create-mern-omar 1.1.0 → 1.2.0

package/templates/node_modules/mongodb/src/cmap/auth/mongodb_aws.ts

@@ -1,186 +0,0 @@
-import type { Binary, BSONSerializeOptions } from '../../bson';
-import * as BSON from '../../bson';
-import { aws4 } from '../../deps';
-import {
-  MongoCompatibilityError,
-  MongoMissingCredentialsError,
-  MongoRuntimeError
-} from '../../error';
-import { ByteUtils, maxWireVersion, ns, randomBytes } from '../../utils';
-import { type AuthContext, AuthProvider } from './auth_provider';
-import {
-  type AWSCredentialProvider,
-  AWSSDKCredentialProvider,
-  type AWSTempCredentials
-} from './aws_temporary_credentials';
-import { MongoCredentials } from './mongo_credentials';
-import { AuthMechanism } from './providers';
-
-const ASCII_N = 110;
-const bsonOptions: BSONSerializeOptions = {
-  useBigInt64: false,
-  promoteLongs: true,
-  promoteValues: true,
-  promoteBuffers: false,
-  bsonRegExp: false
-};
-
-interface AWSSaslContinuePayload {
-  a: string;
-  d: string;
-  t?: string;
-}
-
-export class MongoDBAWS extends AuthProvider {
-  private credentialFetcher: AWSSDKCredentialProvider;
-
-  constructor(credentialProvider?: AWSCredentialProvider) {
-    super();
-    this.credentialFetcher = new AWSSDKCredentialProvider(credentialProvider);
-  }
-
-  override async auth(authContext: AuthContext): Promise<void> {
-    const { connection } = authContext;
-    if (!authContext.credentials) {
-      throw new MongoMissingCredentialsError('AuthContext must provide credentials.');
-    }
-
-    if ('kModuleError' in aws4) {
-      throw aws4['kModuleError'];
-    }
-    const { sign } = aws4;
-
-    if (maxWireVersion(connection) < 9) {
-      throw new MongoCompatibilityError(
-        'MONGODB-AWS authentication requires MongoDB version 4.4 or later'
-      );
-    }
-
-    authContext.credentials = await makeTempCredentials(
-      authContext.credentials,
-      this.credentialFetcher
-    );
-
-    const { credentials } = authContext;
-
-    const accessKeyId = credentials.username;
-    const secretAccessKey = credentials.password;
-    // Allow the user to specify an AWS session token for authentication with temporary credentials.
-    const sessionToken = credentials.mechanismProperties.AWS_SESSION_TOKEN;
-
-    // If all three defined, include sessionToken, else include username and pass, else no credentials
-    const awsCredentials =
-      accessKeyId && secretAccessKey && sessionToken
-        ? { accessKeyId, secretAccessKey, sessionToken }
-        : accessKeyId && secretAccessKey
-          ? { accessKeyId, secretAccessKey }
-          : undefined;
-
-    const db = credentials.source;
-    const nonce = await randomBytes(32);
-
-    // All messages between MongoDB clients and servers are sent as BSON objects
-    // in the payload field of saslStart and saslContinue.
-    const saslStart = {
-      saslStart: 1,
-      mechanism: 'MONGODB-AWS',
-      payload: BSON.serialize({ r: nonce, p: ASCII_N }, bsonOptions)
-    };
-
-    const saslStartResponse = await connection.command(ns(`${db}.$cmd`), saslStart, undefined);
-
-    const serverResponse = BSON.deserialize(saslStartResponse.payload.buffer, bsonOptions) as {
-      s: Binary;
-      h: string;
-    };
-    const host = serverResponse.h;
-    const serverNonce = serverResponse.s.buffer;
-    if (serverNonce.length !== 64) {
-      // TODO(NODE-3483)
-      throw new MongoRuntimeError(`Invalid server nonce length ${serverNonce.length}, expected 64`);
-    }
-
-    if (!ByteUtils.equals(serverNonce.subarray(0, nonce.byteLength), nonce)) {
-      // throw because the serverNonce's leading 32 bytes must equal the client nonce's 32 bytes
-      // https://github.com/mongodb/specifications/blob/master/source/auth/auth.md#conversation-5
-
-      // TODO(NODE-3483)
-      throw new MongoRuntimeError('Server nonce does not begin with client nonce');
-    }
-
-    if (host.length < 1 || host.length > 255 || host.indexOf('..') !== -1) {
-      // TODO(NODE-3483)
-      throw new MongoRuntimeError(`Server returned an invalid host: "${host}"`);
-    }
-
-    const body = 'Action=GetCallerIdentity&Version=2011-06-15';
-    const options = sign(
-      {
-        method: 'POST',
-        host,
-        region: deriveRegion(serverResponse.h),
-        service: 'sts',
-        headers: {
-          'Content-Type': 'application/x-www-form-urlencoded',
-          'Content-Length': body.length,
-          'X-MongoDB-Server-Nonce': ByteUtils.toBase64(serverNonce),
-          'X-MongoDB-GS2-CB-Flag': 'n'
-        },
-        path: '/',
-        body
-      },
-      awsCredentials
-    );
-
-    const payload: AWSSaslContinuePayload = {
-      a: options.headers.Authorization,
-      d: options.headers['X-Amz-Date']
-    };
-
-    if (sessionToken) {
-      payload.t = sessionToken;
-    }
-
-    const saslContinue = {
-      saslContinue: 1,
-      conversationId: saslStartResponse.conversationId,
-      payload: BSON.serialize(payload, bsonOptions)
-    };
-
-    await connection.command(ns(`${db}.$cmd`), saslContinue, undefined);
-  }
-}
-
-async function makeTempCredentials(
-  credentials: MongoCredentials,
-  awsCredentialFetcher: AWSSDKCredentialProvider
-): Promise<MongoCredentials> {
-  function makeMongoCredentialsFromAWSTemp(creds: AWSTempCredentials) {
-    // The AWS session token (creds.Token) may or may not be set.
-    if (!creds.AccessKeyId || !creds.SecretAccessKey) {
-      throw new MongoMissingCredentialsError('Could not obtain temporary MONGODB-AWS credentials');
-    }
-
-    return new MongoCredentials({
-      username: creds.AccessKeyId,
-      password: creds.SecretAccessKey,
-      source: credentials.source,
-      mechanism: AuthMechanism.MONGODB_AWS,
-      mechanismProperties: {
-        AWS_SESSION_TOKEN: creds.Token
-      }
-    });
-  }
-  const temporaryCredentials = await awsCredentialFetcher.getCredentials();
-
-  return makeMongoCredentialsFromAWSTemp(temporaryCredentials);
-}
-
-function deriveRegion(host: string) {
-  const parts = host.split('.');
-  if (parts.length === 1 || parts[1] === 'amazonaws') {
-    return 'us-east-1';
-  }
-
-  return parts[1];
-}

package/templates/node_modules/mongodb/src/cmap/auth/mongodb_oidc/automated_callback_workflow.ts

@@ -1,88 +0,0 @@
-import { MONGODB_ERROR_CODES, MongoError, MongoOIDCError } from '../../../error';
-import { Timeout, TimeoutError } from '../../../timeout';
-import { type Connection } from '../../connection';
-import { type MongoCredentials } from '../mongo_credentials';
-import {
-  OIDC_VERSION,
-  type OIDCCallbackFunction,
-  type OIDCCallbackParams,
-  type OIDCResponse
-} from '../mongodb_oidc';
-import { AUTOMATED_TIMEOUT_MS, CallbackWorkflow } from './callback_workflow';
-import { type TokenCache } from './token_cache';
-
-/**
- * Class implementing behaviour for the non human callback workflow.
- * @internal
- */
-export class AutomatedCallbackWorkflow extends CallbackWorkflow {
-  /**
-   * Instantiate the human callback workflow.
-   */
-  constructor(cache: TokenCache, callback: OIDCCallbackFunction) {
-    super(cache, callback);
-  }
-
-  /**
-   * Execute the OIDC callback workflow.
-   */
-  async execute(connection: Connection, credentials: MongoCredentials): Promise<void> {
-    // If there is a cached access token, try to authenticate with it. If
-    // authentication fails with an Authentication error (18),
-    // invalidate the access token, fetch a new access token, and try
-    // to authenticate again.
-    // If the server fails for any other reason, do not clear the cache.
-    if (this.cache.hasAccessToken) {
-      const token = this.cache.getAccessToken();
-      if (!connection.accessToken) {
-        connection.accessToken = token;
-      }
-      try {
-        return await this.finishAuthentication(connection, credentials, token);
-      } catch (error) {
-        if (
-          error instanceof MongoError &&
-          error.code === MONGODB_ERROR_CODES.AuthenticationFailed
-        ) {
-          this.cache.removeAccessToken();
-          return await this.execute(connection, credentials);
-        } else {
-          throw error;
-        }
-      }
-    }
-    const response = await this.fetchAccessToken(credentials);
-    this.cache.put(response);
-    connection.accessToken = response.accessToken;
-    await this.finishAuthentication(connection, credentials, response.accessToken);
-  }
-
-  /**
-   * Fetches the access token using the callback.
-   */
-  protected async fetchAccessToken(credentials: MongoCredentials): Promise<OIDCResponse> {
-    const controller = new AbortController();
-    const params: OIDCCallbackParams = {
-      timeoutContext: controller.signal,
-      version: OIDC_VERSION
-    };
-    if (credentials.username) {
-      params.username = credentials.username;
-    }
-    if (credentials.mechanismProperties.TOKEN_RESOURCE) {
-      params.tokenAudience = credentials.mechanismProperties.TOKEN_RESOURCE;
-    }
-    const timeout = Timeout.expires(AUTOMATED_TIMEOUT_MS);
-    try {
-      return await Promise.race([this.executeAndValidateCallback(params), timeout]);
-    } catch (error) {
-      if (TimeoutError.is(error)) {
-        controller.abort();
-        throw new MongoOIDCError(`OIDC callback timed out after ${AUTOMATED_TIMEOUT_MS}ms.`);
-      }
-      throw error;
-    } finally {
-      timeout.clear();
-    }
-  }
-}

package/templates/node_modules/mongodb/src/cmap/auth/mongodb_oidc/azure_machine_workflow.ts

@@ -1,73 +0,0 @@
-import { addAzureParams, AZURE_BASE_URL } from '../../../client-side-encryption/providers/azure';
-import { MongoAzureError } from '../../../error';
-import { get } from '../../../utils';
-import type { OIDCCallbackFunction, OIDCCallbackParams, OIDCResponse } from '../mongodb_oidc';
-
-/** Azure request headers. */
-const AZURE_HEADERS = Object.freeze({ Metadata: 'true', Accept: 'application/json' });
-
-/** Invalid endpoint result error. */
-const ENDPOINT_RESULT_ERROR =
-  'Azure endpoint did not return a value with only access_token and expires_in properties';
-
-/** Error for when the token audience is missing in the environment. */
-const TOKEN_RESOURCE_MISSING_ERROR =
-  'TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is azure.';
-
-/**
- * The callback function to be used in the automated callback workflow.
- * @param params - The OIDC callback parameters.
- * @returns The OIDC response.
- */
-export const callback: OIDCCallbackFunction = async (
-  params: OIDCCallbackParams
-): Promise<OIDCResponse> => {
-  const tokenAudience = params.tokenAudience;
-  const username = params.username;
-  if (!tokenAudience) {
-    throw new MongoAzureError(TOKEN_RESOURCE_MISSING_ERROR);
-  }
-  const response = await getAzureTokenData(tokenAudience, username);
-  if (!isEndpointResultValid(response)) {
-    throw new MongoAzureError(ENDPOINT_RESULT_ERROR);
-  }
-  return response;
-};
-
-/**
- * Hit the Azure endpoint to get the token data.
- */
-async function getAzureTokenData(tokenAudience: string, username?: string): Promise<OIDCResponse> {
-  const url = new URL(AZURE_BASE_URL);
-  addAzureParams(url, tokenAudience, username);
-  const response = await get(url, {
-    headers: AZURE_HEADERS
-  });
-  if (response.status !== 200) {
-    throw new MongoAzureError(
-      `Status code ${response.status} returned from the Azure endpoint. Response body: ${response.body}`
-    );
-  }
-  const result = JSON.parse(response.body);
-  return {
-    accessToken: result.access_token,
-    expiresInSeconds: Number(result.expires_in)
-  };
-}
-
-/**
- * Determines if a result returned from the endpoint is valid.
- * This means the result is not nullish, contains the access_token required field
- * and the expires_in required field.
- */
-function isEndpointResultValid(
-  token: unknown
-): token is { access_token: unknown; expires_in: unknown } {
-  if (token == null || typeof token !== 'object') return false;
-  return (
-    'accessToken' in token &&
-    typeof token.accessToken === 'string' &&
-    'expiresInSeconds' in token &&
-    typeof token.expiresInSeconds === 'number'
-  );
-}

package/templates/node_modules/mongodb/src/cmap/auth/mongodb_oidc/callback_workflow.ts

@@ -1,188 +0,0 @@
-import { setTimeout } from 'timers/promises';
-
-import { type Document } from '../../../bson';
-import { MongoMissingCredentialsError } from '../../../error';
-import { ns } from '../../../utils';
-import type { Connection } from '../../connection';
-import type { MongoCredentials } from '../mongo_credentials';
-import {
-  type OIDCCallbackFunction,
-  type OIDCCallbackParams,
-  type OIDCResponse,
-  type Workflow
-} from '../mongodb_oidc';
-import { finishCommandDocument, startCommandDocument } from './command_builders';
-import { type TokenCache } from './token_cache';
-
-/** 5 minutes in milliseconds */
-export const HUMAN_TIMEOUT_MS = 300000;
-/** 1 minute in milliseconds */
-export const AUTOMATED_TIMEOUT_MS = 60000;
-
-/** Properties allowed on results of callbacks. */
-const RESULT_PROPERTIES = ['accessToken', 'expiresInSeconds', 'refreshToken'];
-
-/** Error message when the callback result is invalid. */
-const CALLBACK_RESULT_ERROR =
-  'User provided OIDC callbacks must return a valid object with an accessToken.';
-
-/** The time to throttle callback calls. */
-const THROTTLE_MS = 100;
-
-/**
- * OIDC implementation of a callback based workflow.
- * @internal
- */
-export abstract class CallbackWorkflow implements Workflow {
-  cache: TokenCache;
-  callback: OIDCCallbackFunction;
-  lastExecutionTime: number;
-
-  /**
-   * Instantiate the callback workflow.
-   */
-  constructor(cache: TokenCache, callback: OIDCCallbackFunction) {
-    this.cache = cache;
-    this.callback = this.withLock(callback);
-    this.lastExecutionTime = Date.now() - THROTTLE_MS;
-  }
-
-  /**
-   * Get the document to add for speculative authentication. This also needs
-   * to add a db field from the credentials source.
-   */
-  async speculativeAuth(connection: Connection, credentials: MongoCredentials): Promise<Document> {
-    // Check if the Client Cache has an access token.
-    // If it does, cache the access token in the Connection Cache and send a JwtStepRequest
-    // with the cached access token in the speculative authentication SASL payload.
-    if (this.cache.hasAccessToken) {
-      const accessToken = this.cache.getAccessToken();
-      connection.accessToken = accessToken;
-      const document = finishCommandDocument(accessToken);
-      document.db = credentials.source;
-      return { speculativeAuthenticate: document };
-    }
-    return {};
-  }
-
-  /**
-   * Reauthenticate the callback workflow. For this we invalidated the access token
-   * in the cache and run the authentication steps again. No initial handshake needs
-   * to be sent.
-   */
-  async reauthenticate(connection: Connection, credentials: MongoCredentials): Promise<void> {
-    if (this.cache.hasAccessToken) {
-      // Reauthentication implies the token has expired.
-      if (connection.accessToken === this.cache.getAccessToken()) {
-        // If connection's access token is the same as the cache's, remove
-        // the token from the cache and connection.
-        this.cache.removeAccessToken();
-        delete connection.accessToken;
-      } else {
-        // If the connection's access token is different from the cache's, set
-        // the cache's token on the connection and do not remove from the
-        // cache.
-        connection.accessToken = this.cache.getAccessToken();
-      }
-    }
-    await this.execute(connection, credentials);
-  }
-
-  /**
-   * Execute the OIDC callback workflow.
-   */
-  abstract execute(
-    connection: Connection,
-    credentials: MongoCredentials,
-    response?: Document
-  ): Promise<void>;
-
-  /**
-   * Starts the callback authentication process. If there is a speculative
-   * authentication document from the initial handshake, then we will use that
-   * value to get the issuer, otherwise we will send the saslStart command.
-   */
-  protected async startAuthentication(
-    connection: Connection,
-    credentials: MongoCredentials,
-    response?: Document
-  ): Promise<Document> {
-    let result;
-    if (response?.speculativeAuthenticate) {
-      result = response.speculativeAuthenticate;
-    } else {
-      result = await connection.command(
-        ns(credentials.source),
-        startCommandDocument(credentials),
-        undefined
-      );
-    }
-    return result;
-  }
-
-  /**
-   * Finishes the callback authentication process.
-   */
-  protected async finishAuthentication(
-    connection: Connection,
-    credentials: MongoCredentials,
-    token: string,
-    conversationId?: number
-  ): Promise<void> {
-    await connection.command(
-      ns(credentials.source),
-      finishCommandDocument(token, conversationId),
-      undefined
-    );
-  }
-
-  /**
-   * Executes the callback and validates the output.
-   */
-  protected async executeAndValidateCallback(params: OIDCCallbackParams): Promise<OIDCResponse> {
-    const result = await this.callback(params);
-    // Validate that the result returned by the callback is acceptable. If it is not
-    // we must clear the token result from the cache.
-    if (isCallbackResultInvalid(result)) {
-      throw new MongoMissingCredentialsError(CALLBACK_RESULT_ERROR);
-    }
-    return result;
-  }
-
-  /**
-   * Ensure the callback is only executed one at a time and throttles the calls
-   * to every 100ms.
-   */
-  protected withLock(callback: OIDCCallbackFunction): OIDCCallbackFunction {
-    let lock: Promise<any> = Promise.resolve();
-    return async (params: OIDCCallbackParams): Promise<OIDCResponse> => {
-      // We do this to ensure that we would never return the result of the
-      // previous lock, only the current callback's value would get returned.
-      await lock;
-      lock = lock
-
-        .catch(() => null)
-
-        .then(async () => {
-          const difference = Date.now() - this.lastExecutionTime;
-          if (difference <= THROTTLE_MS) {
-            await setTimeout(THROTTLE_MS - difference, { signal: params.timeoutContext });
-          }
-          this.lastExecutionTime = Date.now();
-          return await callback(params);
-        });
-      return await lock;
-    };
-  }
-}
-
-/**
- * Determines if a result returned from a request or refresh callback
- * function is invalid. This means the result is nullish, doesn't contain
- * the accessToken required field, and does not contain extra fields.
- */
-function isCallbackResultInvalid(tokenResult: unknown): boolean {
-  if (tokenResult == null || typeof tokenResult !== 'object') return true;
-  if (!('accessToken' in tokenResult)) return true;
-  return !Object.getOwnPropertyNames(tokenResult).every(prop => RESULT_PROPERTIES.includes(prop));
-}

package/templates/node_modules/mongodb/src/cmap/auth/mongodb_oidc/command_builders.ts

@@ -1,53 +0,0 @@
-import { Binary, BSON, type Document } from '../../../bson';
-import { type MongoCredentials } from '../mongo_credentials';
-import { AuthMechanism } from '../providers';
-
-/** @internal */
-export interface OIDCCommand {
-  saslStart?: number;
-  saslContinue?: number;
-  conversationId?: number;
-  mechanism?: string;
-  autoAuthorize?: number;
-  db?: string;
-  payload: Binary;
-}
-
-/**
- * Generate the finishing command document for authentication. Will be a
- * saslStart or saslContinue depending on the presence of a conversation id.
- */
-export function finishCommandDocument(token: string, conversationId?: number): OIDCCommand {
-  if (conversationId != null) {
-    return {
-      saslContinue: 1,
-      conversationId: conversationId,
-      payload: new Binary(BSON.serialize({ jwt: token }))
-    };
-  }
-  // saslContinue requires a conversationId in the command to be valid so in this
-  // case the server allows "step two" to actually be a saslStart with the token
-  // as the jwt since the use of the cached value has no correlating conversating
-  // on the particular connection.
-  return {
-    saslStart: 1,
-    mechanism: AuthMechanism.MONGODB_OIDC,
-    payload: new Binary(BSON.serialize({ jwt: token }))
-  };
-}
-
-/**
- * Generate the saslStart command document.
- */
-export function startCommandDocument(credentials: MongoCredentials): OIDCCommand {
-  const payload: Document = {};
-  if (credentials.username) {
-    payload.n = credentials.username;
-  }
-  return {
-    saslStart: 1,
-    autoAuthorize: 1,
-    mechanism: AuthMechanism.MONGODB_OIDC,
-    payload: new Binary(BSON.serialize(payload))
-  };
-}

package/templates/node_modules/mongodb/src/cmap/auth/mongodb_oidc/gcp_machine_workflow.ts

@@ -1,46 +0,0 @@
-import { MongoGCPError } from '../../../error';
-import { get } from '../../../utils';
-import type { OIDCCallbackFunction, OIDCCallbackParams, OIDCResponse } from '../mongodb_oidc';
-
-/** GCP base URL. */
-const GCP_BASE_URL =
-  'http://metadata/computeMetadata/v1/instance/service-accounts/default/identity';
-
-/** GCP request headers. */
-const GCP_HEADERS = Object.freeze({ 'Metadata-Flavor': 'Google' });
-
-/** Error for when the token audience is missing in the environment. */
-const TOKEN_RESOURCE_MISSING_ERROR =
-  'TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is gcp.';
-
-/**
- * The callback function to be used in the automated callback workflow.
- * @param params - The OIDC callback parameters.
- * @returns The OIDC response.
- */
-export const callback: OIDCCallbackFunction = async (
-  params: OIDCCallbackParams
-): Promise<OIDCResponse> => {
-  const tokenAudience = params.tokenAudience;
-  if (!tokenAudience) {
-    throw new MongoGCPError(TOKEN_RESOURCE_MISSING_ERROR);
-  }
-  return await getGcpTokenData(tokenAudience);
-};
-
-/**
- * Hit the GCP endpoint to get the token data.
- */
-async function getGcpTokenData(tokenAudience: string): Promise<OIDCResponse> {
-  const url = new URL(GCP_BASE_URL);
-  url.searchParams.append('audience', tokenAudience);
-  const response = await get(url, {
-    headers: GCP_HEADERS
-  });
-  if (response.status !== 200) {
-    throw new MongoGCPError(
-      `Status code ${response.status} returned from the GCP endpoint. Response body: ${response.body}`
-    );
-  }
-  return { accessToken: response.body };
-}