create-mern-omar 1.0.0 → 1.1.0

package/templates/node_modules/mongodb/src/cmap/auth/mongodb_oidc/human_callback_workflow.ts

@@ -0,0 +1,141 @@
+import { BSON } from '../../../bson';
+import { MONGODB_ERROR_CODES, MongoError, MongoOIDCError } from '../../../error';
+import { Timeout, TimeoutError } from '../../../timeout';
+import { type Connection } from '../../connection';
+import { type MongoCredentials } from '../mongo_credentials';
+import {
+  type IdPInfo,
+  OIDC_VERSION,
+  type OIDCCallbackFunction,
+  type OIDCCallbackParams,
+  type OIDCResponse
+} from '../mongodb_oidc';
+import { CallbackWorkflow, HUMAN_TIMEOUT_MS } from './callback_workflow';
+import { type TokenCache } from './token_cache';
+
+/**
+ * Class implementing behaviour for the non human callback workflow.
+ * @internal
+ */
+export class HumanCallbackWorkflow extends CallbackWorkflow {
+  /**
+   * Instantiate the human callback workflow.
+   */
+  constructor(cache: TokenCache, callback: OIDCCallbackFunction) {
+    super(cache, callback);
+  }
+
+  /**
+   * Execute the OIDC human callback workflow.
+   */
+  async execute(connection: Connection, credentials: MongoCredentials): Promise<void> {
+    // Check if the Client Cache has an access token.
+    // If it does, cache the access token in the Connection Cache and perform a One-Step SASL conversation
+    // using the access token. If the server returns an Authentication error (18),
+    // invalidate the access token token from the Client Cache, clear the Connection Cache,
+    // and restart the authentication flow. Raise any other errors to the user. On success, exit the algorithm.
+    if (this.cache.hasAccessToken) {
+      const token = this.cache.getAccessToken();
+      connection.accessToken = token;
+      try {
+        return await this.finishAuthentication(connection, credentials, token);
+      } catch (error) {
+        if (
+          error instanceof MongoError &&
+          error.code === MONGODB_ERROR_CODES.AuthenticationFailed
+        ) {
+          this.cache.removeAccessToken();
+          delete connection.accessToken;
+          return await this.execute(connection, credentials);
+        } else {
+          throw error;
+        }
+      }
+    }
+    // Check if the Client Cache has a refresh token.
+    // If it does, call the OIDC Human Callback with the cached refresh token and IdpInfo to get a
+    // new access token. Cache the new access token in the Client Cache and Connection Cache.
+    // Perform a One-Step SASL conversation using the new access token. If the the server returns
+    // an Authentication error (18), clear the refresh token, invalidate the access token from the
+    // Client Cache, clear the Connection Cache, and restart the authentication flow. Raise any other
+    // errors to the user. On success, exit the algorithm.
+    if (this.cache.hasRefreshToken) {
+      const refreshToken = this.cache.getRefreshToken();
+      const result = await this.fetchAccessToken(
+        this.cache.getIdpInfo(),
+        credentials,
+        refreshToken
+      );
+      this.cache.put(result);
+      connection.accessToken = result.accessToken;
+      try {
+        return await this.finishAuthentication(connection, credentials, result.accessToken);
+      } catch (error) {
+        if (
+          error instanceof MongoError &&
+          error.code === MONGODB_ERROR_CODES.AuthenticationFailed
+        ) {
+          this.cache.removeRefreshToken();
+          delete connection.accessToken;
+          return await this.execute(connection, credentials);
+        } else {
+          throw error;
+        }
+      }
+    }
+
+    // Start a new Two-Step SASL conversation.
+    // Run a PrincipalStepRequest to get the IdpInfo.
+    // Call the OIDC Human Callback with the new IdpInfo to get a new access token and optional refresh
+    // token. Drivers MUST NOT pass a cached refresh token to the callback when performing
+    // a new Two-Step conversation. Cache the new IdpInfo and refresh token in the Client Cache and the
+    // new access token in the Client Cache and Connection Cache.
+    // Attempt to authenticate using a JwtStepRequest with the new access token. Raise any errors to the user.
+    const startResponse = await this.startAuthentication(connection, credentials);
+    const conversationId = startResponse.conversationId;
+    const idpInfo = BSON.deserialize(startResponse.payload.buffer) as IdPInfo;
+    const callbackResponse = await this.fetchAccessToken(idpInfo, credentials);
+    this.cache.put(callbackResponse, idpInfo);
+    connection.accessToken = callbackResponse.accessToken;
+    return await this.finishAuthentication(
+      connection,
+      credentials,
+      callbackResponse.accessToken,
+      conversationId
+    );
+  }
+
+  /**
+   * Fetches an access token using the callback.
+   */
+  private async fetchAccessToken(
+    idpInfo: IdPInfo,
+    credentials: MongoCredentials,
+    refreshToken?: string
+  ): Promise<OIDCResponse> {
+    const controller = new AbortController();
+    const params: OIDCCallbackParams = {
+      timeoutContext: controller.signal,
+      version: OIDC_VERSION,
+      idpInfo: idpInfo
+    };
+    if (credentials.username) {
+      params.username = credentials.username;
+    }
+    if (refreshToken) {
+      params.refreshToken = refreshToken;
+    }
+    const timeout = Timeout.expires(HUMAN_TIMEOUT_MS);
+    try {
+      return await Promise.race([this.executeAndValidateCallback(params), timeout]);
+    } catch (error) {
+      if (TimeoutError.is(error)) {
+        controller.abort();
+        throw new MongoOIDCError(`OIDC callback timed out after ${HUMAN_TIMEOUT_MS}ms.`);
+      }
+      throw error;
+    } finally {
+      timeout.clear();
+    }
+  }
+}

package/templates/node_modules/mongodb/src/cmap/auth/mongodb_oidc/k8s_machine_workflow.ts

@@ -0,0 +1,30 @@
+import { readFile } from 'fs/promises';
+
+import type { OIDCCallbackFunction, OIDCResponse } from '../mongodb_oidc';
+
+/** The fallback file name */
+const FALLBACK_FILENAME = '/var/run/secrets/kubernetes.io/serviceaccount/token';
+
+/** The azure environment variable for the file name. */
+const AZURE_FILENAME = 'AZURE_FEDERATED_TOKEN_FILE';
+
+/** The AWS environment variable for the file name. */
+const AWS_FILENAME = 'AWS_WEB_IDENTITY_TOKEN_FILE';
+
+/**
+ * The callback function to be used in the automated callback workflow.
+ * @param params - The OIDC callback parameters.
+ * @returns The OIDC response.
+ */
+export const callback: OIDCCallbackFunction = async (): Promise<OIDCResponse> => {
+  let filename: string;
+  if (process.env[AZURE_FILENAME]) {
+    filename = process.env[AZURE_FILENAME];
+  } else if (process.env[AWS_FILENAME]) {
+    filename = process.env[AWS_FILENAME];
+  } else {
+    filename = FALLBACK_FILENAME;
+  }
+  const token = await readFile(filename, 'utf8');
+  return { accessToken: token };
+};

package/templates/node_modules/mongodb/src/cmap/auth/mongodb_oidc/token_cache.ts

@@ -0,0 +1,62 @@
+import { MongoDriverError } from '../../../error';
+import type { IdPInfo, OIDCResponse } from '../mongodb_oidc';
+
+class MongoOIDCError extends MongoDriverError {}
+
+/** @internal */
+export class TokenCache {
+  private accessToken?: string;
+  private refreshToken?: string;
+  private idpInfo?: IdPInfo;
+  private expiresInSeconds?: number;
+
+  get hasAccessToken(): boolean {
+    return !!this.accessToken;
+  }
+
+  get hasRefreshToken(): boolean {
+    return !!this.refreshToken;
+  }
+
+  get hasIdpInfo(): boolean {
+    return !!this.idpInfo;
+  }
+
+  getAccessToken(): string {
+    if (!this.accessToken) {
+      throw new MongoOIDCError('Attempted to get an access token when none exists.');
+    }
+    return this.accessToken;
+  }
+
+  getRefreshToken(): string {
+    if (!this.refreshToken) {
+      throw new MongoOIDCError('Attempted to get a refresh token when none exists.');
+    }
+    return this.refreshToken;
+  }
+
+  getIdpInfo(): IdPInfo {
+    if (!this.idpInfo) {
+      throw new MongoOIDCError('Attempted to get IDP information when none exists.');
+    }
+    return this.idpInfo;
+  }
+
+  put(response: OIDCResponse, idpInfo?: IdPInfo) {
+    this.accessToken = response.accessToken;
+    this.refreshToken = response.refreshToken;
+    this.expiresInSeconds = response.expiresInSeconds;
+    if (idpInfo) {
+      this.idpInfo = idpInfo;
+    }
+  }
+
+  removeAccessToken() {
+    this.accessToken = undefined;
+  }
+
+  removeRefreshToken() {
+    this.refreshToken = undefined;
+  }
+}

package/templates/node_modules/mongodb/src/cmap/auth/mongodb_oidc/token_machine_workflow.ts

@@ -0,0 +1,21 @@
+import * as fs from 'fs';
+
+import { MongoAWSError } from '../../../error';
+import type { OIDCCallbackFunction, OIDCResponse } from '../mongodb_oidc';
+
+/** Error for when the token is missing in the environment. */
+const TOKEN_MISSING_ERROR = 'OIDC_TOKEN_FILE must be set in the environment.';
+
+/**
+ * The callback function to be used in the automated callback workflow.
+ * @param params - The OIDC callback parameters.
+ * @returns The OIDC response.
+ */
+export const callback: OIDCCallbackFunction = async (): Promise<OIDCResponse> => {
+  const tokenFile = process.env.OIDC_TOKEN_FILE;
+  if (!tokenFile) {
+    throw new MongoAWSError(TOKEN_MISSING_ERROR);
+  }
+  const token = await fs.promises.readFile(tokenFile, 'utf8');
+  return { accessToken: token };
+};

package/templates/node_modules/mongodb/src/cmap/auth/mongodb_oidc.ts

@@ -0,0 +1,185 @@
+import type { Document } from '../../bson';
+import { MongoInvalidArgumentError, MongoMissingCredentialsError } from '../../error';
+import type { HandshakeDocument } from '../connect';
+import type { Connection } from '../connection';
+import { type AuthContext, AuthProvider } from './auth_provider';
+import type { MongoCredentials } from './mongo_credentials';
+import { AutomatedCallbackWorkflow } from './mongodb_oidc/automated_callback_workflow';
+import { callback as azureCallback } from './mongodb_oidc/azure_machine_workflow';
+import { callback as gcpCallback } from './mongodb_oidc/gcp_machine_workflow';
+import { callback as k8sCallback } from './mongodb_oidc/k8s_machine_workflow';
+import { TokenCache } from './mongodb_oidc/token_cache';
+import { callback as testCallback } from './mongodb_oidc/token_machine_workflow';
+
+/** Error when credentials are missing. */
+const MISSING_CREDENTIALS_ERROR = 'AuthContext must provide credentials.';
+
+/**
+ * The information returned by the server on the IDP server.
+ * @public
+ */
+export interface IdPInfo {
+  /**
+   * A URL which describes the Authentication Server. This identifier should
+   * be the iss of provided access tokens, and be viable for RFC8414 metadata
+   * discovery and RFC9207 identification.
+   */
+  issuer: string;
+  /** A unique client ID for this OIDC client. */
+  clientId: string;
+  /** A list of additional scopes to request from IdP. */
+  requestScopes?: string[];
+}
+
+/**
+ * The response from the IdP server with the access token and
+ * optional expiration time and refresh token.
+ * @public
+ */
+export interface IdPServerResponse {
+  /** The OIDC access token. */
+  accessToken: string;
+  /** The time when the access token expires. For future use. */
+  expiresInSeconds?: number;
+  /** The refresh token, if applicable, to be used by the callback to request a new token from the issuer. */
+  refreshToken?: string;
+}
+
+/**
+ * The response required to be returned from the machine or
+ * human callback workflows' callback.
+ * @public
+ */
+export interface OIDCResponse {
+  /** The OIDC access token. */
+  accessToken: string;
+  /** The time when the access token expires. For future use. */
+  expiresInSeconds?: number;
+  /** The refresh token, if applicable, to be used by the callback to request a new token from the issuer. */
+  refreshToken?: string;
+}
+
+/**
+ * The parameters that the driver provides to the user supplied
+ * human or machine callback.
+ *
+ * The version number is used to communicate callback API changes that are not breaking but that
+ * users may want to know about and review their implementation. Users may wish to check the version
+ * number and throw an error if their expected version number and the one provided do not match.
+ * @public
+ */
+export interface OIDCCallbackParams {
+  /** Optional username. */
+  username?: string;
+  /** The context in which to timeout the OIDC callback. */
+  timeoutContext: AbortSignal;
+  /** The current OIDC API version. */
+  version: 1;
+  /** The IdP information returned from the server. */
+  idpInfo?: IdPInfo;
+  /** The refresh token, if applicable, to be used by the callback to request a new token from the issuer. */
+  refreshToken?: string;
+  /** The token audience for GCP and Azure. */
+  tokenAudience?: string;
+}
+
+/**
+ * The signature of the human or machine callback functions.
+ * @public
+ */
+export type OIDCCallbackFunction = (params: OIDCCallbackParams) => Promise<OIDCResponse>;
+
+/** The current version of OIDC implementation. */
+export const OIDC_VERSION = 1;
+
+type EnvironmentName = 'test' | 'azure' | 'gcp' | 'k8s' | undefined;
+
+/** @internal */
+export interface Workflow {
+  cache: TokenCache;
+
+  /**
+   * All device workflows must implement this method in order to get the access
+   * token and then call authenticate with it.
+   */
+  execute(
+    connection: Connection,
+    credentials: MongoCredentials,
+    response?: Document
+  ): Promise<void>;
+
+  /**
+   * Each workflow should specify the correct custom behaviour for reauthentication.
+   */
+  reauthenticate(connection: Connection, credentials: MongoCredentials): Promise<void>;
+
+  /**
+   * Get the document to add for speculative authentication.
+   */
+  speculativeAuth(connection: Connection, credentials: MongoCredentials): Promise<Document>;
+}
+
+/** @internal */
+export const OIDC_WORKFLOWS: Map<EnvironmentName, () => Workflow> = new Map();
+OIDC_WORKFLOWS.set('test', () => new AutomatedCallbackWorkflow(new TokenCache(), testCallback));
+OIDC_WORKFLOWS.set('azure', () => new AutomatedCallbackWorkflow(new TokenCache(), azureCallback));
+OIDC_WORKFLOWS.set('gcp', () => new AutomatedCallbackWorkflow(new TokenCache(), gcpCallback));
+OIDC_WORKFLOWS.set('k8s', () => new AutomatedCallbackWorkflow(new TokenCache(), k8sCallback));
+
+/**
+ * OIDC auth provider.
+ */
+export class MongoDBOIDC extends AuthProvider {
+  workflow: Workflow;
+
+  /**
+   * Instantiate the auth provider.
+   */
+  constructor(workflow?: Workflow) {
+    super();
+    if (!workflow) {
+      throw new MongoInvalidArgumentError('No workflow provided to the OIDC auth provider.');
+    }
+    this.workflow = workflow;
+  }
+
+  /**
+   * Authenticate using OIDC
+   */
+  override async auth(authContext: AuthContext): Promise<void> {
+    const { connection, reauthenticating, response } = authContext;
+    if (response?.speculativeAuthenticate?.done && !reauthenticating) {
+      return;
+    }
+    const credentials = getCredentials(authContext);
+    if (reauthenticating) {
+      await this.workflow.reauthenticate(connection, credentials);
+    } else {
+      await this.workflow.execute(connection, credentials, response);
+    }
+  }
+
+  /**
+   * Add the speculative auth for the initial handshake.
+   */
+  override async prepare(
+    handshakeDoc: HandshakeDocument,
+    authContext: AuthContext
+  ): Promise<HandshakeDocument> {
+    const { connection } = authContext;
+    const credentials = getCredentials(authContext);
+    const result = await this.workflow.speculativeAuth(connection, credentials);
+    return { ...handshakeDoc, ...result };
+  }
+}
+
+/**
+ * Get credentials from the auth context, throwing if they do not exist.
+ */
+function getCredentials(authContext: AuthContext): MongoCredentials {
+  const { credentials } = authContext;
+  if (!credentials) {
+    throw new MongoMissingCredentialsError(MISSING_CREDENTIALS_ERROR);
+  }
+  return credentials;
+}

package/templates/node_modules/mongodb/src/cmap/auth/plain.ts

@@ -0,0 +1,25 @@
+import { Binary } from '../../bson';
+import { MongoMissingCredentialsError } from '../../error';
+import { ns } from '../../utils';
+import { type AuthContext, AuthProvider } from './auth_provider';
+
+export class Plain extends AuthProvider {
+  override async auth(authContext: AuthContext): Promise<void> {
+    const { connection, credentials } = authContext;
+    if (!credentials) {
+      throw new MongoMissingCredentialsError('AuthContext must provide credentials.');
+    }
+
+    const { username, password } = credentials;
+
+    const payload = new Binary(Buffer.from(`\x00${username}\x00${password}`));
+    const command = {
+      saslStart: 1,
+      mechanism: 'PLAIN',
+      payload: payload,
+      autoAuthorize: 1
+    };
+
+    await connection.command(ns('$external.$cmd'), command, undefined);
+  }
+}

package/templates/node_modules/mongodb/src/cmap/auth/providers.ts

@@ -0,0 +1,22 @@
+/** @public */
+export const AuthMechanism = Object.freeze({
+  MONGODB_AWS: 'MONGODB-AWS',
+  MONGODB_DEFAULT: 'DEFAULT',
+  MONGODB_GSSAPI: 'GSSAPI',
+  MONGODB_PLAIN: 'PLAIN',
+  MONGODB_SCRAM_SHA1: 'SCRAM-SHA-1',
+  MONGODB_SCRAM_SHA256: 'SCRAM-SHA-256',
+  MONGODB_X509: 'MONGODB-X509',
+  MONGODB_OIDC: 'MONGODB-OIDC'
+} as const);
+
+/** @public */
+export type AuthMechanism = (typeof AuthMechanism)[keyof typeof AuthMechanism];
+
+/** @internal */
+export const AUTH_MECHS_AUTH_SRC_EXTERNAL = new Set<AuthMechanism>([
+  AuthMechanism.MONGODB_GSSAPI,
+  AuthMechanism.MONGODB_AWS,
+  AuthMechanism.MONGODB_OIDC,
+  AuthMechanism.MONGODB_X509
+]);