@nullix/zod-mongoose-studio 0.0.1

package/.output/server/node_modules/mongodb/lib/cmap/auth/scram.js

@@ -0,0 +1,254 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScramSHA256 = exports.ScramSHA1 = void 0;
+const saslprep_1 = require("@mongodb-js/saslprep");
+const crypto = require("crypto");
+const bson_1 = require("../../bson");
+const error_1 = require("../../error");
+const utils_1 = require("../../utils");
+const auth_provider_1 = require("./auth_provider");
+const providers_1 = require("./providers");
+class ScramSHA extends auth_provider_1.AuthProvider {
+    constructor(cryptoMethod) {
+        super();
+        this.cryptoMethod = cryptoMethod || 'sha1';
+    }
+    async prepare(handshakeDoc, authContext) {
+        const cryptoMethod = this.cryptoMethod;
+        const credentials = authContext.credentials;
+        if (!credentials) {
+            throw new error_1.MongoMissingCredentialsError('AuthContext must provide credentials.');
+        }
+        const nonce = await (0, utils_1.randomBytes)(24);
+        // store the nonce for later use
+        authContext.nonce = nonce;
+        const request = {
+            ...handshakeDoc,
+            speculativeAuthenticate: {
+                ...makeFirstMessage(cryptoMethod, credentials, nonce),
+                db: credentials.source
+            }
+        };
+        return request;
+    }
+    async auth(authContext) {
+        const { reauthenticating, response } = authContext;
+        if (response?.speculativeAuthenticate && !reauthenticating) {
+            return await continueScramConversation(this.cryptoMethod, response.speculativeAuthenticate, authContext);
+        }
+        return await executeScram(this.cryptoMethod, authContext);
+    }
+}
+function cleanUsername(username) {
+    return username.replace('=', '=3D').replace(',', '=2C');
+}
+function clientFirstMessageBare(username, nonce) {
+    // NOTE: This is done b/c Javascript uses UTF-16, but the server is hashing in UTF-8.
+    // Since the username is not sasl-prep-d, we need to do this here.
+    return Buffer.concat([
+        Buffer.from('n=', 'utf8'),
+        Buffer.from(username, 'utf8'),
+        Buffer.from(',r=', 'utf8'),
+        Buffer.from(nonce.toString('base64'), 'utf8')
+    ]);
+}
+function makeFirstMessage(cryptoMethod, credentials, nonce) {
+    const username = cleanUsername(credentials.username);
+    const mechanism = cryptoMethod === 'sha1' ? providers_1.AuthMechanism.MONGODB_SCRAM_SHA1 : providers_1.AuthMechanism.MONGODB_SCRAM_SHA256;
+    // NOTE: This is done b/c Javascript uses UTF-16, but the server is hashing in UTF-8.
+    // Since the username is not sasl-prep-d, we need to do this here.
+    return {
+        saslStart: 1,
+        mechanism,
+        payload: new bson_1.Binary(Buffer.concat([Buffer.from('n,,', 'utf8'), clientFirstMessageBare(username, nonce)])),
+        autoAuthorize: 1,
+        options: { skipEmptyExchange: true }
+    };
+}
+async function executeScram(cryptoMethod, authContext) {
+    const { connection, credentials } = authContext;
+    if (!credentials) {
+        throw new error_1.MongoMissingCredentialsError('AuthContext must provide credentials.');
+    }
+    if (!authContext.nonce) {
+        throw new error_1.MongoInvalidArgumentError('AuthContext must contain a valid nonce property');
+    }
+    const nonce = authContext.nonce;
+    const db = credentials.source;
+    const saslStartCmd = makeFirstMessage(cryptoMethod, credentials, nonce);
+    const response = await connection.command((0, utils_1.ns)(`${db}.$cmd`), saslStartCmd, undefined);
+    await continueScramConversation(cryptoMethod, response, authContext);
+}
+async function continueScramConversation(cryptoMethod, response, authContext) {
+    const connection = authContext.connection;
+    const credentials = authContext.credentials;
+    if (!credentials) {
+        throw new error_1.MongoMissingCredentialsError('AuthContext must provide credentials.');
+    }
+    if (!authContext.nonce) {
+        throw new error_1.MongoInvalidArgumentError('Unable to continue SCRAM without valid nonce');
+    }
+    const nonce = authContext.nonce;
+    const db = credentials.source;
+    const username = cleanUsername(credentials.username);
+    const password = credentials.password;
+    const processedPassword = cryptoMethod === 'sha256' ? (0, saslprep_1.saslprep)(password) : passwordDigest(username, password);
+    const payload = Buffer.isBuffer(response.payload)
+        ? new bson_1.Binary(response.payload)
+        : response.payload;
+    const dict = parsePayload(payload);
+    const iterations = parseInt(dict.i, 10);
+    if (iterations && iterations < 4096) {
+        // TODO(NODE-3483)
+        throw new error_1.MongoRuntimeError(`Server returned an invalid iteration count ${iterations}`);
+    }
+    const salt = dict.s;
+    const rnonce = dict.r;
+    if (rnonce.startsWith('nonce')) {
+        // TODO(NODE-3483)
+        throw new error_1.MongoRuntimeError(`Server returned an invalid nonce: ${rnonce}`);
+    }
+    // Set up start of proof
+    const withoutProof = `c=biws,r=${rnonce}`;
+    const saltedPassword = HI(processedPassword, Buffer.from(salt, 'base64'), iterations, cryptoMethod);
+    const clientKey = HMAC(cryptoMethod, saltedPassword, 'Client Key');
+    const serverKey = HMAC(cryptoMethod, saltedPassword, 'Server Key');
+    const storedKey = H(cryptoMethod, clientKey);
+    const authMessage = [
+        clientFirstMessageBare(username, nonce),
+        payload.toString('utf8'),
+        withoutProof
+    ].join(',');
+    const clientSignature = HMAC(cryptoMethod, storedKey, authMessage);
+    const clientProof = `p=${xor(clientKey, clientSignature)}`;
+    const clientFinal = [withoutProof, clientProof].join(',');
+    const serverSignature = HMAC(cryptoMethod, serverKey, authMessage);
+    const saslContinueCmd = {
+        saslContinue: 1,
+        conversationId: response.conversationId,
+        payload: new bson_1.Binary(Buffer.from(clientFinal))
+    };
+    const r = await connection.command((0, utils_1.ns)(`${db}.$cmd`), saslContinueCmd, undefined);
+    const parsedResponse = parsePayload(r.payload);
+    if (!compareDigest(Buffer.from(parsedResponse.v, 'base64'), serverSignature)) {
+        throw new error_1.MongoRuntimeError('Server returned an invalid signature');
+    }
+    if (r.done !== false) {
+        // If the server sends r.done === true we can save one RTT
+        return;
+    }
+    const retrySaslContinueCmd = {
+        saslContinue: 1,
+        conversationId: r.conversationId,
+        payload: Buffer.alloc(0)
+    };
+    await connection.command((0, utils_1.ns)(`${db}.$cmd`), retrySaslContinueCmd, undefined);
+}
+function parsePayload(payload) {
+    const payloadStr = payload.toString('utf8');
+    const dict = {};
+    const parts = payloadStr.split(',');
+    for (let i = 0; i < parts.length; i++) {
+        const valueParts = (parts[i].match(/^([^=]*)=(.*)$/) ?? []).slice(1);
+        dict[valueParts[0]] = valueParts[1];
+    }
+    return dict;
+}
+function passwordDigest(username, password) {
+    if (typeof username !== 'string') {
+        throw new error_1.MongoInvalidArgumentError('Username must be a string');
+    }
+    if (typeof password !== 'string') {
+        throw new error_1.MongoInvalidArgumentError('Password must be a string');
+    }
+    if (password.length === 0) {
+        throw new error_1.MongoInvalidArgumentError('Password cannot be empty');
+    }
+    let md5;
+    try {
+        md5 = crypto.createHash('md5');
+    }
+    catch (err) {
+        if (crypto.getFips()) {
+            // This error is (slightly) more helpful than what comes from OpenSSL directly, e.g.
+            // 'Error: error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS'
+            throw new Error('Auth mechanism SCRAM-SHA-1 is not supported in FIPS mode');
+        }
+        throw err;
+    }
+    md5.update(`${username}:mongo:${password}`, 'utf8');
+    return md5.digest('hex');
+}
+// XOR two buffers
+function xor(a, b) {
+    if (!Buffer.isBuffer(a)) {
+        a = Buffer.from(a);
+    }
+    if (!Buffer.isBuffer(b)) {
+        b = Buffer.from(b);
+    }
+    const length = Math.max(a.length, b.length);
+    const res = [];
+    for (let i = 0; i < length; i += 1) {
+        res.push(a[i] ^ b[i]);
+    }
+    return Buffer.from(res).toString('base64');
+}
+function H(method, text) {
+    return crypto.createHash(method).update(text).digest();
+}
+function HMAC(method, key, text) {
+    return crypto.createHmac(method, key).update(text).digest();
+}
+let _hiCache = {};
+let _hiCacheCount = 0;
+function _hiCachePurge() {
+    _hiCache = {};
+    _hiCacheCount = 0;
+}
+const hiLengthMap = {
+    sha256: 32,
+    sha1: 20
+};
+function HI(data, salt, iterations, cryptoMethod) {
+    // omit the work if already generated
+    const key = [data, salt.toString('base64'), iterations].join('_');
+    if (_hiCache[key] != null) {
+        return _hiCache[key];
+    }
+    // generate the salt
+    const saltedData = crypto.pbkdf2Sync(data, salt, iterations, hiLengthMap[cryptoMethod], cryptoMethod);
+    // cache a copy to speed up the next lookup, but prevent unbounded cache growth
+    if (_hiCacheCount >= 200) {
+        _hiCachePurge();
+    }
+    _hiCache[key] = saltedData;
+    _hiCacheCount += 1;
+    return saltedData;
+}
+function compareDigest(lhs, rhs) {
+    if (lhs.length !== rhs.length) {
+        return false;
+    }
+    if (typeof crypto.timingSafeEqual === 'function') {
+        return crypto.timingSafeEqual(lhs, rhs);
+    }
+    let result = 0;
+    for (let i = 0; i < lhs.length; i++) {
+        result |= lhs[i] ^ rhs[i];
+    }
+    return result === 0;
+}
+class ScramSHA1 extends ScramSHA {
+    constructor() {
+        super('sha1');
+    }
+}
+exports.ScramSHA1 = ScramSHA1;
+class ScramSHA256 extends ScramSHA {
+    constructor() {
+        super('sha256');
+    }
+}
+exports.ScramSHA256 = ScramSHA256;
+//# sourceMappingURL=scram.js.map

package/.output/server/node_modules/mongodb/lib/cmap/auth/x509.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.X509 = void 0;
+const error_1 = require("../../error");
+const utils_1 = require("../../utils");
+const auth_provider_1 = require("./auth_provider");
+class X509 extends auth_provider_1.AuthProvider {
+    async prepare(handshakeDoc, authContext) {
+        const { credentials } = authContext;
+        if (!credentials) {
+            throw new error_1.MongoMissingCredentialsError('AuthContext must provide credentials.');
+        }
+        return { ...handshakeDoc, speculativeAuthenticate: x509AuthenticateCommand(credentials) };
+    }
+    async auth(authContext) {
+        const connection = authContext.connection;
+        const credentials = authContext.credentials;
+        if (!credentials) {
+            throw new error_1.MongoMissingCredentialsError('AuthContext must provide credentials.');
+        }
+        const response = authContext.response;
+        if (response?.speculativeAuthenticate) {
+            return;
+        }
+        await connection.command((0, utils_1.ns)('$external.$cmd'), x509AuthenticateCommand(credentials), undefined);
+    }
+}
+exports.X509 = X509;
+function x509AuthenticateCommand(credentials) {
+    const command = { authenticate: 1, mechanism: 'MONGODB-X509' };
+    if (credentials.username) {
+        command.user = credentials.username;
+    }
+    return command;
+}
+//# sourceMappingURL=x509.js.map

package/.output/server/node_modules/mongodb/lib/cmap/command_monitoring_events.js

@@ -0,0 +1,223 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SENSITIVE_COMMANDS = exports.CommandFailedEvent = exports.CommandSucceededEvent = exports.CommandStartedEvent = void 0;
+const constants_1 = require("../constants");
+const utils_1 = require("../utils");
+const commands_1 = require("./commands");
+/**
+ * An event indicating the start of a given command
+ * @public
+ * @category Event
+ */
+class CommandStartedEvent {
+    /**
+     * Create a started event
+     *
+     * @internal
+     * @param pool - the pool that originated the command
+     * @param command - the command
+     */
+    constructor(connection, command, serverConnectionId) {
+        /** @internal */
+        this.name = constants_1.COMMAND_STARTED;
+        const cmd = extractCommand(command);
+        const commandName = extractCommandName(cmd);
+        const { address, connectionId, serviceId } = extractConnectionDetails(connection);
+        // TODO: remove in major revision, this is not spec behavior
+        if (exports.SENSITIVE_COMMANDS.has(commandName)) {
+            this.commandObj = {};
+            this.commandObj[commandName] = true;
+        }
+        this.address = address;
+        this.connectionId = connectionId;
+        this.serviceId = serviceId;
+        this.requestId = command.requestId;
+        this.databaseName = command.databaseName;
+        this.commandName = commandName;
+        this.command = maybeRedact(commandName, cmd, cmd);
+        this.serverConnectionId = serverConnectionId;
+    }
+    /* @internal */
+    get hasServiceId() {
+        return !!this.serviceId;
+    }
+}
+exports.CommandStartedEvent = CommandStartedEvent;
+/**
+ * An event indicating the success of a given command
+ * @public
+ * @category Event
+ */
+class CommandSucceededEvent {
+    /**
+     * Create a succeeded event
+     *
+     * @internal
+     * @param pool - the pool that originated the command
+     * @param command - the command
+     * @param reply - the reply for this command from the server
+     * @param started - a high resolution tuple timestamp of when the command was first sent, to calculate duration
+     */
+    constructor(connection, command, reply, started, serverConnectionId) {
+        /** @internal */
+        this.name = constants_1.COMMAND_SUCCEEDED;
+        const cmd = extractCommand(command);
+        const commandName = extractCommandName(cmd);
+        const { address, connectionId, serviceId } = extractConnectionDetails(connection);
+        this.address = address;
+        this.connectionId = connectionId;
+        this.serviceId = serviceId;
+        this.requestId = command.requestId;
+        this.commandName = commandName;
+        this.duration = (0, utils_1.calculateDurationInMs)(started);
+        this.reply = maybeRedact(commandName, cmd, extractReply(reply));
+        this.serverConnectionId = serverConnectionId;
+        this.databaseName = command.databaseName;
+    }
+    /* @internal */
+    get hasServiceId() {
+        return !!this.serviceId;
+    }
+}
+exports.CommandSucceededEvent = CommandSucceededEvent;
+/**
+ * An event indicating the failure of a given command
+ * @public
+ * @category Event
+ */
+class CommandFailedEvent {
+    /**
+     * Create a failure event
+     *
+     * @internal
+     * @param pool - the pool that originated the command
+     * @param command - the command
+     * @param error - the generated error or a server error response
+     * @param started - a high resolution tuple timestamp of when the command was first sent, to calculate duration
+     */
+    constructor(connection, command, error, started, serverConnectionId) {
+        /** @internal */
+        this.name = constants_1.COMMAND_FAILED;
+        const cmd = extractCommand(command);
+        const commandName = extractCommandName(cmd);
+        const { address, connectionId, serviceId } = extractConnectionDetails(connection);
+        this.address = address;
+        this.connectionId = connectionId;
+        this.serviceId = serviceId;
+        this.requestId = command.requestId;
+        this.commandName = commandName;
+        this.duration = (0, utils_1.calculateDurationInMs)(started);
+        this.failure = maybeRedact(commandName, cmd, error);
+        this.serverConnectionId = serverConnectionId;
+        this.databaseName = command.databaseName;
+    }
+    /* @internal */
+    get hasServiceId() {
+        return !!this.serviceId;
+    }
+}
+exports.CommandFailedEvent = CommandFailedEvent;
+/**
+ * Commands that we want to redact because of the sensitive nature of their contents
+ * @internal
+ */
+exports.SENSITIVE_COMMANDS = new Set([
+    'authenticate',
+    'saslStart',
+    'saslContinue',
+    'getnonce',
+    'createUser',
+    'updateUser',
+    'copydbgetnonce',
+    'copydbsaslstart',
+    'copydb'
+]);
+const HELLO_COMMANDS = new Set(['hello', constants_1.LEGACY_HELLO_COMMAND, constants_1.LEGACY_HELLO_COMMAND_CAMEL_CASE]);
+// helper methods
+const extractCommandName = (commandDoc) => Object.keys(commandDoc)[0];
+const collectionName = (command) => command.ns.split('.')[1];
+const maybeRedact = (commandName, commandDoc, result) => exports.SENSITIVE_COMMANDS.has(commandName) ||
+    (HELLO_COMMANDS.has(commandName) && commandDoc.speculativeAuthenticate)
+    ? {}
+    : result;
+const LEGACY_FIND_QUERY_MAP = {
+    $query: 'filter',
+    $orderby: 'sort',
+    $hint: 'hint',
+    $comment: 'comment',
+    $maxScan: 'maxScan',
+    $max: 'max',
+    $min: 'min',
+    $returnKey: 'returnKey',
+    $showDiskLoc: 'showRecordId',
+    $maxTimeMS: 'maxTimeMS',
+    $snapshot: 'snapshot'
+};
+const LEGACY_FIND_OPTIONS_MAP = {
+    numberToSkip: 'skip',
+    numberToReturn: 'batchSize',
+    returnFieldSelector: 'projection'
+};
+/** Extract the actual command from the query, possibly up-converting if it's a legacy format */
+function extractCommand(command) {
+    if (command instanceof commands_1.OpMsgRequest) {
+        const cmd = { ...command.command };
+        // For OP_MSG with payload type 1 we need to pull the documents
+        // array out of the document sequence for monitoring.
+        if (cmd.ops instanceof commands_1.DocumentSequence) {
+            cmd.ops = cmd.ops.documents;
+        }
+        if (cmd.nsInfo instanceof commands_1.DocumentSequence) {
+            cmd.nsInfo = cmd.nsInfo.documents;
+        }
+        return cmd;
+    }
+    if (command.query?.$query) {
+        let result;
+        if (command.ns === 'admin.$cmd') {
+            // up-convert legacy command
+            result = Object.assign({}, command.query.$query);
+        }
+        else {
+            // up-convert legacy find command
+            result = { find: collectionName(command) };
+            Object.keys(LEGACY_FIND_QUERY_MAP).forEach(key => {
+                if (command.query[key] != null) {
+                    result[LEGACY_FIND_QUERY_MAP[key]] = { ...command.query[key] };
+                }
+            });
+        }
+        Object.keys(LEGACY_FIND_OPTIONS_MAP).forEach(key => {
+            const legacyKey = key;
+            if (command[legacyKey] != null) {
+                result[LEGACY_FIND_OPTIONS_MAP[legacyKey]] = command[legacyKey];
+            }
+        });
+        return result;
+    }
+    let clonedQuery = {};
+    const clonedCommand = { ...command };
+    if (command.query) {
+        clonedQuery = { ...command.query };
+        clonedCommand.query = clonedQuery;
+    }
+    return command.query ? clonedQuery : clonedCommand;
+}
+function extractReply(reply) {
+    if (!reply) {
+        return reply;
+    }
+    return reply.result ? reply.result : reply;
+}
+function extractConnectionDetails(connection) {
+    let connectionId;
+    if ('id' in connection) {
+        connectionId = connection.id;
+    }
+    return {
+        address: connection.address,
+        serviceId: connection.serviceId,
+        connectionId
+    };
+}
+//# sourceMappingURL=command_monitoring_events.js.map