create-mern-omar 1.1.0 → 1.2.0

package/templates/node_modules/mongodb/src/cmap/auth/scram.ts

@@ -1,344 +0,0 @@
-import { saslprep } from '@mongodb-js/saslprep';
-import * as crypto from 'crypto';
-
-import { Binary, type Document } from '../../bson';
-import {
-  MongoInvalidArgumentError,
-  MongoMissingCredentialsError,
-  MongoRuntimeError
-} from '../../error';
-import { ns, randomBytes } from '../../utils';
-import type { HandshakeDocument } from '../connect';
-import { type AuthContext, AuthProvider } from './auth_provider';
-import type { MongoCredentials } from './mongo_credentials';
-import { AuthMechanism } from './providers';
-
-type CryptoMethod = 'sha1' | 'sha256';
-
-class ScramSHA extends AuthProvider {
-  cryptoMethod: CryptoMethod;
-
-  constructor(cryptoMethod: CryptoMethod) {
-    super();
-    this.cryptoMethod = cryptoMethod || 'sha1';
-  }
-
-  override async prepare(
-    handshakeDoc: HandshakeDocument,
-    authContext: AuthContext
-  ): Promise<HandshakeDocument> {
-    const cryptoMethod = this.cryptoMethod;
-    const credentials = authContext.credentials;
-    if (!credentials) {
-      throw new MongoMissingCredentialsError('AuthContext must provide credentials.');
-    }
-
-    const nonce = await randomBytes(24);
-    // store the nonce for later use
-    authContext.nonce = nonce;
-
-    const request = {
-      ...handshakeDoc,
-      speculativeAuthenticate: {
-        ...makeFirstMessage(cryptoMethod, credentials, nonce),
-        db: credentials.source
-      }
-    };
-
-    return request;
-  }
-
-  override async auth(authContext: AuthContext) {
-    const { reauthenticating, response } = authContext;
-    if (response?.speculativeAuthenticate && !reauthenticating) {
-      return await continueScramConversation(
-        this.cryptoMethod,
-        response.speculativeAuthenticate,
-        authContext
-      );
-    }
-    return await executeScram(this.cryptoMethod, authContext);
-  }
-}
-
-function cleanUsername(username: string) {
-  return username.replace('=', '=3D').replace(',', '=2C');
-}
-
-function clientFirstMessageBare(username: string, nonce: Buffer) {
-  // NOTE: This is done b/c Javascript uses UTF-16, but the server is hashing in UTF-8.
-  // Since the username is not sasl-prep-d, we need to do this here.
-  return Buffer.concat([
-    Buffer.from('n=', 'utf8'),
-    Buffer.from(username, 'utf8'),
-    Buffer.from(',r=', 'utf8'),
-    Buffer.from(nonce.toString('base64'), 'utf8')
-  ]);
-}
-
-function makeFirstMessage(
-  cryptoMethod: CryptoMethod,
-  credentials: MongoCredentials,
-  nonce: Buffer
-) {
-  const username = cleanUsername(credentials.username);
-  const mechanism =
-    cryptoMethod === 'sha1' ? AuthMechanism.MONGODB_SCRAM_SHA1 : AuthMechanism.MONGODB_SCRAM_SHA256;
-
-  // NOTE: This is done b/c Javascript uses UTF-16, but the server is hashing in UTF-8.
-  // Since the username is not sasl-prep-d, we need to do this here.
-  return {
-    saslStart: 1,
-    mechanism,
-    payload: new Binary(
-      Buffer.concat([Buffer.from('n,,', 'utf8'), clientFirstMessageBare(username, nonce)])
-    ),
-    autoAuthorize: 1,
-    options: { skipEmptyExchange: true }
-  };
-}
-
-async function executeScram(cryptoMethod: CryptoMethod, authContext: AuthContext): Promise<void> {
-  const { connection, credentials } = authContext;
-  if (!credentials) {
-    throw new MongoMissingCredentialsError('AuthContext must provide credentials.');
-  }
-  if (!authContext.nonce) {
-    throw new MongoInvalidArgumentError('AuthContext must contain a valid nonce property');
-  }
-  const nonce = authContext.nonce;
-  const db = credentials.source;
-
-  const saslStartCmd = makeFirstMessage(cryptoMethod, credentials, nonce);
-  const response = await connection.command(ns(`${db}.$cmd`), saslStartCmd, undefined);
-  await continueScramConversation(cryptoMethod, response, authContext);
-}
-
-async function continueScramConversation(
-  cryptoMethod: CryptoMethod,
-  response: Document,
-  authContext: AuthContext
-): Promise<void> {
-  const connection = authContext.connection;
-  const credentials = authContext.credentials;
-  if (!credentials) {
-    throw new MongoMissingCredentialsError('AuthContext must provide credentials.');
-  }
-  if (!authContext.nonce) {
-    throw new MongoInvalidArgumentError('Unable to continue SCRAM without valid nonce');
-  }
-  const nonce = authContext.nonce;
-
-  const db = credentials.source;
-  const username = cleanUsername(credentials.username);
-  const password = credentials.password;
-
-  const processedPassword =
-    cryptoMethod === 'sha256' ? saslprep(password) : passwordDigest(username, password);
-
-  const payload: Binary = Buffer.isBuffer(response.payload)
-    ? new Binary(response.payload)
-    : response.payload;
-
-  const dict = parsePayload(payload);
-
-  const iterations = parseInt(dict.i, 10);
-  if (iterations && iterations < 4096) {
-    // TODO(NODE-3483)
-    throw new MongoRuntimeError(`Server returned an invalid iteration count ${iterations}`);
-  }
-
-  const salt = dict.s;
-  const rnonce = dict.r;
-  if (rnonce.startsWith('nonce')) {
-    // TODO(NODE-3483)
-    throw new MongoRuntimeError(`Server returned an invalid nonce: ${rnonce}`);
-  }
-
-  // Set up start of proof
-  const withoutProof = `c=biws,r=${rnonce}`;
-  const saltedPassword = HI(
-    processedPassword,
-    Buffer.from(salt, 'base64'),
-    iterations,
-    cryptoMethod
-  );
-
-  const clientKey = HMAC(cryptoMethod, saltedPassword, 'Client Key');
-  const serverKey = HMAC(cryptoMethod, saltedPassword, 'Server Key');
-  const storedKey = H(cryptoMethod, clientKey);
-  const authMessage = [
-    clientFirstMessageBare(username, nonce),
-    payload.toString('utf8'),
-    withoutProof
-  ].join(',');
-
-  const clientSignature = HMAC(cryptoMethod, storedKey, authMessage);
-  const clientProof = `p=${xor(clientKey, clientSignature)}`;
-  const clientFinal = [withoutProof, clientProof].join(',');
-
-  const serverSignature = HMAC(cryptoMethod, serverKey, authMessage);
-  const saslContinueCmd = {
-    saslContinue: 1,
-    conversationId: response.conversationId,
-    payload: new Binary(Buffer.from(clientFinal))
-  };
-
-  const r = await connection.command(ns(`${db}.$cmd`), saslContinueCmd, undefined);
-  const parsedResponse = parsePayload(r.payload);
-
-  if (!compareDigest(Buffer.from(parsedResponse.v, 'base64'), serverSignature)) {
-    throw new MongoRuntimeError('Server returned an invalid signature');
-  }
-
-  if (r.done !== false) {
-    // If the server sends r.done === true we can save one RTT
-    return;
-  }
-
-  const retrySaslContinueCmd = {
-    saslContinue: 1,
-    conversationId: r.conversationId,
-    payload: Buffer.alloc(0)
-  };
-
-  await connection.command(ns(`${db}.$cmd`), retrySaslContinueCmd, undefined);
-}
-
-function parsePayload(payload: Binary) {
-  const payloadStr = payload.toString('utf8');
-  const dict: Document = {};
-  const parts = payloadStr.split(',');
-  for (let i = 0; i < parts.length; i++) {
-    const valueParts = (parts[i].match(/^([^=]*)=(.*)$/) ?? []).slice(1);
-    dict[valueParts[0]] = valueParts[1];
-  }
-  return dict;
-}
-
-function passwordDigest(username: string, password: string) {
-  if (typeof username !== 'string') {
-    throw new MongoInvalidArgumentError('Username must be a string');
-  }
-
-  if (typeof password !== 'string') {
-    throw new MongoInvalidArgumentError('Password must be a string');
-  }
-
-  if (password.length === 0) {
-    throw new MongoInvalidArgumentError('Password cannot be empty');
-  }
-
-  let md5: crypto.Hash;
-  try {
-    md5 = crypto.createHash('md5');
-  } catch (err) {
-    if (crypto.getFips()) {
-      // This error is (slightly) more helpful than what comes from OpenSSL directly, e.g.
-      // 'Error: error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS'
-      throw new Error('Auth mechanism SCRAM-SHA-1 is not supported in FIPS mode');
-    }
-    throw err;
-  }
-  md5.update(`${username}:mongo:${password}`, 'utf8');
-  return md5.digest('hex');
-}
-
-// XOR two buffers
-function xor(a: Buffer, b: Buffer) {
-  if (!Buffer.isBuffer(a)) {
-    a = Buffer.from(a);
-  }
-
-  if (!Buffer.isBuffer(b)) {
-    b = Buffer.from(b);
-  }
-
-  const length = Math.max(a.length, b.length);
-  const res = [];
-
-  for (let i = 0; i < length; i += 1) {
-    res.push(a[i] ^ b[i]);
-  }
-
-  return Buffer.from(res).toString('base64');
-}
-
-function H(method: CryptoMethod, text: Buffer) {
-  return crypto.createHash(method).update(text).digest();
-}
-
-function HMAC(method: CryptoMethod, key: Buffer, text: Buffer | string) {
-  return crypto.createHmac(method, key).update(text).digest();
-}
-
-interface HICache {
-  [key: string]: Buffer;
-}
-
-let _hiCache: HICache = {};
-let _hiCacheCount = 0;
-function _hiCachePurge() {
-  _hiCache = {};
-  _hiCacheCount = 0;
-}
-
-const hiLengthMap = {
-  sha256: 32,
-  sha1: 20
-};
-
-function HI(data: string, salt: Buffer, iterations: number, cryptoMethod: CryptoMethod) {
-  // omit the work if already generated
-  const key = [data, salt.toString('base64'), iterations].join('_');
-  if (_hiCache[key] != null) {
-    return _hiCache[key];
-  }
-
-  // generate the salt
-  const saltedData = crypto.pbkdf2Sync(
-    data,
-    salt,
-    iterations,
-    hiLengthMap[cryptoMethod],
-    cryptoMethod
-  );
-
-  // cache a copy to speed up the next lookup, but prevent unbounded cache growth
-  if (_hiCacheCount >= 200) {
-    _hiCachePurge();
-  }
-
-  _hiCache[key] = saltedData;
-  _hiCacheCount += 1;
-  return saltedData;
-}
-
-function compareDigest(lhs: Buffer, rhs: Uint8Array) {
-  if (lhs.length !== rhs.length) {
-    return false;
-  }
-
-  if (typeof crypto.timingSafeEqual === 'function') {
-    return crypto.timingSafeEqual(lhs, rhs);
-  }
-
-  let result = 0;
-  for (let i = 0; i < lhs.length; i++) {
-    result |= lhs[i] ^ rhs[i];
-  }
-
-  return result === 0;
-}
-
-export class ScramSHA1 extends ScramSHA {
-  constructor() {
-    super('sha1');
-  }
-}
-
-export class ScramSHA256 extends ScramSHA {
-  constructor() {
-    super('sha256');
-  }
-}

package/templates/node_modules/mongodb/src/cmap/auth/x509.ts

@@ -1,43 +0,0 @@
-import type { Document } from '../../bson';
-import { MongoMissingCredentialsError } from '../../error';
-import { ns } from '../../utils';
-import type { HandshakeDocument } from '../connect';
-import { type AuthContext, AuthProvider } from './auth_provider';
-import type { MongoCredentials } from './mongo_credentials';
-
-export class X509 extends AuthProvider {
-  override async prepare(
-    handshakeDoc: HandshakeDocument,
-    authContext: AuthContext
-  ): Promise<HandshakeDocument> {
-    const { credentials } = authContext;
-    if (!credentials) {
-      throw new MongoMissingCredentialsError('AuthContext must provide credentials.');
-    }
-    return { ...handshakeDoc, speculativeAuthenticate: x509AuthenticateCommand(credentials) };
-  }
-
-  override async auth(authContext: AuthContext) {
-    const connection = authContext.connection;
-    const credentials = authContext.credentials;
-    if (!credentials) {
-      throw new MongoMissingCredentialsError('AuthContext must provide credentials.');
-    }
-    const response = authContext.response;
-
-    if (response?.speculativeAuthenticate) {
-      return;
-    }
-
-    await connection.command(ns('$external.$cmd'), x509AuthenticateCommand(credentials), undefined);
-  }
-}
-
-function x509AuthenticateCommand(credentials: MongoCredentials) {
-  const command: Document = { authenticate: 1, mechanism: 'MONGODB-X509' };
-  if (credentials.username) {
-    command.user = credentials.username;
-  }
-
-  return command;
-}

package/templates/node_modules/mongodb/src/cmap/command_monitoring_events.ts

@@ -1,316 +0,0 @@
-import { type Document, type ObjectId } from '../bson';
-import {
-  COMMAND_FAILED,
-  COMMAND_STARTED,
-  COMMAND_SUCCEEDED,
-  LEGACY_HELLO_COMMAND,
-  LEGACY_HELLO_COMMAND_CAMEL_CASE
-} from '../constants';
-import { calculateDurationInMs } from '../utils';
-import {
-  DocumentSequence,
-  OpMsgRequest,
-  type OpQueryRequest,
-  type WriteProtocolMessageType
-} from './commands';
-import type { Connection } from './connection';
-
-/**
- * An event indicating the start of a given command
- * @public
- * @category Event
- */
-export class CommandStartedEvent {
-  commandObj?: Document;
-  requestId: number;
-  databaseName: string;
-  commandName: string;
-  command: Document;
-  address: string;
-  /** Driver generated connection id */
-  connectionId?: string | number;
-  /**
-   * Server generated connection id
-   * Distinct from the connection id and is returned by the hello or legacy hello response as "connectionId"
-   * from the server on 4.2+.
-   */
-  serverConnectionId: bigint | null;
-  serviceId?: ObjectId;
-  /** @internal */
-  name = COMMAND_STARTED;
-
-  /**
-   * Create a started event
-   *
-   * @internal
-   * @param pool - the pool that originated the command
-   * @param command - the command
-   */
-  constructor(
-    connection: Connection,
-    command: WriteProtocolMessageType,
-    serverConnectionId: bigint | null
-  ) {
-    const cmd = extractCommand(command);
-    const commandName = extractCommandName(cmd);
-    const { address, connectionId, serviceId } = extractConnectionDetails(connection);
-
-    // TODO: remove in major revision, this is not spec behavior
-    if (SENSITIVE_COMMANDS.has(commandName)) {
-      this.commandObj = {};
-      this.commandObj[commandName] = true;
-    }
-
-    this.address = address;
-    this.connectionId = connectionId;
-    this.serviceId = serviceId;
-    this.requestId = command.requestId;
-    this.databaseName = command.databaseName;
-    this.commandName = commandName;
-    this.command = maybeRedact(commandName, cmd, cmd);
-    this.serverConnectionId = serverConnectionId;
-  }
-
-  /* @internal */
-  get hasServiceId(): boolean {
-    return !!this.serviceId;
-  }
-}
-
-/**
- * An event indicating the success of a given command
- * @public
- * @category Event
- */
-export class CommandSucceededEvent {
-  address: string;
-  /** Driver generated connection id */
-  connectionId?: string | number;
-  /**
-   * Server generated connection id
-   * Distinct from the connection id and is returned by the hello or legacy hello response as "connectionId" from the server on 4.2+.
-   */
-  serverConnectionId: bigint | null;
-  requestId: number;
-  duration: number;
-  commandName: string;
-  reply: unknown;
-  serviceId?: ObjectId;
-  databaseName: string;
-  /** @internal */
-  name = COMMAND_SUCCEEDED;
-
-  /**
-   * Create a succeeded event
-   *
-   * @internal
-   * @param pool - the pool that originated the command
-   * @param command - the command
-   * @param reply - the reply for this command from the server
-   * @param started - a high resolution tuple timestamp of when the command was first sent, to calculate duration
-   */
-  constructor(
-    connection: Connection,
-    command: WriteProtocolMessageType,
-    reply: Document | undefined,
-    started: number,
-    serverConnectionId: bigint | null
-  ) {
-    const cmd = extractCommand(command);
-    const commandName = extractCommandName(cmd);
-    const { address, connectionId, serviceId } = extractConnectionDetails(connection);
-
-    this.address = address;
-    this.connectionId = connectionId;
-    this.serviceId = serviceId;
-    this.requestId = command.requestId;
-    this.commandName = commandName;
-    this.duration = calculateDurationInMs(started);
-    this.reply = maybeRedact(commandName, cmd, extractReply(reply));
-    this.serverConnectionId = serverConnectionId;
-    this.databaseName = command.databaseName;
-  }
-
-  /* @internal */
-  get hasServiceId(): boolean {
-    return !!this.serviceId;
-  }
-}
-
-/**
- * An event indicating the failure of a given command
- * @public
- * @category Event
- */
-export class CommandFailedEvent {
-  address: string;
-  /** Driver generated connection id */
-  connectionId?: string | number;
-  /**
-   * Server generated connection id
-   * Distinct from the connection id and is returned by the hello or legacy hello response as "connectionId" from the server on 4.2+.
-   */
-  serverConnectionId: bigint | null;
-  requestId: number;
-  duration: number;
-  commandName: string;
-  failure: Error;
-  serviceId?: ObjectId;
-  databaseName: string;
-  /** @internal */
-  name = COMMAND_FAILED;
-
-  /**
-   * Create a failure event
-   *
-   * @internal
-   * @param pool - the pool that originated the command
-   * @param command - the command
-   * @param error - the generated error or a server error response
-   * @param started - a high resolution tuple timestamp of when the command was first sent, to calculate duration
-   */
-  constructor(
-    connection: Connection,
-    command: WriteProtocolMessageType,
-    error: Error | Document,
-    started: number,
-    serverConnectionId: bigint | null
-  ) {
-    const cmd = extractCommand(command);
-    const commandName = extractCommandName(cmd);
-    const { address, connectionId, serviceId } = extractConnectionDetails(connection);
-
-    this.address = address;
-    this.connectionId = connectionId;
-    this.serviceId = serviceId;
-
-    this.requestId = command.requestId;
-    this.commandName = commandName;
-    this.duration = calculateDurationInMs(started);
-    this.failure = maybeRedact(commandName, cmd, error) as Error;
-    this.serverConnectionId = serverConnectionId;
-    this.databaseName = command.databaseName;
-  }
-
-  /* @internal */
-  get hasServiceId(): boolean {
-    return !!this.serviceId;
-  }
-}
-
-/**
- * Commands that we want to redact because of the sensitive nature of their contents
- * @internal
- */
-export const SENSITIVE_COMMANDS = new Set([
-  'authenticate',
-  'saslStart',
-  'saslContinue',
-  'getnonce',
-  'createUser',
-  'updateUser',
-  'copydbgetnonce',
-  'copydbsaslstart',
-  'copydb'
-]);
-
-const HELLO_COMMANDS = new Set(['hello', LEGACY_HELLO_COMMAND, LEGACY_HELLO_COMMAND_CAMEL_CASE]);
-
-// helper methods
-const extractCommandName = (commandDoc: Document) => Object.keys(commandDoc)[0];
-const collectionName = (command: OpQueryRequest) => command.ns.split('.')[1];
-const maybeRedact = (commandName: string, commandDoc: Document, result: Error | Document) =>
-  SENSITIVE_COMMANDS.has(commandName) ||
-  (HELLO_COMMANDS.has(commandName) && commandDoc.speculativeAuthenticate)
-    ? {}
-    : result;
-
-const LEGACY_FIND_QUERY_MAP: { [key: string]: string } = {
-  $query: 'filter',
-  $orderby: 'sort',
-  $hint: 'hint',
-  $comment: 'comment',
-  $maxScan: 'maxScan',
-  $max: 'max',
-  $min: 'min',
-  $returnKey: 'returnKey',
-  $showDiskLoc: 'showRecordId',
-  $maxTimeMS: 'maxTimeMS',
-  $snapshot: 'snapshot'
-};
-
-const LEGACY_FIND_OPTIONS_MAP = {
-  numberToSkip: 'skip',
-  numberToReturn: 'batchSize',
-  returnFieldSelector: 'projection'
-} as const;
-
-/** Extract the actual command from the query, possibly up-converting if it's a legacy format */
-function extractCommand(command: WriteProtocolMessageType): Document {
-  if (command instanceof OpMsgRequest) {
-    const cmd = { ...command.command };
-    // For OP_MSG with payload type 1 we need to pull the documents
-    // array out of the document sequence for monitoring.
-    if (cmd.ops instanceof DocumentSequence) {
-      cmd.ops = cmd.ops.documents;
-    }
-    if (cmd.nsInfo instanceof DocumentSequence) {
-      cmd.nsInfo = cmd.nsInfo.documents;
-    }
-    return cmd;
-  }
-
-  if (command.query?.$query) {
-    let result: Document;
-    if (command.ns === 'admin.$cmd') {
-      // up-convert legacy command
-      result = Object.assign({}, command.query.$query);
-    } else {
-      // up-convert legacy find command
-      result = { find: collectionName(command) };
-      Object.keys(LEGACY_FIND_QUERY_MAP).forEach(key => {
-        if (command.query[key] != null) {
-          result[LEGACY_FIND_QUERY_MAP[key]] = { ...command.query[key] };
-        }
-      });
-    }
-
-    Object.keys(LEGACY_FIND_OPTIONS_MAP).forEach(key => {
-      const legacyKey = key as keyof typeof LEGACY_FIND_OPTIONS_MAP;
-      if (command[legacyKey] != null) {
-        result[LEGACY_FIND_OPTIONS_MAP[legacyKey]] = command[legacyKey];
-      }
-    });
-
-    return result;
-  }
-
-  let clonedQuery: Record<string, unknown> = {};
-  const clonedCommand: Record<string, unknown> = { ...command };
-  if (command.query) {
-    clonedQuery = { ...command.query };
-    clonedCommand.query = clonedQuery;
-  }
-
-  return command.query ? clonedQuery : clonedCommand;
-}
-
-function extractReply(reply?: Document) {
-  if (!reply) {
-    return reply;
-  }
-
-  return reply.result ? reply.result : reply;
-}
-
-function extractConnectionDetails(connection: Connection) {
-  let connectionId;
-  if ('id' in connection) {
-    connectionId = connection.id;
-  }
-  return {
-    address: connection.address,
-    serviceId: connection.serviceId,
-    connectionId
-  };
-}