
+            throw new error_1.MongoRuntimeError(`Invalid server nonce length ${serverNonce.length}, expected 64`);
+        }
+        if (!utils_1.ByteUtils.equals(serverNonce.subarray(0, nonce.byteLength), nonce)) {
+            // throw because the serverNonce's leading 32 bytes must equal the client nonce's 32 bytes
+            // https://github.com/mongodb/specifications/blob/master/source/auth/auth.md#conversation-5
+            // TODO(NODE-3483)
+            throw new error_1.MongoRuntimeError('Server nonce does not begin with client nonce');
+        }
+        if (host.length < 1 || host.length > 255 || host.indexOf('..') !== -1) {
+            // TODO(NODE-3483)
+            throw new error_1.MongoRuntimeError(`Server returned an invalid host: "${host}"`);
+        }
+        const body = 'Action=GetCallerIdentity&Version=2011-06-15';
+        const headers = await (0, aws4_1.aws4Sign)({
+            method: 'POST',
+            host,
+            region: deriveRegion(serverResponse.h),
+            service: 'sts',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'Content-Length': body.length,
+                'X-MongoDB-Server-Nonce': utils_1.ByteUtils.toBase64(serverNonce),
+                'X-MongoDB-GS2-CB-Flag': 'n'
+            },
+            path: '/',
+            body,
+            date: new Date()
+        }, awsCredentials);
+        const payload = {
+            a: headers.Authorization,
+            d: headers['X-Amz-Date']
+        };
+        if (sessionToken) {
+            payload.t = sessionToken;
+        }
+        const saslContinue = {
+            saslContinue: 1,
+            conversationId: saslStartResponse.conversationId,
+            payload: BSON.serialize(payload, bsonOptions)
+        };
+        await connection.command((0, utils_1.ns)(`${db}.$cmd`), saslContinue, undefined);
+    }
+}
+exports.MongoDBAWS = MongoDBAWS;
+async function makeTempCredentials(credentials, awsCredentialFetcher) {
+    function makeMongoCredentialsFromAWSTemp(creds) {
+        // The AWS session token (creds.Token) may or may not be set.
+        if (!creds.AccessKeyId || !creds.SecretAccessKey) {
+            throw new error_1.MongoMissingCredentialsError('Could not obtain temporary MONGODB-AWS credentials');
+        }
+        return new mongo_credentials_1.MongoCredentials({
+            username: creds.AccessKeyId,
+            password: creds.SecretAccessKey,
+            source: credentials.source,
+            mechanism: providers_1.AuthMechanism.MONGODB_AWS,
+            mechanismProperties: {
+                AWS_SESSION_TOKEN: creds.Token
+            }
+        });
+    }
+    const temporaryCredentials = await awsCredentialFetcher.getCredentials();
+    return makeMongoCredentialsFromAWSTemp(temporaryCredentials);
+}
+function deriveRegion(host) {
+    const parts = host.split('.');
+    if (parts.length === 1 || parts[1] === 'amazonaws') {
+        return 'us-east-1';
+    }
+    return parts[1];
+}
+//# sourceMappingURL=mongodb_aws.js.map

package/lib/cmap/auth/mongodb_aws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongodb_aws.js","sourceRoot":"","sources":["../../../src/cmap/auth/mongodb_aws.ts"],"names":[],"mappings":";;;AACA,mCAAmC;AACnC,uCAIqB;AACrB,uCAAyE;AACzE,mDAAiE;AACjE,2EAIqC;AACrC,iCAAkC;AAClC,2DAAuD;AACvD,2CAA4C;AAE5C,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,WAAW,GAAyB;IACxC,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE,KAAK;CAClB,CAAC;AAQF,MAAa,UAAW,SAAQ,4BAAY;IAG1C,YAAY,kBAA0C;QACpD,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,iBAAiB,GAAG,IAAI,oDAAwB,CAAC,kBAAkB,CAAC,CAAC;IAC5E,CAAC;IAEQ,KAAK,CAAC,IAAI,CAAC,WAAwB;QAC1C,MAAM,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC;QACnC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,oCAA4B,CAAC,uCAAuC,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,IAAA,sBAAc,EAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,+BAAuB,CAC/B,kEAAkE,CACnE,CAAC;QACJ,CAAC;QAED,WAAW,CAAC,WAAW,GAAG,MAAM,mBAAmB,CACjD,WAAW,CAAC,WAAW,EACvB,IAAI,CAAC,iBAAiB,CACvB,CAAC;QAEF,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC;QAEpC,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC;QACzC,MAAM,eAAe,GAAG,WAAW,CAAC,QAAQ,CAAC;QAC7C,gGAAgG;QAChG,MAAM,YAAY,GAAG,WAAW,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;QAEvE,kFAAkF;QAClF,MAAM,cAAc,GAAG,YAAY;YACjC,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE;YAChD,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;QAErC,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAW,EAAC,EAAE,CAAC,CAAC;QAEpC,4EAA4E;QAC5E,sDAAsD;QACtD,MAAM,SAAS,GAAG;YAChB,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,aAAa;YACxB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,WAAW,CAAC;SAC/D,CAAC;QAEF,MAAM,iBAAiB,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAA,UAAE,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAE3F,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAGpF,CAAC;QACF,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC;QAC9B,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5C,IAAI,WAAW,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC9B,kBAAkB;YAClB,MAAM,IAAI,yBAAiB,CAAC,+BAA+B,WAAW,CAAC,MAAM,eAAe,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,CAAC,iBAAS,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YACxE,0FAA0F;YAC1F,2FAA2F;YAE3F,kBAAkB;YAClB,MAAM,IAAI,yBAAiB,CAAC,+CAA+C,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACtE,kBAAkB;YAClB,MAAM,IAAI,yBAAiB,CAAC,qCAAqC,IAAI,GAAG,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,IAAI,GAAG,6CAA6C,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,IAAA,eAAQ,EAC5B;YACE,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,MAAM,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;YACtC,OAAO,EAAE,KAAK;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,gBAAgB,EAAE,IAAI,CAAC,MAAM;gBAC7B,wBAAwB,EAAE,iBAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACzD,uBAAuB,EAAE,GAAG;aAC7B;YACD,IAAI,EAAE,GAAG;YACT,IAAI;YACJ,IAAI,EAAE,IAAI,IAAI,EAAE;SACjB,EACD,cAAc,CACf,CAAC;QAEF,MAAM,OAAO,GAA2B;YACtC,CAAC,EAAE,OAAO,CAAC,aAAa;YACxB,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC;SACzB,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,GAAG,YAAY,CAAC;QAC3B,CAAC;QAED,MAAM,YAAY,GAAG;YACnB,YAAY,EAAE,CAAC;YACf,cAAc,EAAE,iBAAiB,CAAC,cAAc;YAChD,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;SAC9C,CAAC;QAEF,MAAM,UAAU,CAAC,OAAO,CAAC,IAAA,UAAE,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IACtE,CAAC;CACF;AA/GD,gCA+GC;AAED,KAAK,UAAU,mBAAmB,CAChC,WAA6B,EAC7B,oBAA8C;IAE9C,SAAS,+BAA+B,CAAC,KAAyB;QAChE,6DAA6D;QAC7D,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YACjD,MAAM,IAAI,oCAA4B,CAAC,oDAAoD,CAAC,CAAC;QAC/F,CAAC;QAED,OAAO,IAAI,oCAAgB,CAAC;YAC1B,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,QAAQ,EAAE,KAAK,CAAC,eAAe;YAC/B,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,SAAS,EAAE,yBAAa,CAAC,WAAW;YACpC,mBAAmB,EAAE;gBACnB,iBAAiB,EAAE,KAAK,CAAC,KAAK;aAC/B;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,oBAAoB,GAAG,MAAM,oBAAoB,CAAC,cAAc,EAAE,CAAC;IAEzE,OAAO,+BAA+B,CAAC,oBAAoB,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;QACnD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}