@nullix/zod-mongoose-studio 0.0.1

package/.output/server/node_modules/mongodb/lib/cmap/auth/gssapi.js

@@ -0,0 +1,154 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GSSAPI = exports.GSSAPICanonicalizationValue = void 0;
+exports.performGSSAPICanonicalizeHostName = performGSSAPICanonicalizeHostName;
+exports.resolveCname = resolveCname;
+const dns = require("dns");
+const deps_1 = require("../../deps");
+const error_1 = require("../../error");
+const utils_1 = require("../../utils");
+const auth_provider_1 = require("./auth_provider");
+/** @public */
+exports.GSSAPICanonicalizationValue = Object.freeze({
+    on: true,
+    off: false,
+    none: 'none',
+    forward: 'forward',
+    forwardAndReverse: 'forwardAndReverse'
+});
+async function externalCommand(connection, command) {
+    const response = await connection.command((0, utils_1.ns)('$external.$cmd'), command);
+    return response;
+}
+let krb;
+class GSSAPI extends auth_provider_1.AuthProvider {
+    async auth(authContext) {
+        const { connection, credentials } = authContext;
+        if (credentials == null) {
+            throw new error_1.MongoMissingCredentialsError('Credentials required for GSSAPI authentication');
+        }
+        const { username } = credentials;
+        const client = await makeKerberosClient(authContext);
+        const payload = await client.step('');
+        const saslStartResponse = await externalCommand(connection, saslStart(payload));
+        const negotiatedPayload = await negotiate(client, 10, saslStartResponse.payload);
+        const saslContinueResponse = await externalCommand(connection, saslContinue(negotiatedPayload, saslStartResponse.conversationId));
+        const finalizePayload = await finalize(client, username, saslContinueResponse.payload);
+        await externalCommand(connection, {
+            saslContinue: 1,
+            conversationId: saslContinueResponse.conversationId,
+            payload: finalizePayload
+        });
+    }
+}
+exports.GSSAPI = GSSAPI;
+async function makeKerberosClient(authContext) {
+    const { hostAddress } = authContext.options;
+    const { credentials } = authContext;
+    if (!hostAddress || typeof hostAddress.host !== 'string' || !credentials) {
+        throw new error_1.MongoInvalidArgumentError('Connection must have host and port and credentials defined.');
+    }
+    loadKrb();
+    if ('kModuleError' in krb) {
+        throw krb['kModuleError'];
+    }
+    const { initializeClient } = krb;
+    const { username, password } = credentials;
+    const mechanismProperties = credentials.mechanismProperties;
+    const serviceName = mechanismProperties.SERVICE_NAME ?? 'mongodb';
+    const host = await performGSSAPICanonicalizeHostName(hostAddress.host, mechanismProperties);
+    const initOptions = {};
+    if (password != null) {
+        // TODO(NODE-5139): These do not match the typescript options in initializeClient
+        Object.assign(initOptions, { user: username, password: password });
+    }
+    const spnHost = mechanismProperties.SERVICE_HOST ?? host;
+    let spn = `${serviceName}${process.platform === 'win32' ? '/' : '@'}${spnHost}`;
+    if ('SERVICE_REALM' in mechanismProperties) {
+        spn = `${spn}@${mechanismProperties.SERVICE_REALM}`;
+    }
+    return await initializeClient(spn, initOptions);
+}
+function saslStart(payload) {
+    return {
+        saslStart: 1,
+        mechanism: 'GSSAPI',
+        payload,
+        autoAuthorize: 1
+    };
+}
+function saslContinue(payload, conversationId) {
+    return {
+        saslContinue: 1,
+        conversationId,
+        payload
+    };
+}
+async function negotiate(client, retries, payload) {
+    try {
+        const response = await client.step(payload);
+        return response || '';
+    }
+    catch (error) {
+        if (retries === 0) {
+            // Retries exhausted, raise error
+            throw error;
+        }
+        // Adjust number of retries and call step again
+        return await negotiate(client, retries - 1, payload);
+    }
+}
+async function finalize(client, user, payload) {
+    // GSS Client Unwrap
+    const response = await client.unwrap(payload);
+    return await client.wrap(response || '', { user });
+}
+async function performGSSAPICanonicalizeHostName(host, mechanismProperties) {
+    const mode = mechanismProperties.CANONICALIZE_HOST_NAME;
+    if (!mode || mode === exports.GSSAPICanonicalizationValue.none) {
+        return host;
+    }
+    // If forward and reverse or true
+    if (mode === exports.GSSAPICanonicalizationValue.on ||
+        mode === exports.GSSAPICanonicalizationValue.forwardAndReverse) {
+        // Perform the lookup of the ip address.
+        const { address } = await dns.promises.lookup(host);
+        try {
+            // Perform a reverse ptr lookup on the ip address.
+            const results = await dns.promises.resolvePtr(address);
+            // If the ptr did not error but had no results, return the host.
+            return results.length > 0 ? results[0] : host;
+        }
+        catch {
+            // This can error as ptr records may not exist for all ips. In this case
+            // fallback to a cname lookup as dns.lookup() does not return the
+            // cname.
+            return await resolveCname(host);
+        }
+    }
+    else {
+        // The case for forward is just to resolve the cname as dns.lookup()
+        // will not return it.
+        return await resolveCname(host);
+    }
+}
+async function resolveCname(host) {
+    // Attempt to resolve the host name
+    try {
+        const results = await dns.promises.resolveCname(host);
+        // Get the first resolved host id
+        return results.length > 0 ? results[0] : host;
+    }
+    catch {
+        return host;
+    }
+}
+/**
+ * Load the Kerberos library.
+ */
+function loadKrb() {
+    if (!krb) {
+        krb = (0, deps_1.getKerberos)();
+    }
+}
+//# sourceMappingURL=gssapi.js.map

package/.output/server/node_modules/mongodb/lib/cmap/auth/mongo_credentials.js

@@ -0,0 +1,183 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MongoCredentials = exports.DEFAULT_ALLOWED_HOSTS = void 0;
+const error_1 = require("../../error");
+const gssapi_1 = require("./gssapi");
+const providers_1 = require("./providers");
+/**
+ * @see https://github.com/mongodb/specifications/blob/master/source/auth/auth.md
+ */
+function getDefaultAuthMechanism(hello) {
+    if (hello) {
+        // If hello contains saslSupportedMechs, use scram-sha-256
+        // if it is available, else scram-sha-1
+        if (Array.isArray(hello.saslSupportedMechs)) {
+            return hello.saslSupportedMechs.includes(providers_1.AuthMechanism.MONGODB_SCRAM_SHA256)
+                ? providers_1.AuthMechanism.MONGODB_SCRAM_SHA256
+                : providers_1.AuthMechanism.MONGODB_SCRAM_SHA1;
+        }
+    }
+    // Default auth mechanism for 4.0 and higher.
+    return providers_1.AuthMechanism.MONGODB_SCRAM_SHA256;
+}
+const ALLOWED_ENVIRONMENT_NAMES = [
+    'test',
+    'azure',
+    'gcp',
+    'k8s'
+];
+const ALLOWED_HOSTS_ERROR = 'Auth mechanism property ALLOWED_HOSTS must be an array of strings.';
+/** @internal */
+exports.DEFAULT_ALLOWED_HOSTS = [
+    '*.mongodb.net',
+    '*.mongodb-qa.net',
+    '*.mongodb-dev.net',
+    '*.mongodbgov.net',
+    'localhost',
+    '127.0.0.1',
+    '::1'
+];
+/** Error for when the token audience is missing in the environment. */
+const TOKEN_RESOURCE_MISSING_ERROR = 'TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is azure or gcp.';
+/**
+ * A representation of the credentials used by MongoDB
+ * @public
+ */
+class MongoCredentials {
+    constructor(options) {
+        this.username = options.username ?? '';
+        this.password = options.password;
+        this.source = options.source;
+        if (!this.source && options.db) {
+            this.source = options.db;
+        }
+        this.mechanism = options.mechanism || providers_1.AuthMechanism.MONGODB_DEFAULT;
+        this.mechanismProperties = options.mechanismProperties || {};
+        if (this.mechanism.match(/MONGODB-AWS/i)) {
+            if (!this.username && process.env.AWS_ACCESS_KEY_ID) {
+                this.username = process.env.AWS_ACCESS_KEY_ID;
+            }
+            if (!this.password && process.env.AWS_SECRET_ACCESS_KEY) {
+                this.password = process.env.AWS_SECRET_ACCESS_KEY;
+            }
+            if (this.mechanismProperties.AWS_SESSION_TOKEN == null &&
+                process.env.AWS_SESSION_TOKEN != null) {
+                this.mechanismProperties = {
+                    ...this.mechanismProperties,
+                    AWS_SESSION_TOKEN: process.env.AWS_SESSION_TOKEN
+                };
+            }
+        }
+        if (this.mechanism === providers_1.AuthMechanism.MONGODB_OIDC && !this.mechanismProperties.ALLOWED_HOSTS) {
+            this.mechanismProperties = {
+                ...this.mechanismProperties,
+                ALLOWED_HOSTS: exports.DEFAULT_ALLOWED_HOSTS
+            };
+        }
+        Object.freeze(this.mechanismProperties);
+        Object.freeze(this);
+    }
+    /** Determines if two MongoCredentials objects are equivalent */
+    equals(other) {
+        return (this.mechanism === other.mechanism &&
+            this.username === other.username &&
+            this.password === other.password &&
+            this.source === other.source);
+    }
+    /**
+     * If the authentication mechanism is set to "default", resolves the authMechanism
+     * based on the server version and server supported sasl mechanisms.
+     *
+     * @param hello - A hello response from the server
+     */
+    resolveAuthMechanism(hello) {
+        // If the mechanism is not "default", then it does not need to be resolved
+        if (this.mechanism.match(/DEFAULT/i)) {
+            return new MongoCredentials({
+                username: this.username,
+                password: this.password,
+                source: this.source,
+                mechanism: getDefaultAuthMechanism(hello),
+                mechanismProperties: this.mechanismProperties
+            });
+        }
+        return this;
+    }
+    validate() {
+        if ((this.mechanism === providers_1.AuthMechanism.MONGODB_GSSAPI ||
+            this.mechanism === providers_1.AuthMechanism.MONGODB_PLAIN ||
+            this.mechanism === providers_1.AuthMechanism.MONGODB_SCRAM_SHA1 ||
+            this.mechanism === providers_1.AuthMechanism.MONGODB_SCRAM_SHA256) &&
+            !this.username) {
+            throw new error_1.MongoMissingCredentialsError(`Username required for mechanism '${this.mechanism}'`);
+        }
+        if (this.mechanism === providers_1.AuthMechanism.MONGODB_OIDC) {
+            if (this.username &&
+                this.mechanismProperties.ENVIRONMENT &&
+                this.mechanismProperties.ENVIRONMENT !== 'azure') {
+                throw new error_1.MongoInvalidArgumentError(`username and ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' may not be used together for mechanism '${this.mechanism}'.`);
+            }
+            if (this.username && this.password) {
+                throw new error_1.MongoInvalidArgumentError(`No password is allowed in ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' for '${this.mechanism}'.`);
+            }
+            if ((this.mechanismProperties.ENVIRONMENT === 'azure' ||
+                this.mechanismProperties.ENVIRONMENT === 'gcp') &&
+                !this.mechanismProperties.TOKEN_RESOURCE) {
+                throw new error_1.MongoInvalidArgumentError(TOKEN_RESOURCE_MISSING_ERROR);
+            }
+            if (this.mechanismProperties.ENVIRONMENT &&
+                !ALLOWED_ENVIRONMENT_NAMES.includes(this.mechanismProperties.ENVIRONMENT)) {
+                throw new error_1.MongoInvalidArgumentError(`Currently only a ENVIRONMENT in ${ALLOWED_ENVIRONMENT_NAMES.join(',')} is supported for mechanism '${this.mechanism}'.`);
+            }
+            if (!this.mechanismProperties.ENVIRONMENT &&
+                !this.mechanismProperties.OIDC_CALLBACK &&
+                !this.mechanismProperties.OIDC_HUMAN_CALLBACK) {
+                throw new error_1.MongoInvalidArgumentError(`Either a ENVIRONMENT, OIDC_CALLBACK, or OIDC_HUMAN_CALLBACK must be specified for mechanism '${this.mechanism}'.`);
+            }
+            if (this.mechanismProperties.ALLOWED_HOSTS) {
+                const hosts = this.mechanismProperties.ALLOWED_HOSTS;
+                if (!Array.isArray(hosts)) {
+                    throw new error_1.MongoInvalidArgumentError(ALLOWED_HOSTS_ERROR);
+                }
+                for (const host of hosts) {
+                    if (typeof host !== 'string') {
+                        throw new error_1.MongoInvalidArgumentError(ALLOWED_HOSTS_ERROR);
+                    }
+                }
+            }
+        }
+        if (providers_1.AUTH_MECHS_AUTH_SRC_EXTERNAL.has(this.mechanism)) {
+            if (this.source != null && this.source !== '$external') {
+                // TODO(NODE-3485): Replace this with a MongoAuthValidationError
+                throw new error_1.MongoAPIError(`Invalid source '${this.source}' for mechanism '${this.mechanism}' specified.`);
+            }
+        }
+        if (this.mechanism === providers_1.AuthMechanism.MONGODB_PLAIN && this.source == null) {
+            // TODO(NODE-3485): Replace this with a MongoAuthValidationError
+            throw new error_1.MongoAPIError('PLAIN Authentication Mechanism needs an auth source');
+        }
+        if (this.mechanism === providers_1.AuthMechanism.MONGODB_X509 && this.password != null) {
+            if (this.password === '') {
+                Reflect.set(this, 'password', undefined);
+                return;
+            }
+            // TODO(NODE-3485): Replace this with a MongoAuthValidationError
+            throw new error_1.MongoAPIError(`Password not allowed for mechanism MONGODB-X509`);
+        }
+        const canonicalization = this.mechanismProperties.CANONICALIZE_HOST_NAME ?? false;
+        if (!Object.values(gssapi_1.GSSAPICanonicalizationValue).includes(canonicalization)) {
+            throw new error_1.MongoAPIError(`Invalid CANONICALIZE_HOST_NAME value: ${canonicalization}`);
+        }
+    }
+    static merge(creds, options) {
+        return new MongoCredentials({
+            username: options.username ?? creds?.username ?? '',
+            password: options.password ?? creds?.password ?? '',
+            mechanism: options.mechanism ?? creds?.mechanism ?? providers_1.AuthMechanism.MONGODB_DEFAULT,
+            mechanismProperties: options.mechanismProperties ?? creds?.mechanismProperties ?? {},
+            source: options.source ?? options.db ?? creds?.source ?? 'admin'
+        });
+    }
+}
+exports.MongoCredentials = MongoCredentials;
+//# sourceMappingURL=mongo_credentials.js.map

package/.output/server/node_modules/mongodb/lib/cmap/auth/mongodb_aws.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MongoDBAWS = void 0;
+const BSON = require("../../bson");
+const deps_1 = require("../../deps");
+const error_1 = require("../../error");
+const utils_1 = require("../../utils");
+const auth_provider_1 = require("./auth_provider");
+const aws_temporary_credentials_1 = require("./aws_temporary_credentials");
+const mongo_credentials_1 = require("./mongo_credentials");
+const providers_1 = require("./providers");
+const ASCII_N = 110;
+const bsonOptions = {
+    useBigInt64: false,
+    promoteLongs: true,
+    promoteValues: true,
+    promoteBuffers: false,
+    bsonRegExp: false
+};
+class MongoDBAWS extends auth_provider_1.AuthProvider {
+    constructor(credentialProvider) {
+        super();
+        this.credentialProvider = credentialProvider;
+        this.credentialFetcher = aws_temporary_credentials_1.AWSTemporaryCredentialProvider.isAWSSDKInstalled
+            ? new aws_temporary_credentials_1.AWSSDKCredentialProvider(credentialProvider)
+            : new aws_temporary_credentials_1.LegacyAWSTemporaryCredentialProvider();
+    }
+    async auth(authContext) {
+        const { connection } = authContext;
+        if (!authContext.credentials) {
+            throw new error_1.MongoMissingCredentialsError('AuthContext must provide credentials.');
+        }
+        if ('kModuleError' in deps_1.aws4) {
+            throw deps_1.aws4['kModuleError'];
+        }
+        const { sign } = deps_1.aws4;
+        if ((0, utils_1.maxWireVersion)(connection) < 9) {
+            throw new error_1.MongoCompatibilityError('MONGODB-AWS authentication requires MongoDB version 4.4 or later');
+        }
+        if (!authContext.credentials.username) {
+            authContext.credentials = await makeTempCredentials(authContext.credentials, this.credentialFetcher);
+        }
+        const { credentials } = authContext;
+        const accessKeyId = credentials.username;
+        const secretAccessKey = credentials.password;
+        // Allow the user to specify an AWS session token for authentication with temporary credentials.
+        const sessionToken = credentials.mechanismProperties.AWS_SESSION_TOKEN;
+        // If all three defined, include sessionToken, else include username and pass, else no credentials
+        const awsCredentials = accessKeyId && secretAccessKey && sessionToken
+            ? { accessKeyId, secretAccessKey, sessionToken }
+            : accessKeyId && secretAccessKey
+                ? { accessKeyId, secretAccessKey }
+                : undefined;
+        const db = credentials.source;
+        const nonce = await (0, utils_1.randomBytes)(32);
+        // All messages between MongoDB clients and servers are sent as BSON objects
+        // in the payload field of saslStart and saslContinue.
+        const saslStart = {
+            saslStart: 1,
+            mechanism: 'MONGODB-AWS',
+            payload: BSON.serialize({ r: nonce, p: ASCII_N }, bsonOptions)
+        };
+        const saslStartResponse = await connection.command((0, utils_1.ns)(`${db}.$cmd`), saslStart, undefined);
+        const serverResponse = BSON.deserialize(saslStartResponse.payload.buffer, bsonOptions);
+        const host = serverResponse.h;
+        const serverNonce = serverResponse.s.buffer;
+        if (serverNonce.length !== 64) {
+            // TODO(NODE-3483)
+            throw new error_1.MongoRuntimeError(`Invalid server nonce length ${serverNonce.length}, expected 64`);
+        }
+        if (!utils_1.ByteUtils.equals(serverNonce.subarray(0, nonce.byteLength), nonce)) {
+            // throw because the serverNonce's leading 32 bytes must equal the client nonce's 32 bytes
+            // https://github.com/mongodb/specifications/blob/master/source/auth/auth.md#conversation-5
+            // TODO(NODE-3483)
+            throw new error_1.MongoRuntimeError('Server nonce does not begin with client nonce');
+        }
+        if (host.length < 1 || host.length > 255 || host.indexOf('..') !== -1) {
+            // TODO(NODE-3483)
+            throw new error_1.MongoRuntimeError(`Server returned an invalid host: "${host}"`);
+        }
+        const body = 'Action=GetCallerIdentity&Version=2011-06-15';
+        const options = sign({
+            method: 'POST',
+            host,
+            region: deriveRegion(serverResponse.h),
+            service: 'sts',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'Content-Length': body.length,
+                'X-MongoDB-Server-Nonce': utils_1.ByteUtils.toBase64(serverNonce),
+                'X-MongoDB-GS2-CB-Flag': 'n'
+            },
+            path: '/',
+            body
+        }, awsCredentials);
+        const payload = {
+            a: options.headers.Authorization,
+            d: options.headers['X-Amz-Date']
+        };
+        if (sessionToken) {
+            payload.t = sessionToken;
+        }
+        const saslContinue = {
+            saslContinue: 1,
+            conversationId: saslStartResponse.conversationId,
+            payload: BSON.serialize(payload, bsonOptions)
+        };
+        await connection.command((0, utils_1.ns)(`${db}.$cmd`), saslContinue, undefined);
+    }
+}
+exports.MongoDBAWS = MongoDBAWS;
+async function makeTempCredentials(credentials, awsCredentialFetcher) {
+    function makeMongoCredentialsFromAWSTemp(creds) {
+        // The AWS session token (creds.Token) may or may not be set.
+        if (!creds.AccessKeyId || !creds.SecretAccessKey) {
+            throw new error_1.MongoMissingCredentialsError('Could not obtain temporary MONGODB-AWS credentials');
+        }
+        return new mongo_credentials_1.MongoCredentials({
+            username: creds.AccessKeyId,
+            password: creds.SecretAccessKey,
+            source: credentials.source,
+            mechanism: providers_1.AuthMechanism.MONGODB_AWS,
+            mechanismProperties: {
+                AWS_SESSION_TOKEN: creds.Token
+            }
+        });
+    }
+    const temporaryCredentials = await awsCredentialFetcher.getCredentials();
+    return makeMongoCredentialsFromAWSTemp(temporaryCredentials);
+}
+function deriveRegion(host) {
+    const parts = host.split('.');
+    if (parts.length === 1 || parts[1] === 'amazonaws') {
+        return 'us-east-1';
+    }
+    return parts[1];
+}
+//# sourceMappingURL=mongodb_aws.js.map

package/.output/server/node_modules/mongodb/lib/cmap/auth/mongodb_oidc/automated_callback_workflow.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AutomatedCallbackWorkflow = void 0;
+const error_1 = require("../../../error");
+const timeout_1 = require("../../../timeout");
+const mongodb_oidc_1 = require("../mongodb_oidc");
+const callback_workflow_1 = require("./callback_workflow");
+/**
+ * Class implementing behaviour for the non human callback workflow.
+ * @internal
+ */
+class AutomatedCallbackWorkflow extends callback_workflow_1.CallbackWorkflow {
+    /**
+     * Instantiate the human callback workflow.
+     */
+    constructor(cache, callback) {
+        super(cache, callback);
+    }
+    /**
+     * Execute the OIDC callback workflow.
+     */
+    async execute(connection, credentials) {
+        // If there is a cached access token, try to authenticate with it. If
+        // authentication fails with an Authentication error (18),
+        // invalidate the access token, fetch a new access token, and try
+        // to authenticate again.
+        // If the server fails for any other reason, do not clear the cache.
+        if (this.cache.hasAccessToken) {
+            const token = this.cache.getAccessToken();
+            if (!connection.accessToken) {
+                connection.accessToken = token;
+            }
+            try {
+                return await this.finishAuthentication(connection, credentials, token);
+            }
+            catch (error) {
+                if (error instanceof error_1.MongoError &&
+                    error.code === error_1.MONGODB_ERROR_CODES.AuthenticationFailed) {
+                    this.cache.removeAccessToken();
+                    return await this.execute(connection, credentials);
+                }
+                else {
+                    throw error;
+                }
+            }
+        }
+        const response = await this.fetchAccessToken(credentials);
+        this.cache.put(response);
+        connection.accessToken = response.accessToken;
+        await this.finishAuthentication(connection, credentials, response.accessToken);
+    }
+    /**
+     * Fetches the access token using the callback.
+     */
+    async fetchAccessToken(credentials) {
+        const controller = new AbortController();
+        const params = {
+            timeoutContext: controller.signal,
+            version: mongodb_oidc_1.OIDC_VERSION
+        };
+        if (credentials.username) {
+            params.username = credentials.username;
+        }
+        if (credentials.mechanismProperties.TOKEN_RESOURCE) {
+            params.tokenAudience = credentials.mechanismProperties.TOKEN_RESOURCE;
+        }
+        const timeout = timeout_1.Timeout.expires(callback_workflow_1.AUTOMATED_TIMEOUT_MS);
+        try {
+            return await Promise.race([this.executeAndValidateCallback(params), timeout]);
+        }
+        catch (error) {
+            if (timeout_1.TimeoutError.is(error)) {
+                controller.abort();
+                throw new error_1.MongoOIDCError(`OIDC callback timed out after ${callback_workflow_1.AUTOMATED_TIMEOUT_MS}ms.`);
+            }
+            throw error;
+        }
+        finally {
+            timeout.clear();
+        }
+    }
+}
+exports.AutomatedCallbackWorkflow = AutomatedCallbackWorkflow;
+//# sourceMappingURL=automated_callback_workflow.js.map

package/.output/server/node_modules/mongodb/lib/cmap/auth/mongodb_oidc/azure_machine_workflow.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.callback = void 0;
+const azure_1 = require("../../../client-side-encryption/providers/azure");
+const error_1 = require("../../../error");
+const utils_1 = require("../../../utils");
+/** Azure request headers. */
+const AZURE_HEADERS = Object.freeze({ Metadata: 'true', Accept: 'application/json' });
+/** Invalid endpoint result error. */
+const ENDPOINT_RESULT_ERROR = 'Azure endpoint did not return a value with only access_token and expires_in properties';
+/** Error for when the token audience is missing in the environment. */
+const TOKEN_RESOURCE_MISSING_ERROR = 'TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is azure.';
+/**
+ * The callback function to be used in the automated callback workflow.
+ * @param params - The OIDC callback parameters.
+ * @returns The OIDC response.
+ */
+const callback = async (params) => {
+    const tokenAudience = params.tokenAudience;
+    const username = params.username;
+    if (!tokenAudience) {
+        throw new error_1.MongoAzureError(TOKEN_RESOURCE_MISSING_ERROR);
+    }
+    const response = await getAzureTokenData(tokenAudience, username);
+    if (!isEndpointResultValid(response)) {
+        throw new error_1.MongoAzureError(ENDPOINT_RESULT_ERROR);
+    }
+    return response;
+};
+exports.callback = callback;
+/**
+ * Hit the Azure endpoint to get the token data.
+ */
+async function getAzureTokenData(tokenAudience, username) {
+    const url = new URL(azure_1.AZURE_BASE_URL);
+    (0, azure_1.addAzureParams)(url, tokenAudience, username);
+    const response = await (0, utils_1.get)(url, {
+        headers: AZURE_HEADERS
+    });
+    if (response.status !== 200) {
+        throw new error_1.MongoAzureError(`Status code ${response.status} returned from the Azure endpoint. Response body: ${response.body}`);
+    }
+    const result = JSON.parse(response.body);
+    return {
+        accessToken: result.access_token,
+        expiresInSeconds: Number(result.expires_in)
+    };
+}
+/**
+ * Determines if a result returned from the endpoint is valid.
+ * This means the result is not nullish, contains the access_token required field
+ * and the expires_in required field.
+ */
+function isEndpointResultValid(token) {
+    if (token == null || typeof token !== 'object')
+        return false;
+    return ('accessToken' in token &&
+        typeof token.accessToken === 'string' &&
+        'expiresInSeconds' in token &&
+        typeof token.expiresInSeconds === 'number');
+}
+//# sourceMappingURL=azure_machine_workflow.js.map