@mongodb-js/oidc-plugin 0.1.0-alpha.0

package/dist/util.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.timeoutSignal = exports.AbortSignal = exports.AbortController = exports.errorString = exports.withAbortCheck = exports.throwIfAborted = void 0;
+class AbortError extends Error {
+    constructor() {
+        super('The operation was aborted');
+    }
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted)
+        throw signal.reason ?? new AbortError();
+}
+exports.throwIfAborted = throwIfAborted;
+async function withAbortCheck(signal, fn) {
+    const signalCheck = () => throwIfAborted(signal);
+    let reject;
+    const signalPromise = new Promise((resolve, rej) => {
+        reject = rej;
+    });
+    function listener() {
+        reject(signal?.reason ?? new AbortError());
+    }
+    signalPromise.catch(() => {
+        /* squelch UnhandledPromiseRejectionWarning */
+    });
+    signalCheck();
+    signal?.addEventListener('abort', listener, { once: true });
+    try {
+        return await fn({ signalCheck, signalPromise });
+    }
+    finally {
+        signal?.removeEventListener('abort', listener);
+    }
+}
+exports.withAbortCheck = withAbortCheck;
+function errorString(err) {
+    return String(typeof err === 'object' && err && 'message' in err ? err.message : err);
+}
+exports.errorString = errorString;
+exports.AbortController = 
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+globalThis.AbortController ?? require('abort-controller').AbortController;
+exports.AbortSignal = 
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+globalThis.AbortSignal ?? require('abort-controller').AbortSignal;
+// AbortSignal.timeout, but consistently .unref()ed
+function timeoutSignal(ms) {
+    const controller = new exports.AbortController();
+    setTimeout(() => controller.abort(), ms).unref();
+    return controller.signal;
+}
+exports.timeoutSignal = timeoutSignal;
+//# sourceMappingURL=util.js.map

package/dist/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":";;;AAEA,MAAM,UAAW,SAAQ,KAAK;IAC5B;QACE,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACrC,CAAC;CACF;AAED,SAAgB,cAAc,CAAC,MAAwB;IACrD,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,MAAM,CAAC,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;AAC/D,CAAC;AAFD,wCAEC;AAMM,KAAK,UAAU,cAAc,CAGlC,MAAmC,EAAE,EAAK;IAC1C,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,MAA8B,CAAC;IACnC,MAAM,aAAa,GAAG,IAAI,OAAO,CAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;QACxD,MAAM,GAAG,GAAG,CAAC;IACf,CAAC,CAAC,CAAC;IACH,SAAS,QAAQ;QACf,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE;QACvB,8CAA8C;IAChD,CAAC,CAAC,CAAC;IAEH,WAAW,EAAE,CAAC;IACd,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI;QACF,OAAO,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;KACjD;YAAS;QACR,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;KAChD;AACH,CAAC;AAvBD,wCAuBC;AAED,SAAgB,WAAW,CAAC,GAAY;IACtC,OAAO,MAAM,CACX,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACvE,CAAC;AACJ,CAAC;AAJD,kCAIC;AAEY,QAAA,eAAe;AAC1B,8DAA8D;AAC9D,UAAU,CAAC,eAAe,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC,eAAe,CAAC;AAC/D,QAAA,WAAW;AACtB,8DAA8D;AAC9D,UAAU,CAAC,WAAW,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC,WAAW,CAAC;AAEpE,mDAAmD;AACnD,SAAgB,aAAa,CAAC,EAAU;IACtC,MAAM,UAAU,GAAG,IAAI,uBAAe,EAAE,CAAC;IACzC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACjD,OAAO,UAAU,CAAC,MAAM,CAAC;AAC3B,CAAC;AAJD,sCAIC"}

package/index.d.ts

@@ -0,0 +1,287 @@
+/// <reference types="node" />
+
+import type { IncomingMessage } from 'http';
+import type { ServerResponse } from 'http';
+
+/** @public */
+export declare type AuthFlowType = 'auth-code' | 'device-auth';
+
+/**
+ * Create a new OIDC plugin instance that can be passed to the Node.js MongoDB
+ * driver's MongoClientOptions struct.
+ *
+ * This plugin instance can be passed to multiple MongoClient instances.
+ * It caches credentials based on cluster ID and username. If no username is
+ * provided when connecting to the MongoDB instance, the cache will be shared
+ * across all MongoClients that use this plugin instance.
+ *
+ * @public
+ */
+export declare function createMongoDBOIDCPlugin(options: Readonly<MongoDBOIDCPluginOptions>): MongoDBOIDCPlugin;
+
+/**
+ * Information that the application needs to show to users when using the
+ * Device Authorization flow.
+ *
+ * @public
+ */
+export declare interface DeviceFlowInformation {
+    verificationUrl: string;
+    userCode: string;
+}
+
+/** @public */
+export declare class MongoDBOIDCError extends Error {
+    /* Excluded from this release type: [MongoDBOIDCErrorTag] */
+    constructor(message: string);
+    static isMongoDBOIDCError(value: unknown): value is MongoDBOIDCError;
+}
+
+/* Excluded from this release type: MongoDBOIDCErrorTag */
+
+/** @public */
+export declare interface MongoDBOIDCLogEventsMap {
+    'mongodb-oidc-plugin:local-redirect-accessed': (event: {
+        id: string;
+    }) => void;
+    'mongodb-oidc-plugin:oidc-callback-accepted': (event: {
+        method: string;
+        hasBody: boolean;
+        errorCode?: string;
+    }) => void;
+    'mongodb-oidc-plugin:oidc-callback-rejected': (event: {
+        method: string;
+        hasBody: boolean;
+        errorCode: string;
+        isAcceptedOIDCResponse: boolean;
+    }) => void;
+    'mongodb-oidc-plugin:unknown-url-accessed': (event: {
+        method: string;
+        path: string;
+    }) => void;
+    'mongodb-oidc-plugin:local-listen-started': (event: {
+        url: string;
+    }) => void;
+    'mongodb-oidc-plugin:local-listen-failed': (event: {
+        url: string;
+    }) => void;
+    'mongodb-oidc-plugin:local-listen-succeeded': (event: {
+        url: string;
+        interfaces: string[];
+    }) => void;
+    'mongodb-oidc-plugin:local-server-close': (event: {
+        url: string;
+    }) => void;
+    'mongodb-oidc-plugin:open-browser': (event: {
+        customOpener: boolean;
+    }) => void;
+    'mongodb-oidc-plugin:notify-device-flow': () => void;
+    'mongodb-oidc-plugin:auth-attempt-started': (event: {
+        flow: string;
+    }) => void;
+    'mongodb-oidc-plugin:auth-attempt-succeeded': () => void;
+    'mongodb-oidc-plugin:auth-attempt-failed': (event: {
+        error: string;
+    }) => void;
+    'mongodb-oidc-plugin:refresh-failed': (event: {
+        error: string;
+    }) => void;
+    'mongodb-oidc-plugin:skip-auth-attempt': (event: {
+        reason: string;
+    }) => void;
+    'mongodb-oidc-plugin:auth-failed': (event: {
+        error: string;
+    }) => void;
+    'mongodb-oidc-plugin:auth-succeeded': (event: {
+        hasRefreshToken: boolean;
+        expiresAt: string | null;
+    }) => void;
+}
+
+/** @public */
+export declare interface MongoDBOIDCPlugin {
+    /**
+     * A subset of MongoClientOptions that need to be set in order
+     * for the MongoClient to an instance of this plugin.
+     *
+     * This object should be deep-merged with other, pre-existing
+     * MongoClient driver options.
+     */
+    readonly mongoClientOptions: {
+        readonly authMechanismProperties: {
+            readonly REQUEST_TOKEN_CALLBACK: OIDCRequestFunction;
+            readonly REFRESH_TOKEN_CALLBACK: OIDCRefreshFunction;
+        };
+    };
+    /**
+     * The logger instance passed in the options, or a default one otherwise.
+     */
+    readonly logger: TypedEventEmitter<MongoDBOIDCLogEventsMap>;
+}
+
+/** @public */
+export declare interface MongoDBOIDCPluginOptions {
+    /**
+     * A local URL to listen on. If this is not provided, a default URL
+     * standardized for MongoDB applications is used.
+     *
+     * This is only used when the Authorization Code flow is enabled,
+     * and when it is possible to open a browser.
+     */
+    redirectURI?: string;
+    /**
+     * A function that opens an URL in a browser window. If this is `false`,
+     * then all flows involving automatic browser operation (currently
+     * Authorization Code flow) are disabled.
+     *
+     * If a `{ command: string }` object is provided, `command` will be spawned
+     * inside a shell and receive the target URL as an argument. If `abortable`
+     * is set, then a possible AbortSignal will be passed on and the child
+     * process will be killed once that is reached. (This does not typically
+     * make sense for GUI browsers, but can for command-line browsers.)
+     *
+     * If this option is missing or undefined, the default behavior is to use
+     * `shell.openExternal()` if this is running inside of electron, and
+     * the `open` package otherwise.
+     */
+    openBrowser?: undefined | false | {
+        command: string;
+        abortable?: boolean;
+    } | ((options: OpenBrowserOptions) => Promise<OpenBrowserReturnType>);
+    /**
+     * The maximum time that the plugin waits for an opened browser to access
+     * the URL that was passed to it, in milliseconds. The default is 10 seconds.
+     * Passing a value of zero will disable the timeout altogether.
+     */
+    openBrowserTimeout?: number;
+    /**
+     * A callback to provide users with the information required to operate
+     * the Device Authorization flow.
+     */
+    notifyDeviceFlow?: (information: DeviceFlowInformation) => Promise<void> | void;
+    /**
+     * Restrict possible OIDC authorization flows to a subset.
+     */
+    allowedFlows?: AuthFlowType[];
+    /**
+     * An optional EventEmitter that can be used for recording log events.
+     */
+    logger?: TypedEventEmitter<MongoDBOIDCLogEventsMap>;
+    /**
+     * An AbortSignal that can be used to explicitly cancel authentication
+     * attempts, for example if a user intentionally aborts a connection
+     * attempt.
+     *
+     * Note that the driver also registers its own AbortSignal with individual
+     * authentication attempts in order to enforce a timeout, which has the
+     * same effect for authentication attempts from that driver MongoClient
+     * instance (but does not prevent other MongoClients from using this
+     * plugin instance to authenticate).
+     */
+    signal?: OIDCAbortSignal;
+    /**
+     * A custom handler for providing HTTP responses for requests to the
+     * redirect HTTP server used in the Authorization Code Flow.
+     *
+     * The default handler serves simple text/plain messages.
+     */
+    redirectServerRequestHandler?: RedirectServerRequestHandler;
+}
+
+/** @public */
+export declare type OIDCAbortSignal = {
+    aborted: boolean;
+    reason?: unknown;
+    addEventListener(type: 'abort', callback: () => void, options?: {
+        once: boolean;
+    }): void;
+    removeEventListener(type: 'abort', callback: () => void): void;
+};
+
+/**
+ * A copy of the Node.js driver's `OIDCMechanismServerStep1`
+ * @public
+ */
+export declare interface OIDCMechanismServerStep1 {
+    authorizationEndpoint?: string;
+    tokenEndpoint?: string;
+    deviceAuthorizationEndpoint?: string;
+    clientId: string;
+    clientSecret?: string;
+    requestScopes?: string[];
+}
+
+/**
+ * A copy of the Node.js driver's `OIDCRefreshFunction`
+ * @public
+ */
+export declare type OIDCRefreshFunction = (principalName: string | undefined, idl: OIDCMechanismServerStep1, result: OIDCRequestTokenResult, abortSignal?: OIDCAbortSignal | number) => Promise<OIDCRequestTokenResult>;
+
+/**
+ * A copy of the Node.js driver's `OIDCRequestFunction`
+ * @public
+ */
+export declare type OIDCRequestFunction = (principalName: string | undefined, idl: OIDCMechanismServerStep1, abortSignal?: OIDCAbortSignal | number) => Promise<OIDCRequestTokenResult>;
+
+/**
+ * A copy of the Node.js driver's `OIDCRequestTokenResult`
+ * @public
+ */
+export declare interface OIDCRequestTokenResult {
+    accessToken: string;
+    expiresInSeconds?: number;
+    refreshToken?: string;
+}
+
+/** @public */
+export declare interface OpenBrowserOptions {
+    /**
+     * The URL to open the browser with.
+     */
+    url: string;
+    /**
+     * A signal that is aborted when the user or the driver abort
+     * an authentication attempt.
+     */
+    signal: AbortSignal;
+}
+
+/** @public */
+export declare type OpenBrowserReturnType = void | undefined | TypedEventEmitter<{
+    exit(exitCode: number): void;
+    error(err: unknown): void;
+}>;
+
+/** @public */
+export declare type RedirectServerRequestHandler = (data: RedirectServerRequestInfo) => void;
+
+/** @public */
+export declare type RedirectServerRequestInfo = {
+    /** The incoming HTTP request. */
+    req: IncomingMessage;
+    /** The outgoing HTTP response. */
+    res: ServerResponse;
+    /** The suggested HTTP status code. For unknown-url, this is 404. */
+    status: number;
+} & ({
+    result: 'rejected';
+    /** Error information reported by the IdP as defined in RFC6749 section 4.1.2.1 */
+    error?: string;
+    /** Error information reported by the IdP as defined in RFC6749 section 4.1.2.1 */
+    errorDescription?: string;
+    /** Error information reported by the IdP as defined in RFC6749 section 4.1.2.1 */
+    errorURI?: string;
+} | {
+    result: 'accepted';
+} | {
+    result: 'unknown-url';
+});
+
+/** @public */
+export declare interface TypedEventEmitter<EventMap extends object> {
+    on<K extends keyof EventMap>(event: K, listener: EventMap[K]): this;
+    once<K extends keyof EventMap>(event: K, listener: EventMap[K]): this;
+    emit<K extends keyof EventMap>(event: K, ...args: EventMap[K] extends (...args: infer P) => any ? P : never): unknown;
+}
+
+export { }

package/package.json

@@ -0,0 +1,92 @@
+{
+  "name": "@mongodb-js/oidc-plugin",
+  "description": "MongoDB OIDC plugin for the Node.js driver",
+  "author": {
+    "name": "MongoDB Inc",
+    "email": "compass@mongodb.com"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "bugs": {
+    "url": "https://jira.mongodb.org/projects/COMPASS/issues",
+    "email": "compass@mongodb.com"
+  },
+  "homepage": "https://github.com/mongodb-js/oidc-plugin",
+  "version": "0.1.0-alpha.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mongodb-js/oidc-plugin.git"
+  },
+  "files": [
+    "dist",
+    "index.d.ts",
+    "README.md"
+  ],
+  "license": "Apache-2.0",
+  "main": "dist/index.js",
+  "exports": {
+    "require": "./dist/index.js",
+    "import": "./dist/.esm-wrapper.mjs"
+  },
+  "engines": {
+    "node": ">= 14.18.0"
+  },
+  "types": "./index.d.ts",
+  "scripts": {
+    "bootstrap": "npm run compile",
+    "prepublishOnly": "npm run compile",
+    "compile": "tsc -p tsconfig.json && api-extractor run && rimraf 'dist/**/*.d.ts*' && gen-esm-wrapper . ./dist/.esm-wrapper.mjs",
+    "typecheck": "tsc --noEmit",
+    "eslint": "eslint",
+    "prettier": "prettier",
+    "lint": "npm run eslint . && npm run prettier -- --check .",
+    "depcheck": "depcheck",
+    "check": "npm run typecheck && npm run lint && npm run depcheck",
+    "check-ci": "npm run check",
+    "test": "xvfb-maybe --auto-servernum -- mocha",
+    "test-electron": "xvfb-maybe --auto-servernum -- electron-mocha",
+    "test-cov": "nyc -x \"**/*.spec.*\" --reporter=lcov --reporter=text --reporter=html npm run test",
+    "test-watch": "npm run test -- --watch",
+    "test-ci": "npm run test-cov",
+    "reformat": "npm run prettier -- --write . && npm run eslint . -- --fix"
+  },
+  "devDependencies": {
+    "@microsoft/api-extractor": "^7.34.4",
+    "@mongodb-js/mocha-config-compass": "^0.10.0",
+    "@mongodb-js/prettier-config-compass": "^0.5.0",
+    "@mongodb-js/tsconfig-compass": "^0.6.0",
+    "@types/chai": "^4.2.21",
+    "@types/express": "^4.17.17",
+    "@types/mocha": "^9.0.0",
+    "@types/node": "^18.13.0",
+    "@types/oidc-provider": "^8.1.1",
+    "@types/sinon-chai": "^3.2.5",
+    "@typescript-eslint/eslint-plugin": "^5.52.0",
+    "@typescript-eslint/parser": "^5.54.1",
+    "chai": "^4.3.6",
+    "depcheck": "^1.4.1",
+    "electron": "^23.1.2",
+    "electron-mocha": "^11.0.2",
+    "eslint": "^7.25.0",
+    "eslint-config-prettier": "^8.7.0",
+    "eslint-plugin-mocha": "^10.1.0",
+    "gen-esm-wrapper": "^1.1.0",
+    "mocha": "^10.2.0",
+    "node-fetch": "^3.3.1",
+    "nyc": "^15.1.0",
+    "oidc-provider": "https://github.com/panva/node-oidc-provider/archive/refs/tags/v7.14.3.tar.gz",
+    "prettier": "2.3.2",
+    "rimraf": "^4.4.0",
+    "sinon": "^9.2.3",
+    "typescript": "^4.9.5",
+    "webdriverio": "^8.5.9",
+    "xvfb-maybe": "^0.2.1"
+  },
+  "dependencies": {
+    "abort-controller": "^3.0.0",
+    "express": "^4.18.2",
+    "open": "^8.4.1",
+    "openid-client": "^5.4.0"
+  }
+}