@nullix/zod-mongoose-studio 1.0.13 → 2.0.0

package/.output/server/node_modules/mongodb/lib/cmap/auth/aws_temporary_credentials.js

@@ -1,46 +1,31 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LegacyAWSTemporaryCredentialProvider = exports.AWSSDKCredentialProvider = exports.AWSTemporaryCredentialProvider = void 0;
+exports.AWSSDKCredentialProvider = void 0;
+const process = require("process");
 const deps_1 = require("../../deps");
 const error_1 = require("../../error");
-const utils_1 = require("../../utils");
-const AWS_RELATIVE_URI = 'http://169.254.170.2';
-const AWS_EC2_URI = 'http://169.254.169.254';
-const AWS_EC2_PATH = '/latest/meta-data/iam/security-credentials';
-/**
- * @internal
- *
- * Fetches temporary AWS credentials.
- */
-class AWSTemporaryCredentialProvider {
-    static get awsSDK() {
-        AWSTemporaryCredentialProvider._awsSDK ??= (0, deps_1.getAwsCredentialProvider)();
-        return AWSTemporaryCredentialProvider._awsSDK;
-    }
-    static get isAWSSDKInstalled() {
-        return !('kModuleError' in AWSTemporaryCredentialProvider.awsSDK);
-    }
-}
-exports.AWSTemporaryCredentialProvider = AWSTemporaryCredentialProvider;
 /** @internal */
-class AWSSDKCredentialProvider extends AWSTemporaryCredentialProvider {
+class AWSSDKCredentialProvider {
     /**
      * Create the SDK credentials provider.
      * @param credentialsProvider - The credentials provider.
      */
     constructor(credentialsProvider) {
-        super();
         if (credentialsProvider) {
             this._provider = credentialsProvider;
         }
     }
+    static get awsSDK() {
+        AWSSDKCredentialProvider._awsSDK ??= (0, deps_1.getAwsCredentialProvider)();
+        return AWSSDKCredentialProvider._awsSDK;
+    }
     /**
      * The AWS SDK caches credentials automatically and handles refresh when the credentials have expired.
      * To ensure this occurs, we need to cache the `provider` returned by the AWS sdk and re-use it when fetching credentials.
      */
     get provider() {
-        if ('kModuleError' in AWSTemporaryCredentialProvider.awsSDK) {
-            throw AWSTemporaryCredentialProvider.awsSDK.kModuleError;
+        if ('kModuleError' in AWSSDKCredentialProvider.awsSDK) {
+            throw AWSSDKCredentialProvider.awsSDK.kModuleError;
         }
         if (this._provider) {
             return this._provider;
@@ -83,10 +68,10 @@ class AWSSDKCredentialProvider extends AWSTemporaryCredentialProvider {
             (AWS_STS_REGIONAL_ENDPOINTS === 'legacy' && !LEGACY_REGIONS.has(AWS_REGION));
         this._provider =
             awsRegionSettingsExist && useRegionalSts
-                ? AWSTemporaryCredentialProvider.awsSDK.fromNodeProviderChain({
+                ? AWSSDKCredentialProvider.awsSDK.fromNodeProviderChain({
                     clientConfig: { region: AWS_REGION }
                 })
-                : AWSTemporaryCredentialProvider.awsSDK.fromNodeProviderChain();
+                : AWSSDKCredentialProvider.awsSDK.fromNodeProviderChain();
         return this._provider;
     }
     async getCredentials() {
@@ -115,36 +100,4 @@ class AWSSDKCredentialProvider extends AWSTemporaryCredentialProvider {
     }
 }
 exports.AWSSDKCredentialProvider = AWSSDKCredentialProvider;
-/**
- * @internal
- * Fetches credentials manually (without the AWS SDK), as outlined in the [Obtaining Credentials](https://github.com/mongodb/specifications/blob/master/source/auth/auth.md#obtaining-credentials)
- * section of the Auth spec.
- */
-class LegacyAWSTemporaryCredentialProvider extends AWSTemporaryCredentialProvider {
-    async getCredentials() {
-        // If the environment variable AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
-        // is set then drivers MUST assume that it was set by an AWS ECS agent
-        if (process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI) {
-            return await (0, utils_1.request)(`${AWS_RELATIVE_URI}${process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI}`);
-        }
-        // Otherwise assume we are on an EC2 instance
-        // get a token
-        const token = await (0, utils_1.request)(`${AWS_EC2_URI}/latest/api/token`, {
-            method: 'PUT',
-            json: false,
-            headers: { 'X-aws-ec2-metadata-token-ttl-seconds': 30 }
-        });
-        // get role name
-        const roleName = await (0, utils_1.request)(`${AWS_EC2_URI}/${AWS_EC2_PATH}`, {
-            json: false,
-            headers: { 'X-aws-ec2-metadata-token': token }
-        });
-        // get temp credentials
-        const creds = await (0, utils_1.request)(`${AWS_EC2_URI}/${AWS_EC2_PATH}/${roleName}`, {
-            headers: { 'X-aws-ec2-metadata-token': token }
-        });
-        return creds;
-    }
-}
-exports.LegacyAWSTemporaryCredentialProvider = LegacyAWSTemporaryCredentialProvider;
 //# sourceMappingURL=aws_temporary_credentials.js.map

package/.output/server/node_modules/mongodb/lib/cmap/auth/gssapi.js

@@ -42,9 +42,7 @@ class GSSAPI extends auth_provider_1.AuthProvider {
     }
 }
 exports.GSSAPI = GSSAPI;
-async function makeKerberosClient(authContext) {
-    const { hostAddress } = authContext.options;
-    const { credentials } = authContext;
+async function makeKerberosClient({ options: { hostAddress, runtime: { os } }, credentials }) {
     if (!hostAddress || typeof hostAddress.host !== 'string' || !credentials) {
         throw new error_1.MongoInvalidArgumentError('Connection must have host and port and credentials defined.');
     }
@@ -63,7 +61,7 @@ async function makeKerberosClient(authContext) {
         Object.assign(initOptions, { user: username, password: password });
     }
     const spnHost = mechanismProperties.SERVICE_HOST ?? host;
-    let spn = `${serviceName}${process.platform === 'win32' ? '/' : '@'}${spnHost}`;
+    let spn = `${serviceName}${os.platform() === 'win32' ? '/' : '@'}${spnHost}`;
     if ('SERVICE_REALM' in mechanismProperties) {
         spn = `${spn}@${mechanismProperties.SERVICE_REALM}`;
     }
@@ -115,7 +113,7 @@ async function performGSSAPICanonicalizeHostName(host, mechanismProperties) {
         const { address } = await dns.promises.lookup(host);
         try {
             // Perform a reverse ptr lookup on the ip address.
-            const results = await dns.promises.resolvePtr(address);
+            const results = await dns.promises.resolve(address, 'PTR');
             // If the ptr did not error but had no results, return the host.
             return results.length > 0 ? results[0] : host;
         }
@@ -135,7 +133,7 @@ async function performGSSAPICanonicalizeHostName(host, mechanismProperties) {
 async function resolveCname(host) {
     // Attempt to resolve the host name
     try {
-        const results = await dns.promises.resolveCname(host);
+        const results = await dns.promises.resolve(host, 'CNAME');
         // Get the first resolved host id
         return results.length > 0 ? results[0] : host;
     }

package/.output/server/node_modules/mongodb/lib/cmap/auth/mongo_credentials.js

@@ -35,7 +35,8 @@ exports.DEFAULT_ALLOWED_HOSTS = [
     '*.mongodbgov.net',
     'localhost',
     '127.0.0.1',
-    '::1'
+    '::1',
+    '*.mongo.com'
 ];
 /** Error for when the token audience is missing in the environment. */
 const TOKEN_RESOURCE_MISSING_ERROR = 'TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is azure or gcp.';
@@ -53,21 +54,6 @@ class MongoCredentials {
         }
         this.mechanism = options.mechanism || providers_1.AuthMechanism.MONGODB_DEFAULT;
         this.mechanismProperties = options.mechanismProperties || {};
-        if (this.mechanism.match(/MONGODB-AWS/i)) {
-            if (!this.username && process.env.AWS_ACCESS_KEY_ID) {
-                this.username = process.env.AWS_ACCESS_KEY_ID;
-            }
-            if (!this.password && process.env.AWS_SECRET_ACCESS_KEY) {
-                this.password = process.env.AWS_SECRET_ACCESS_KEY;
-            }
-            if (this.mechanismProperties.AWS_SESSION_TOKEN == null &&
-                process.env.AWS_SESSION_TOKEN != null) {
-                this.mechanismProperties = {
-                    ...this.mechanismProperties,
-                    AWS_SESSION_TOKEN: process.env.AWS_SESSION_TOKEN
-                };
-            }
-        }
         if (this.mechanism === providers_1.AuthMechanism.MONGODB_OIDC && !this.mechanismProperties.ALLOWED_HOSTS) {
             this.mechanismProperties = {
                 ...this.mechanismProperties,

package/.output/server/node_modules/mongodb/lib/cmap/auth/mongodb_aws.js

@@ -1,12 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MongoDBAWS = void 0;
+const bson_1 = require("../../bson");
 const BSON = require("../../bson");
-const deps_1 = require("../../deps");
 const error_1 = require("../../error");
 const utils_1 = require("../../utils");
 const auth_provider_1 = require("./auth_provider");
 const aws_temporary_credentials_1 = require("./aws_temporary_credentials");
+const aws4_1 = require("./aws4");
 const mongo_credentials_1 = require("./mongo_credentials");
 const providers_1 = require("./providers");
 const ASCII_N = 110;
@@ -20,37 +21,26 @@ const bsonOptions = {
 class MongoDBAWS extends auth_provider_1.AuthProvider {
     constructor(credentialProvider) {
         super();
-        this.credentialProvider = credentialProvider;
-        this.credentialFetcher = aws_temporary_credentials_1.AWSTemporaryCredentialProvider.isAWSSDKInstalled
-            ? new aws_temporary_credentials_1.AWSSDKCredentialProvider(credentialProvider)
-            : new aws_temporary_credentials_1.LegacyAWSTemporaryCredentialProvider();
+        this.credentialFetcher = new aws_temporary_credentials_1.AWSSDKCredentialProvider(credentialProvider);
     }
     async auth(authContext) {
         const { connection } = authContext;
         if (!authContext.credentials) {
             throw new error_1.MongoMissingCredentialsError('AuthContext must provide credentials.');
         }
-        if ('kModuleError' in deps_1.aws4) {
-            throw deps_1.aws4['kModuleError'];
-        }
-        const { sign } = deps_1.aws4;
         if ((0, utils_1.maxWireVersion)(connection) < 9) {
             throw new error_1.MongoCompatibilityError('MONGODB-AWS authentication requires MongoDB version 4.4 or later');
         }
-        if (!authContext.credentials.username) {
-            authContext.credentials = await makeTempCredentials(authContext.credentials, this.credentialFetcher);
-        }
+        authContext.credentials = await makeTempCredentials(authContext.credentials, this.credentialFetcher);
         const { credentials } = authContext;
         const accessKeyId = credentials.username;
         const secretAccessKey = credentials.password;
         // Allow the user to specify an AWS session token for authentication with temporary credentials.
         const sessionToken = credentials.mechanismProperties.AWS_SESSION_TOKEN;
-        // If all three defined, include sessionToken, else include username and pass, else no credentials
-        const awsCredentials = accessKeyId && secretAccessKey && sessionToken
+        // If all three defined, include sessionToken, else only include username and pass
+        const awsCredentials = sessionToken
             ? { accessKeyId, secretAccessKey, sessionToken }
-            : accessKeyId && secretAccessKey
-                ? { accessKeyId, secretAccessKey }
-                : undefined;
+            : { accessKeyId, secretAccessKey };
         const db = credentials.source;
         const nonce = await (0, utils_1.randomBytes)(32);
         // All messages between MongoDB clients and servers are sent as BSON objects
@@ -68,7 +58,7 @@ class MongoDBAWS extends auth_provider_1.AuthProvider {
             // TODO(NODE-3483)
             throw new error_1.MongoRuntimeError(`Invalid server nonce length ${serverNonce.length}, expected 64`);
         }
-        if (!utils_1.ByteUtils.equals(serverNonce.subarray(0, nonce.byteLength), nonce)) {
+        if (!bson_1.ByteUtils.equals(serverNonce.subarray(0, nonce.byteLength), nonce)) {
             // throw because the serverNonce's leading 32 bytes must equal the client nonce's 32 bytes
             // https://github.com/mongodb/specifications/blob/master/source/auth/auth.md#conversation-5
             // TODO(NODE-3483)
@@ -79,7 +69,7 @@ class MongoDBAWS extends auth_provider_1.AuthProvider {
             throw new error_1.MongoRuntimeError(`Server returned an invalid host: "${host}"`);
         }
         const body = 'Action=GetCallerIdentity&Version=2011-06-15';
-        const options = sign({
+        const headers = await (0, aws4_1.aws4Sign)({
             method: 'POST',
             host,
             region: deriveRegion(serverResponse.h),
@@ -87,15 +77,16 @@ class MongoDBAWS extends auth_provider_1.AuthProvider {
             headers: {
                 'Content-Type': 'application/x-www-form-urlencoded',
                 'Content-Length': body.length,
-                'X-MongoDB-Server-Nonce': utils_1.ByteUtils.toBase64(serverNonce),
+                'X-MongoDB-Server-Nonce': bson_1.ByteUtils.toBase64(serverNonce),
                 'X-MongoDB-GS2-CB-Flag': 'n'
             },
             path: '/',
-            body
+            body,
+            date: new Date()
         }, awsCredentials);
         const payload = {
-            a: options.headers.Authorization,
-            d: options.headers['X-Amz-Date']
+            a: headers.Authorization,
+            d: headers['X-Amz-Date']
         };
         if (sessionToken) {
             payload.t = sessionToken;

package/.output/server/node_modules/mongodb/lib/cmap/auth/mongodb_oidc/azure_machine_workflow.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.callback = void 0;
+exports.azureCallback = void 0;
 const azure_1 = require("../../../client-side-encryption/providers/azure");
 const error_1 = require("../../../error");
 const utils_1 = require("../../../utils");
@@ -15,7 +15,7 @@ const TOKEN_RESOURCE_MISSING_ERROR = 'TOKEN_RESOURCE must be set in the auth mec
  * @param params - The OIDC callback parameters.
  * @returns The OIDC response.
  */
-const callback = async (params) => {
+const azureCallback = async (params) => {
     const tokenAudience = params.tokenAudience;
     const username = params.username;
     if (!tokenAudience) {
@@ -27,7 +27,7 @@ const callback = async (params) => {
     }
     return response;
 };
-exports.callback = callback;
+exports.azureCallback = azureCallback;
 /**
  * Hit the Azure endpoint to get the token data.
  */

package/.output/server/node_modules/mongodb/lib/cmap/auth/mongodb_oidc/gcp_machine_workflow.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.callback = void 0;
+exports.gcpCallback = void 0;
 const error_1 = require("../../../error");
 const utils_1 = require("../../../utils");
 /** GCP base URL. */
@@ -14,14 +14,14 @@ const TOKEN_RESOURCE_MISSING_ERROR = 'TOKEN_RESOURCE must be set in the auth mec
  * @param params - The OIDC callback parameters.
  * @returns The OIDC response.
  */
-const callback = async (params) => {
+const gcpCallback = async (params) => {
     const tokenAudience = params.tokenAudience;
     if (!tokenAudience) {
         throw new error_1.MongoGCPError(TOKEN_RESOURCE_MISSING_ERROR);
     }
     return await getGcpTokenData(tokenAudience);
 };
-exports.callback = callback;
+exports.gcpCallback = gcpCallback;
 /**
  * Hit the GCP endpoint to get the token data.
  */

package/.output/server/node_modules/mongodb/lib/cmap/auth/mongodb_oidc/k8s_machine_workflow.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.callback = void 0;
+exports.k8sCallback = void 0;
 const promises_1 = require("fs/promises");
+const process = require("process");
 /** The fallback file name */
 const FALLBACK_FILENAME = '/var/run/secrets/kubernetes.io/serviceaccount/token';
 /** The azure environment variable for the file name. */
@@ -13,7 +14,7 @@ const AWS_FILENAME = 'AWS_WEB_IDENTITY_TOKEN_FILE';
  * @param params - The OIDC callback parameters.
  * @returns The OIDC response.
  */
-const callback = async () => {
+const k8sCallback = async () => {
     let filename;
     if (process.env[AZURE_FILENAME]) {
         filename = process.env[AZURE_FILENAME];
@@ -27,5 +28,5 @@ const callback = async () => {
     const token = await (0, promises_1.readFile)(filename, 'utf8');
     return { accessToken: token };
 };
-exports.callback = callback;
+exports.k8sCallback = k8sCallback;
 //# sourceMappingURL=k8s_machine_workflow.js.map

package/.output/server/node_modules/mongodb/lib/cmap/auth/mongodb_oidc/token_machine_workflow.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.callback = void 0;
+exports.tokenMachineCallback = void 0;
 const fs = require("fs");
+const process = require("process");
 const error_1 = require("../../../error");
 /** Error for when the token is missing in the environment. */
 const TOKEN_MISSING_ERROR = 'OIDC_TOKEN_FILE must be set in the environment.';
@@ -10,7 +11,7 @@ const TOKEN_MISSING_ERROR = 'OIDC_TOKEN_FILE must be set in the environment.';
  * @param params - The OIDC callback parameters.
  * @returns The OIDC response.
  */
-const callback = async () => {
+const tokenMachineCallback = async () => {
     const tokenFile = process.env.OIDC_TOKEN_FILE;
     if (!tokenFile) {
         throw new error_1.MongoAWSError(TOKEN_MISSING_ERROR);
@@ -18,5 +19,5 @@ const callback = async () => {
     const token = await fs.promises.readFile(tokenFile, 'utf8');
     return { accessToken: token };
 };
-exports.callback = callback;
+exports.tokenMachineCallback = tokenMachineCallback;
 //# sourceMappingURL=token_machine_workflow.js.map

package/.output/server/node_modules/mongodb/lib/cmap/auth/mongodb_oidc.js

@@ -15,10 +15,10 @@ const MISSING_CREDENTIALS_ERROR = 'AuthContext must provide credentials.';
 exports.OIDC_VERSION = 1;
 /** @internal */
 exports.OIDC_WORKFLOWS = new Map();
-exports.OIDC_WORKFLOWS.set('test', () => new automated_callback_workflow_1.AutomatedCallbackWorkflow(new token_cache_1.TokenCache(), token_machine_workflow_1.callback));
-exports.OIDC_WORKFLOWS.set('azure', () => new automated_callback_workflow_1.AutomatedCallbackWorkflow(new token_cache_1.TokenCache(), azure_machine_workflow_1.callback));
-exports.OIDC_WORKFLOWS.set('gcp', () => new automated_callback_workflow_1.AutomatedCallbackWorkflow(new token_cache_1.TokenCache(), gcp_machine_workflow_1.callback));
-exports.OIDC_WORKFLOWS.set('k8s', () => new automated_callback_workflow_1.AutomatedCallbackWorkflow(new token_cache_1.TokenCache(), k8s_machine_workflow_1.callback));
+exports.OIDC_WORKFLOWS.set('test', () => new automated_callback_workflow_1.AutomatedCallbackWorkflow(new token_cache_1.TokenCache(), token_machine_workflow_1.tokenMachineCallback));
+exports.OIDC_WORKFLOWS.set('azure', () => new automated_callback_workflow_1.AutomatedCallbackWorkflow(new token_cache_1.TokenCache(), azure_machine_workflow_1.azureCallback));
+exports.OIDC_WORKFLOWS.set('gcp', () => new automated_callback_workflow_1.AutomatedCallbackWorkflow(new token_cache_1.TokenCache(), gcp_machine_workflow_1.gcpCallback));
+exports.OIDC_WORKFLOWS.set('k8s', () => new automated_callback_workflow_1.AutomatedCallbackWorkflow(new token_cache_1.TokenCache(), k8s_machine_workflow_1.k8sCallback));
 /**
  * OIDC auth provider.
  */

package/.output/server/node_modules/mongodb/lib/cmap/auth/plain.js

@@ -12,7 +12,7 @@ class Plain extends auth_provider_1.AuthProvider {
             throw new error_1.MongoMissingCredentialsError('AuthContext must provide credentials.');
         }
         const { username, password } = credentials;
-        const payload = new bson_1.Binary(Buffer.from(`\x00${username}\x00${password}`));
+        const payload = new bson_1.Binary(bson_1.ByteUtils.fromUTF8(`\x00${username}\x00${password}`));
         const command = {
             saslStart: 1,
             mechanism: 'PLAIN',

package/.output/server/node_modules/mongodb/lib/cmap/auth/providers.js

@@ -4,7 +4,6 @@ exports.AUTH_MECHS_AUTH_SRC_EXTERNAL = exports.AuthMechanism = void 0;
 /** @public */
 exports.AuthMechanism = Object.freeze({
     MONGODB_AWS: 'MONGODB-AWS',
-    MONGODB_CR: 'MONGODB-CR',
     MONGODB_DEFAULT: 'DEFAULT',
     MONGODB_GSSAPI: 'GSSAPI',
     MONGODB_PLAIN: 'PLAIN',

package/.output/server/node_modules/mongodb/lib/cmap/auth/scram.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ScramSHA256 = exports.ScramSHA1 = void 0;
 const saslprep_1 = require("@mongodb-js/saslprep");
-const crypto = require("crypto");
 const bson_1 = require("../../bson");
 const error_1 = require("../../error");
 const utils_1 = require("../../utils");
@@ -45,11 +44,11 @@ function cleanUsername(username) {
 function clientFirstMessageBare(username, nonce) {
     // NOTE: This is done b/c Javascript uses UTF-16, but the server is hashing in UTF-8.
     // Since the username is not sasl-prep-d, we need to do this here.
-    return Buffer.concat([
-        Buffer.from('n=', 'utf8'),
-        Buffer.from(username, 'utf8'),
-        Buffer.from(',r=', 'utf8'),
-        Buffer.from(nonce.toString('base64'), 'utf8')
+    return bson_1.ByteUtils.concat([
+        bson_1.ByteUtils.fromUTF8('n='),
+        bson_1.ByteUtils.fromUTF8(username),
+        bson_1.ByteUtils.fromUTF8(',r='),
+        bson_1.ByteUtils.fromUTF8(bson_1.ByteUtils.toBase64(nonce))
     ]);
 }
 function makeFirstMessage(cryptoMethod, credentials, nonce) {
@@ -60,7 +59,7 @@ function makeFirstMessage(cryptoMethod, credentials, nonce) {
     return {
         saslStart: 1,
         mechanism,
-        payload: new bson_1.Binary(Buffer.concat([Buffer.from('n,,', 'utf8'), clientFirstMessageBare(username, nonce)])),
+        payload: new bson_1.Binary(bson_1.ByteUtils.concat([bson_1.ByteUtils.fromUTF8('n,,'), clientFirstMessageBare(username, nonce)])),
         autoAuthorize: 1,
         options: { skipEmptyExchange: true }
     };
@@ -93,7 +92,7 @@ async function continueScramConversation(cryptoMethod, response, authContext) {
     const username = cleanUsername(credentials.username);
     const password = credentials.password;
     const processedPassword = cryptoMethod === 'sha256' ? (0, saslprep_1.saslprep)(password) : passwordDigest(username, password);
-    const payload = Buffer.isBuffer(response.payload)
+    const payload = bson_1.ByteUtils.isUint8Array(response.payload)
         ? new bson_1.Binary(response.payload)
         : response.payload;
     const dict = parsePayload(payload);
@@ -110,27 +109,27 @@ async function continueScramConversation(cryptoMethod, response, authContext) {
     }
     // Set up start of proof
     const withoutProof = `c=biws,r=${rnonce}`;
-    const saltedPassword = HI(processedPassword, Buffer.from(salt, 'base64'), iterations, cryptoMethod);
-    const clientKey = HMAC(cryptoMethod, saltedPassword, 'Client Key');
-    const serverKey = HMAC(cryptoMethod, saltedPassword, 'Server Key');
-    const storedKey = H(cryptoMethod, clientKey);
+    const saltedPassword = await HI(processedPassword, bson_1.ByteUtils.fromBase64(salt), iterations, cryptoMethod);
+    const clientKey = await HMAC(cryptoMethod, saltedPassword, 'Client Key');
+    const serverKey = await HMAC(cryptoMethod, saltedPassword, 'Server Key');
+    const storedKey = await H(cryptoMethod, clientKey);
     const authMessage = [
         clientFirstMessageBare(username, nonce),
         payload.toString('utf8'),
         withoutProof
     ].join(',');
-    const clientSignature = HMAC(cryptoMethod, storedKey, authMessage);
+    const clientSignature = await HMAC(cryptoMethod, storedKey, authMessage);
     const clientProof = `p=${xor(clientKey, clientSignature)}`;
     const clientFinal = [withoutProof, clientProof].join(',');
-    const serverSignature = HMAC(cryptoMethod, serverKey, authMessage);
+    const serverSignature = await HMAC(cryptoMethod, serverKey, authMessage);
     const saslContinueCmd = {
         saslContinue: 1,
         conversationId: response.conversationId,
-        payload: new bson_1.Binary(Buffer.from(clientFinal))
+        payload: new bson_1.Binary(bson_1.ByteUtils.fromUTF8(clientFinal))
     };
     const r = await connection.command((0, utils_1.ns)(`${db}.$cmd`), saslContinueCmd, undefined);
     const parsedResponse = parsePayload(r.payload);
-    if (!compareDigest(Buffer.from(parsedResponse.v, 'base64'), serverSignature)) {
+    if (!compareDigest(bson_1.ByteUtils.fromBase64(parsedResponse.v), serverSignature)) {
         throw new error_1.MongoRuntimeError('Server returned an invalid signature');
     }
     if (r.done !== false) {
@@ -140,7 +139,7 @@ async function continueScramConversation(cryptoMethod, response, authContext) {
     const retrySaslContinueCmd = {
         saslContinue: 1,
         conversationId: r.conversationId,
-        payload: Buffer.alloc(0)
+        payload: bson_1.ByteUtils.allocate(0)
     };
     await connection.command((0, utils_1.ns)(`${db}.$cmd`), retrySaslContinueCmd, undefined);
 }
@@ -164,41 +163,51 @@ function passwordDigest(username, password) {
     if (password.length === 0) {
         throw new error_1.MongoInvalidArgumentError('Password cannot be empty');
     }
-    let md5;
+    let nodeCrypto;
     try {
-        md5 = crypto.createHash('md5');
+        // TODO: NODE-7424 - remove dependency on 'crypto' for SCRAM-SHA-1 authentication
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        nodeCrypto = require('crypto');
+    }
+    catch (e) {
+        throw new error_1.MongoRuntimeError('Node.js crypto module is required for SCRAM-SHA-1 authentication', {
+            cause: e
+        });
+    }
+    try {
+        const md5 = nodeCrypto.createHash('md5');
+        md5.update(`${username}:mongo:${password}`, 'utf8');
+        return md5.digest('hex');
     }
     catch (err) {
-        if (crypto.getFips()) {
+        if (nodeCrypto.getFips()) {
             // This error is (slightly) more helpful than what comes from OpenSSL directly, e.g.
             // 'Error: error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS'
             throw new Error('Auth mechanism SCRAM-SHA-1 is not supported in FIPS mode');
         }
         throw err;
     }
-    md5.update(`${username}:mongo:${password}`, 'utf8');
-    return md5.digest('hex');
 }
 // XOR two buffers
 function xor(a, b) {
-    if (!Buffer.isBuffer(a)) {
-        a = Buffer.from(a);
-    }
-    if (!Buffer.isBuffer(b)) {
-        b = Buffer.from(b);
-    }
     const length = Math.max(a.length, b.length);
     const res = [];
     for (let i = 0; i < length; i += 1) {
         res.push(a[i] ^ b[i]);
     }
-    return Buffer.from(res).toString('base64');
+    return bson_1.ByteUtils.toBase64(bson_1.ByteUtils.fromNumberArray(res));
 }
-function H(method, text) {
-    return crypto.createHash(method).update(text).digest();
+async function H(method, text) {
+    const buffer = await crypto.subtle.digest(method === 'sha256' ? 'SHA-256' : 'SHA-1', text);
+    return new Uint8Array(buffer);
 }
-function HMAC(method, key, text) {
-    return crypto.createHmac(method, key).update(text).digest();
+async function HMAC(method, key, text) {
+    const keyBuffer = bson_1.ByteUtils.toLocalBufferType(key);
+    const cryptoKey = await crypto.subtle.importKey('raw', keyBuffer, { name: 'HMAC', hash: { name: method === 'sha256' ? 'SHA-256' : 'SHA-1' } }, false, ['sign', 'verify']);
+    const textData = typeof text === 'string' ? new TextEncoder().encode(text) : text;
+    const textBuffer = bson_1.ByteUtils.toLocalBufferType(textData);
+    const signature = await crypto.subtle.sign('HMAC', cryptoKey, textBuffer);
+    return new Uint8Array(signature);
 }
 let _hiCache = {};
 let _hiCacheCount = 0;
@@ -210,14 +219,21 @@ const hiLengthMap = {
     sha256: 32,
     sha1: 20
 };
-function HI(data, salt, iterations, cryptoMethod) {
+async function HI(data, salt, iterations, cryptoMethod) {
     // omit the work if already generated
-    const key = [data, salt.toString('base64'), iterations].join('_');
+    const key = [data, bson_1.ByteUtils.toBase64(salt), iterations].join('_');
     if (_hiCache[key] != null) {
         return _hiCache[key];
     }
-    // generate the salt
-    const saltedData = crypto.pbkdf2Sync(data, salt, iterations, hiLengthMap[cryptoMethod], cryptoMethod);
+    const keyMaterial = await crypto.subtle.importKey('raw', new TextEncoder().encode(data), { name: 'PBKDF2' }, false, ['deriveBits']);
+    const params = {
+        name: 'PBKDF2',
+        salt: salt,
+        iterations: iterations,
+        hash: { name: cryptoMethod === 'sha256' ? 'SHA-256' : 'SHA-1' }
+    };
+    const derivedBits = await crypto.subtle.deriveBits(params, keyMaterial, hiLengthMap[cryptoMethod] * 8);
+    const saltedData = new Uint8Array(derivedBits);
     // cache a copy to speed up the next lookup, but prevent unbounded cache growth
     if (_hiCacheCount >= 200) {
         _hiCachePurge();
@@ -230,9 +246,6 @@ function compareDigest(lhs, rhs) {
     if (lhs.length !== rhs.length) {
         return false;
     }
-    if (typeof crypto.timingSafeEqual === 'function') {
-        return crypto.timingSafeEqual(lhs, rhs);
-    }
     let result = 0;
     for (let i = 0; i < lhs.length; i++) {
         result |= lhs[i] ^ rhs[i];