mongodb 5.3.0 → 5.4.0

package/lib/admin.js

@@ -37,6 +37,22 @@ class Admin {
     /**
      * Execute a command
      *
+     * The driver will ensure the following fields are attached to the command sent to the server:
+     * - `lsid` - sourced from an implicit session or options.session
+     * - `$readPreference` - defaults to primary or can be configured by options.readPreference
+     * - `$db` - sourced from the name of this database
+     *
+     * If the client has a serverApi setting:
+     * - `apiVersion`
+     * - `apiStrict`
+     * - `apiDeprecationErrors`
+     *
+     * When in a transaction:
+     * - `readConcern` - sourced from readConcern set on the TransactionOptions
+     * - `writeConcern` - sourced from writeConcern set on the TransactionOptions
+     *
+     * Attaching any of the above fields to the command will have no effect as the driver will overwrite the value.
+     *
      * @param command - The command to execute
      * @param options - Optional settings for the command
      */

package/lib/admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":";;;AAEA,oDAAyE;AAEzE,sEAAkE;AAClE,gEAIqC;AACrC,0DAAkF;AAClF,0DAAkF;AAClF,0EAG0C;AAO1C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,KAAK;IAIhB;;;OAGG;IACH,YAAY,EAAM;QAChB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,OAAiB,EAAE,OAA2B;QAC1D,OAAO,IAAA,oCAAgB,EACrB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAClB,IAAI,iCAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAC7E,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,OAAiC;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,OAAiC;QAChD,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,OAAiC;QAClD,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,OAAiC;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CACX,QAAgB,EAChB,iBAA2C,EAC3C,OAAwB;QAExB,OAAO;YACL,OAAO,IAAI,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAC5C,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,iBAAiB,IAAI,IAAI,IAAI,OAAO,iBAAiB,KAAK,QAAQ;oBACpE,CAAC,CAAC,iBAAiB;oBACnB,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,QAAQ,GAAG,OAAO,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,OAAO,IAAA,oCAAgB,EACrB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAClB,IAAI,2BAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CACrF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,OAA2B;QAC5D,OAAO,IAAA,oCAAgB,EACrB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAClB,IAAI,iCAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAC9E,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CACtB,cAAsB,EACtB,UAAqC,EAAE;QAEvC,OAAO,IAAA,oCAAgB,EACrB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAClB,IAAI,iDAA2B,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,CAC/D,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,OAA8B;QAChD,OAAO,IAAA,oCAAgB,EAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,uCAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAiC;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CACF;AAtID,sBAsIC"}
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":";;;AAEA,oDAAyE;AAEzE,sEAAkE;AAClE,gEAIqC;AACrC,0DAAkF;AAClF,0DAAkF;AAClF,0EAG0C;AAO1C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,KAAK;IAIhB;;;OAGG;IACH,YAAY,EAAM;QAChB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,OAAO,CAAC,OAAiB,EAAE,OAA2B;QAC1D,OAAO,IAAA,oCAAgB,EACrB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAClB,IAAI,iCAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAC7E,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,OAAiC;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,OAAiC;QAChD,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,OAAiC;QAClD,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,OAAiC;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CACX,QAAgB,EAChB,iBAA2C,EAC3C,OAAwB;QAExB,OAAO;YACL,OAAO,IAAI,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAC5C,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,iBAAiB,IAAI,IAAI,IAAI,OAAO,iBAAiB,KAAK,QAAQ;oBACpE,CAAC,CAAC,iBAAiB;oBACnB,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,QAAQ,GAAG,OAAO,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,OAAO,IAAA,oCAAgB,EACrB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAClB,IAAI,2BAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CACrF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,OAA2B;QAC5D,OAAO,IAAA,oCAAgB,EACrB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAClB,IAAI,iCAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAC9E,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CACtB,cAAsB,EACtB,UAAqC,EAAE;QAEvC,OAAO,IAAA,oCAAgB,EACrB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAClB,IAAI,iDAA2B,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,CAC/D,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,OAA8B;QAChD,OAAO,IAAA,oCAAgB,EAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,uCAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAiC;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CACF;AAtJD,sBAsJC"}

package/lib/cmap/auth/mongo_credentials.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MongoCredentials = void 0;
+exports.MongoCredentials = exports.DEFAULT_ALLOWED_HOSTS = void 0;
 const error_1 = require("../../error");
 const gssapi_1 = require("./gssapi");
 const providers_1 = require("./providers");
@@ -22,13 +22,23 @@ function getDefaultAuthMechanism(hello) {
     // Default for wireprotocol < 3
     return providers_1.AuthMechanism.MONGODB_CR;
 }
+const ALLOWED_HOSTS_ERROR = 'Auth mechanism property ALLOWED_HOSTS must be an array of strings.';
+/** @internal */
+exports.DEFAULT_ALLOWED_HOSTS = [
+    '*.mongodb.net',
+    '*.mongodb-dev.net',
+    '*.mongodbgov.net',
+    'localhost',
+    '127.0.0.1',
+    '::1'
+];
 /**
  * A representation of the credentials used by MongoDB
  * @public
  */
 class MongoCredentials {
     constructor(options) {
-        this.username = options.username;
+        this.username = options.username ?? '';
         this.password = options.password;
         this.source = options.source;
         if (!this.source && options.db) {
@@ -51,6 +61,12 @@ class MongoCredentials {
                 };
             }
         }
+        if (this.mechanism === providers_1.AuthMechanism.MONGODB_OIDC && !this.mechanismProperties.ALLOWED_HOSTS) {
+            this.mechanismProperties = {
+                ...this.mechanismProperties,
+                ALLOWED_HOSTS: exports.DEFAULT_ALLOWED_HOSTS
+            };
+        }
         Object.freeze(this.mechanismProperties);
         Object.freeze(this);
     }
@@ -105,6 +121,17 @@ class MongoCredentials {
                 !this.mechanismProperties.REQUEST_TOKEN_CALLBACK) {
                 throw new error_1.MongoInvalidArgumentError(`Either a PROVIDER_NAME or a REQUEST_TOKEN_CALLBACK must be specified for mechanism '${this.mechanism}'.`);
             }
+            if (this.mechanismProperties.ALLOWED_HOSTS) {
+                const hosts = this.mechanismProperties.ALLOWED_HOSTS;
+                if (!Array.isArray(hosts)) {
+                    throw new error_1.MongoInvalidArgumentError(ALLOWED_HOSTS_ERROR);
+                }
+                for (const host of hosts) {
+                    if (typeof host !== 'string') {
+                        throw new error_1.MongoInvalidArgumentError(ALLOWED_HOSTS_ERROR);
+                    }
+                }
+            }
         }
         if (providers_1.AUTH_MECHS_AUTH_SRC_EXTERNAL.has(this.mechanism)) {
             if (this.source != null && this.source !== '$external') {

package/lib/cmap/auth/mongo_credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"mongo_credentials.js","sourceRoot":"","sources":["../../../src/cmap/auth/mongo_credentials.ts"],"names":[],"mappings":";;;AAEA,uCAIqB;AACrB,qCAAuD;AAEvD,2CAA0E;AAE1E,6EAA6E;AAC7E,SAAS,uBAAuB,CAAC,KAAgB;IAC/C,IAAI,KAAK,EAAE;QACT,0DAA0D;QAC1D,uCAAuC;QACvC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE;YAC3C,OAAO,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,yBAAa,CAAC,oBAAoB,CAAC;gBAC1E,CAAC,CAAC,yBAAa,CAAC,oBAAoB;gBACpC,CAAC,CAAC,yBAAa,CAAC,kBAAkB,CAAC;SACtC;QAED,6EAA6E;QAC7E,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,EAAE;YAC7B,OAAO,yBAAa,CAAC,kBAAkB,CAAC;SACzC;KACF;IAED,+BAA+B;IAC/B,OAAO,yBAAa,CAAC,UAAU,CAAC;AAClC,CAAC;AA2BD;;;GAGG;AACH,MAAa,gBAAgB;IAY3B,YAAY,OAAgC;QAC1C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,EAAE;YAC9B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;SAC1B;QACD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,yBAAa,CAAC,eAAe,CAAC;QACpE,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAE7D,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE;YACxC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE;gBACnD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;aAC/C;YAED,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE;gBACvD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;aACnD;YAED,IACE,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,IAAI,IAAI;gBAClD,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,EACrC;gBACA,IAAI,CAAC,mBAAmB,GAAG;oBACzB,GAAG,IAAI,CAAC,mBAAmB;oBAC3B,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;iBACjD,CAAC;aACH;SACF;QAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,gEAAgE;IAChE,MAAM,CAAC,KAAuB;QAC5B,OAAO,CACL,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;YAClC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YAChC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YAChC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAC7B,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAAC,KAAgB;QACnC,0EAA0E;QAC1E,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE;YACpC,OAAO,IAAI,gBAAgB,CAAC;gBAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS,EAAE,uBAAuB,CAAC,KAAK,CAAC;gBACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CAAC,CAAC;SACJ;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ;QACN,IACE,CAAC,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,cAAc;YAC9C,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,UAAU;YAC3C,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,aAAa;YAC9C,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,kBAAkB;YACnD,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,oBAAoB,CAAC;YACxD,CAAC,IAAI,CAAC,QAAQ,EACd;YACA,MAAM,IAAI,oCAA4B,CAAC,oCAAoC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;SAC/F;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,YAAY,EAAE;YACjD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE;gBAC3D,MAAM,IAAI,iCAAyB,CACjC,sEAAsE,IAAI,CAAC,SAAS,IAAI,CACzF,CAAC;aACH;YAED,IACE,IAAI,CAAC,mBAAmB,CAAC,aAAa;gBACtC,IAAI,CAAC,mBAAmB,CAAC,aAAa,KAAK,KAAK,EAChD;gBACA,MAAM,IAAI,iCAAyB,CACjC,uEAAuE,IAAI,CAAC,SAAS,IAAI,CAC1F,CAAC;aACH;YAED,IACE,IAAI,CAAC,mBAAmB,CAAC,sBAAsB;gBAC/C,CAAC,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,EAChD;gBACA,MAAM,IAAI,iCAAyB,CACjC,gGAAgG,IAAI,CAAC,SAAS,GAAG,CAClH,CAAC;aACH;YAED,IACE,CAAC,IAAI,CAAC,mBAAmB,CAAC,aAAa;gBACvC,CAAC,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,EAChD;gBACA,MAAM,IAAI,iCAAyB,CACjC,uFAAuF,IAAI,CAAC,SAAS,IAAI,CAC1G,CAAC;aACH;SACF;QAED,IAAI,wCAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;YACpD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE;gBACtD,gEAAgE;gBAChE,MAAM,IAAI,qBAAa,CACrB,mBAAmB,IAAI,CAAC,MAAM,oBAAoB,IAAI,CAAC,SAAS,cAAc,CAC/E,CAAC;aACH;SACF;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE;YACzE,gEAAgE;YAChE,MAAM,IAAI,qBAAa,CAAC,qDAAqD,CAAC,CAAC;SAChF;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,YAAY,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE;YAC1E,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,EAAE;gBACxB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;gBACzC,OAAO;aACR;YACD,gEAAgE;YAChE,MAAM,IAAI,qBAAa,CAAC,iDAAiD,CAAC,CAAC;SAC5E;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,IAAI,KAAK,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,oCAA2B,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;YAC1E,MAAM,IAAI,qBAAa,CAAC,yCAAyC,gBAAgB,EAAE,CAAC,CAAC;SACtF;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CACV,KAAmC,EACnC,OAAyC;QAEzC,OAAO,IAAI,gBAAgB,CAAC;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK,EAAE,QAAQ,IAAI,EAAE;YACnD,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK,EAAE,QAAQ,IAAI,EAAE;YACnD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK,EAAE,SAAS,IAAI,yBAAa,CAAC,eAAe;YACjF,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,KAAK,EAAE,mBAAmB,IAAI,EAAE;YACpF,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,EAAE,MAAM,IAAI,OAAO;SACjE,CAAC,CAAC;IACL,CAAC;CACF;AArKD,4CAqKC"}
+{"version":3,"file":"mongo_credentials.js","sourceRoot":"","sources":["../../../src/cmap/auth/mongo_credentials.ts"],"names":[],"mappings":";;;AAEA,uCAIqB;AACrB,qCAAuD;AAEvD,2CAA0E;AAE1E,6EAA6E;AAC7E,SAAS,uBAAuB,CAAC,KAAgB;IAC/C,IAAI,KAAK,EAAE;QACT,0DAA0D;QAC1D,uCAAuC;QACvC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE;YAC3C,OAAO,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,yBAAa,CAAC,oBAAoB,CAAC;gBAC1E,CAAC,CAAC,yBAAa,CAAC,oBAAoB;gBACpC,CAAC,CAAC,yBAAa,CAAC,kBAAkB,CAAC;SACtC;QAED,6EAA6E;QAC7E,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,EAAE;YAC7B,OAAO,yBAAa,CAAC,kBAAkB,CAAC;SACzC;KACF;IAED,+BAA+B;IAC/B,OAAO,yBAAa,CAAC,UAAU,CAAC;AAClC,CAAC;AAED,MAAM,mBAAmB,GAAG,oEAAoE,CAAC;AAEjG,gBAAgB;AACH,QAAA,qBAAqB,GAAG;IACnC,eAAe;IACf,mBAAmB;IACnB,kBAAkB;IAClB,WAAW;IACX,WAAW;IACX,KAAK;CACN,CAAC;AA6BF;;;GAGG;AACH,MAAa,gBAAgB;IAY3B,YAAY,OAAgC;QAC1C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,EAAE;YAC9B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;SAC1B;QACD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,yBAAa,CAAC,eAAe,CAAC;QACpE,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAE7D,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE;YACxC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE;gBACnD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;aAC/C;YAED,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE;gBACvD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;aACnD;YAED,IACE,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,IAAI,IAAI;gBAClD,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,EACrC;gBACA,IAAI,CAAC,mBAAmB,GAAG;oBACzB,GAAG,IAAI,CAAC,mBAAmB;oBAC3B,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;iBACjD,CAAC;aACH;SACF;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE;YAC5F,IAAI,CAAC,mBAAmB,GAAG;gBACzB,GAAG,IAAI,CAAC,mBAAmB;gBAC3B,aAAa,EAAE,6BAAqB;aACrC,CAAC;SACH;QAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,gEAAgE;IAChE,MAAM,CAAC,KAAuB;QAC5B,OAAO,CACL,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;YAClC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YAChC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YAChC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAC7B,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAAC,KAAgB;QACnC,0EAA0E;QAC1E,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE;YACpC,OAAO,IAAI,gBAAgB,CAAC;gBAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS,EAAE,uBAAuB,CAAC,KAAK,CAAC;gBACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CAAC,CAAC;SACJ;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ;QACN,IACE,CAAC,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,cAAc;YAC9C,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,UAAU;YAC3C,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,aAAa;YAC9C,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,kBAAkB;YACnD,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,oBAAoB,CAAC;YACxD,CAAC,IAAI,CAAC,QAAQ,EACd;YACA,MAAM,IAAI,oCAA4B,CAAC,oCAAoC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;SAC/F;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,YAAY,EAAE;YACjD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE;gBAC3D,MAAM,IAAI,iCAAyB,CACjC,sEAAsE,IAAI,CAAC,SAAS,IAAI,CACzF,CAAC;aACH;YAED,IACE,IAAI,CAAC,mBAAmB,CAAC,aAAa;gBACtC,IAAI,CAAC,mBAAmB,CAAC,aAAa,KAAK,KAAK,EAChD;gBACA,MAAM,IAAI,iCAAyB,CACjC,uEAAuE,IAAI,CAAC,SAAS,IAAI,CAC1F,CAAC;aACH;YAED,IACE,IAAI,CAAC,mBAAmB,CAAC,sBAAsB;gBAC/C,CAAC,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,EAChD;gBACA,MAAM,IAAI,iCAAyB,CACjC,gGAAgG,IAAI,CAAC,SAAS,GAAG,CAClH,CAAC;aACH;YAED,IACE,CAAC,IAAI,CAAC,mBAAmB,CAAC,aAAa;gBACvC,CAAC,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,EAChD;gBACA,MAAM,IAAI,iCAAyB,CACjC,uFAAuF,IAAI,CAAC,SAAS,IAAI,CAC1G,CAAC;aACH;YAED,IAAI,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE;gBAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC;gBACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;oBACzB,MAAM,IAAI,iCAAyB,CAAC,mBAAmB,CAAC,CAAC;iBAC1D;gBACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;oBACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;wBAC5B,MAAM,IAAI,iCAAyB,CAAC,mBAAmB,CAAC,CAAC;qBAC1D;iBACF;aACF;SACF;QAED,IAAI,wCAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;YACpD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE;gBACtD,gEAAgE;gBAChE,MAAM,IAAI,qBAAa,CACrB,mBAAmB,IAAI,CAAC,MAAM,oBAAoB,IAAI,CAAC,SAAS,cAAc,CAC/E,CAAC;aACH;SACF;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE;YACzE,gEAAgE;YAChE,MAAM,IAAI,qBAAa,CAAC,qDAAqD,CAAC,CAAC;SAChF;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAa,CAAC,YAAY,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE;YAC1E,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,EAAE;gBACxB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;gBACzC,OAAO;aACR;YACD,gEAAgE;YAChE,MAAM,IAAI,qBAAa,CAAC,iDAAiD,CAAC,CAAC;SAC5E;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,IAAI,KAAK,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,oCAA2B,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;YAC1E,MAAM,IAAI,qBAAa,CAAC,yCAAyC,gBAAgB,EAAE,CAAC,CAAC;SACtF;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CACV,KAAmC,EACnC,OAAyC;QAEzC,OAAO,IAAI,gBAAgB,CAAC;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK,EAAE,QAAQ,IAAI,EAAE;YACnD,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK,EAAE,QAAQ,IAAI,EAAE;YACnD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK,EAAE,SAAS,IAAI,yBAAa,CAAC,eAAe;YACjF,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,KAAK,EAAE,mBAAmB,IAAI,EAAE;YACpF,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,EAAE,MAAM,IAAI,OAAO;SACjE,CAAC,CAAC;IACL,CAAC;CACF;AAxLD,4CAwLC"}

package/lib/cmap/auth/mongodb_oidc/aws_service_workflow.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AwsServiceWorkflow = void 0;
-const promises_1 = require("fs/promises");
+const fs = require("fs");
 const error_1 = require("../../../error");
 const service_workflow_1 = require("./service_workflow");
+/** Error for when the token is missing in the environment. */
+const TOKEN_MISSING_ERROR = 'AWS_WEB_IDENTITY_TOKEN_FILE must be set in the environment.';
 /**
  * Device workflow implementation for AWS.
  *
@@ -19,9 +21,9 @@ class AwsServiceWorkflow extends service_workflow_1.ServiceWorkflow {
     async getToken() {
         const tokenFile = process.env.AWS_WEB_IDENTITY_TOKEN_FILE;
         if (!tokenFile) {
-            throw new error_1.MongoAWSError('AWS_WEB_IDENTITY_TOKEN_FILE must be set in the environment.');
+            throw new error_1.MongoAWSError(TOKEN_MISSING_ERROR);
         }
-        return (0, promises_1.readFile)(tokenFile, 'utf8');
+        return fs.promises.readFile(tokenFile, 'utf8');
     }
 }
 exports.AwsServiceWorkflow = AwsServiceWorkflow;

package/lib/cmap/auth/mongodb_oidc/aws_service_workflow.js.map

@@ -1 +1 @@
-{"version":3,"file":"aws_service_workflow.js","sourceRoot":"","sources":["../../../../src/cmap/auth/mongodb_oidc/aws_service_workflow.ts"],"names":[],"mappings":";;;AAAA,0CAAuC;AAEvC,0CAA+C;AAC/C,yDAAqD;AAErD;;;;GAIG;AACH,MAAa,kBAAmB,SAAQ,kCAAe;IACrD;QACE,KAAK,EAAE,CAAC;IACV,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;QAC1D,IAAI,CAAC,SAAS,EAAE;YACd,MAAM,IAAI,qBAAa,CAAC,6DAA6D,CAAC,CAAC;SACxF;QACD,OAAO,IAAA,mBAAQ,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;CACF;AAfD,gDAeC"}
+{"version":3,"file":"aws_service_workflow.js","sourceRoot":"","sources":["../../../../src/cmap/auth/mongodb_oidc/aws_service_workflow.ts"],"names":[],"mappings":";;;AAAA,yBAAyB;AAEzB,0CAA+C;AAC/C,yDAAqD;AAErD,8DAA8D;AAC9D,MAAM,mBAAmB,GAAG,6DAA6D,CAAC;AAE1F;;;;GAIG;AACH,MAAa,kBAAmB,SAAQ,kCAAe;IACrD;QACE,KAAK,EAAE,CAAC;IACV,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;QAC1D,IAAI,CAAC,SAAS,EAAE;YACd,MAAM,IAAI,qBAAa,CAAC,mBAAmB,CAAC,CAAC;SAC9C;QACD,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;CACF;AAfD,gDAeC"}

package/lib/cmap/auth/mongodb_oidc/cache.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Cache = void 0;
+/**
+ * Base class for OIDC caches.
+ */
+class Cache {
+    /**
+     * Create a new cache.
+     */
+    constructor() {
+        this.entries = new Map();
+    }
+    /**
+     * Clear the cache.
+     */
+    clear() {
+        this.entries.clear();
+    }
+    /**
+     * Create a cache key from the address and username.
+     */
+    cacheKey(address, username, callbackHash) {
+        return JSON.stringify([address, username, callbackHash]);
+    }
+}
+exports.Cache = Cache;
+//# sourceMappingURL=cache.js.map

package/lib/cmap/auth/mongodb_oidc/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../../../src/cmap/auth/mongodb_oidc/cache.ts"],"names":[],"mappings":";;;AAAA;;GAEG;AACH,MAAsB,KAAK;IAGzB;;OAEG;IACH;QACE,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,OAAe,EAAE,QAAgB,EAAE,YAAoB;QAC9D,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IAC3D,CAAC;CACF;AAvBD,sBAuBC"}

package/lib/cmap/auth/mongodb_oidc/callback_lock_cache.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CallbackLockCache = void 0;
+const error_1 = require("../../../error");
+const cache_1 = require("./cache");
+/** Error message for when request callback is missing. */
+const REQUEST_CALLBACK_REQUIRED_ERROR = 'Auth mechanism property REQUEST_TOKEN_CALLBACK is required.';
+/* Counter for function "hashes".*/
+let FN_HASH_COUNTER = 0;
+/* No function present function */
+const NO_FUNCTION = async () => ({ accessToken: 'test' });
+/* The map of function hashes */
+const FN_HASHES = new WeakMap();
+/* Put the no function hash in the map. */
+FN_HASHES.set(NO_FUNCTION, FN_HASH_COUNTER);
+/**
+ * A cache of request and refresh callbacks per server/user.
+ */
+class CallbackLockCache extends cache_1.Cache {
+    /**
+     * Get the callbacks for the connection and credentials. If an entry does not
+     * exist a new one will get set.
+     */
+    getCallbacks(connection, credentials) {
+        const requestCallback = credentials.mechanismProperties.REQUEST_TOKEN_CALLBACK;
+        const refreshCallback = credentials.mechanismProperties.REFRESH_TOKEN_CALLBACK;
+        if (!requestCallback) {
+            throw new error_1.MongoInvalidArgumentError(REQUEST_CALLBACK_REQUIRED_ERROR);
+        }
+        const callbackHash = hashFunctions(requestCallback, refreshCallback);
+        const key = this.cacheKey(connection.address, credentials.username, callbackHash);
+        const entry = this.entries.get(key);
+        if (entry) {
+            return entry;
+        }
+        return this.setCallbacks(key, callbackHash, requestCallback, refreshCallback);
+    }
+    /**
+     * Set locked callbacks on for connection and credentials.
+     */
+    setCallbacks(key, callbackHash, requestCallback, refreshCallback) {
+        const entry = {
+            requestCallback: withLock(requestCallback),
+            refreshCallback: refreshCallback ? withLock(refreshCallback) : undefined,
+            callbackHash: callbackHash
+        };
+        this.entries.set(key, entry);
+        return entry;
+    }
+}
+exports.CallbackLockCache = CallbackLockCache;
+/**
+ * Ensure the callback is only executed one at a time.
+ */
+function withLock(callback) {
+    let lock = Promise.resolve();
+    return async (info, context) => {
+        await lock;
+        lock = lock.then(() => callback(info, context));
+        return lock;
+    };
+}
+/**
+ * Get the hash string for the request and refresh functions.
+ */
+function hashFunctions(requestFn, refreshFn) {
+    let requestHash = FN_HASHES.get(requestFn);
+    let refreshHash = FN_HASHES.get(refreshFn ?? NO_FUNCTION);
+    if (requestHash == null) {
+        // Create a new one for the function and put it in the map.
+        FN_HASH_COUNTER++;
+        requestHash = FN_HASH_COUNTER;
+        FN_HASHES.set(requestFn, FN_HASH_COUNTER);
+    }
+    if (refreshHash == null && refreshFn) {
+        // Create a new one for the function and put it in the map.
+        FN_HASH_COUNTER++;
+        refreshHash = FN_HASH_COUNTER;
+        FN_HASHES.set(refreshFn, FN_HASH_COUNTER);
+    }
+    return `${requestHash}-${refreshHash}`;
+}
+//# sourceMappingURL=callback_lock_cache.js.map

package/lib/cmap/auth/mongodb_oidc/callback_lock_cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback_lock_cache.js","sourceRoot":"","sources":["../../../../src/cmap/auth/mongodb_oidc/callback_lock_cache.ts"],"names":[],"mappings":";;;AAAA,0CAA2D;AAU3D,mCAAgC;AAEhC,0DAA0D;AAC1D,MAAM,+BAA+B,GACnC,6DAA6D,CAAC;AAChE,mCAAmC;AACnC,IAAI,eAAe,GAAG,CAAC,CAAC;AACxB,kCAAkC;AAClC,MAAM,WAAW,GAAwB,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;AAC/E,gCAAgC;AAChC,MAAM,SAAS,GAAG,IAAI,OAAO,EAAqD,CAAC;AACnF,0CAA0C;AAC1C,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;AAW5C;;GAEG;AACH,MAAa,iBAAkB,SAAQ,aAAqB;IAC1D;;;OAGG;IACH,YAAY,CAAC,UAAsB,EAAE,WAA6B;QAChE,MAAM,eAAe,GAAG,WAAW,CAAC,mBAAmB,CAAC,sBAAsB,CAAC;QAC/E,MAAM,eAAe,GAAG,WAAW,CAAC,mBAAmB,CAAC,sBAAsB,CAAC;QAC/E,IAAI,CAAC,eAAe,EAAE;YACpB,MAAM,IAAI,iCAAyB,CAAC,+BAA+B,CAAC,CAAC;SACtE;QACD,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,EAAE;YACT,OAAO,KAAK,CAAC;SACd;QACD,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;IAChF,CAAC;IAED;;OAEG;IACK,YAAY,CAClB,GAAW,EACX,YAAoB,EACpB,eAAoC,EACpC,eAAqC;QAErC,MAAM,KAAK,GAAG;YACZ,eAAe,EAAE,QAAQ,CAAC,eAAe,CAAC;YAC1C,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;YACxE,YAAY,EAAE,YAAY;SAC3B,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AArCD,8CAqCC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,QAAmD;IACnE,IAAI,IAAI,GAAiB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3C,OAAO,KAAK,EAAE,IAAmB,EAAE,OAA4B,EAA8B,EAAE;QAC7F,MAAM,IAAI,CAAC;QACX,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,SAA8B,EAAE,SAA+B;IACpF,IAAI,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,IAAI,WAAW,CAAC,CAAC;IAC1D,IAAI,WAAW,IAAI,IAAI,EAAE;QACvB,2DAA2D;QAC3D,eAAe,EAAE,CAAC;QAClB,WAAW,GAAG,eAAe,CAAC;QAC9B,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;KAC3C;IACD,IAAI,WAAW,IAAI,IAAI,IAAI,SAAS,EAAE;QACpC,2DAA2D;QAC3D,eAAe,EAAE,CAAC;QAClB,WAAW,GAAG,eAAe,CAAC;QAC9B,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;KAC3C;IACD,OAAO,GAAG,WAAW,IAAI,WAAW,EAAE,CAAC;AACzC,CAAC"}

package/lib/cmap/auth/mongodb_oidc/callback_workflow.js

@@ -5,9 +5,16 @@ const bson_1 = require("bson");
 const error_1 = require("../../../error");
 const utils_1 = require("../../../utils");
 const providers_1 = require("../providers");
+const callback_lock_cache_1 = require("./callback_lock_cache");
 const token_entry_cache_1 = require("./token_entry_cache");
-/* 5 minutes in milliseconds */
-const TIMEOUT_MS = 300000;
+/** The current version of OIDC implementation. */
+const OIDC_VERSION = 0;
+/** 5 minutes in seconds */
+const TIMEOUT_S = 300;
+/** Properties allowed on results of callbacks. */
+const RESULT_PROPERTIES = ['accessToken', 'expiresInSeconds', 'refreshToken'];
+/** Error message when the callback result is invalid. */
+const CALLBACK_RESULT_ERROR = 'User provided OIDC callbacks must return a valid object with an accessToken.';
 /**
  * OIDC implementation of a callback based workflow.
  * @internal
@@ -18,147 +25,139 @@ class CallbackWorkflow {
      */
     constructor() {
         this.cache = new token_entry_cache_1.TokenEntryCache();
+        this.callbackCache = new callback_lock_cache_1.CallbackLockCache();
     }
     /**
-     * Get the document to add for speculative authentication. Is empty when
-     * callbacks are in play.
+     * Get the document to add for speculative authentication. This also needs
+     * to add a db field from the credentials source.
      */
-    speculativeAuth() {
-        return Promise.resolve({});
+    async speculativeAuth(credentials) {
+        const document = startCommandDocument(credentials);
+        document.db = credentials.source;
+        return { speculativeAuthenticate: document };
     }
     /**
-     * Execute the workflow.
-     *
-     * Steps:
-     * - If an entry is in the cache
-     *   - If it is not expired
-     *     - Skip step one and use the entry to execute step two.
-     *   - If it is expired
-     *     - If the refresh callback exists
-     *       - remove expired entry from cache
-     *       - call the refresh callback.
-     *       - put the new entry in the cache.
-     *       - execute step two.
-     *     - If the refresh callback does not exist.
-     *       - remove expired entry from cache
-     *       - call the request callback.
-     *       - put the new entry in the cache.
-     *       - execute step two.
-     * - If no entry is in the cache.
-     *   - execute step one.
-     *   - call the refresh callback.
-     *   - put the new entry in the cache.
-     *   - execute step two.
+     * Execute the OIDC callback workflow.
      */
-    async execute(connection, credentials, reauthenticate = false) {
-        const request = credentials.mechanismProperties.REQUEST_TOKEN_CALLBACK;
-        const refresh = credentials.mechanismProperties.REFRESH_TOKEN_CALLBACK;
-        const entry = this.cache.getEntry(connection.address, credentials.username, request || null, refresh || null);
+    async execute(connection, credentials, reauthenticating, response) {
+        // Get the callbacks with locks from the callback lock cache.
+        const { requestCallback, refreshCallback, callbackHash } = this.callbackCache.getCallbacks(connection, credentials);
+        // Look for an existing entry in the cache.
+        const entry = this.cache.getEntry(connection.address, credentials.username, callbackHash);
+        let result;
         if (entry) {
-            // Check if the entry is not expired and if we are reauthenticating.
-            if (!reauthenticate && entry.isValid()) {
-                // Skip step one and execute the step two saslContinue.
+            // Reauthentication cannot use a token from the cache since the server has
+            // stated it is invalid by the request for reauthentication.
+            if (entry.isValid() && !reauthenticating) {
+                // Presence of a valid cache entry means we can skip to the finishing step.
+                result = await this.finishAuthentication(connection, credentials, entry.tokenResult, response?.speculativeAuthenticate?.conversationId);
+            }
+            else {
+                // Presence of an expired cache entry means we must fetch a new one and
+                // then execute the final step.
+                const tokenResult = await this.fetchAccessToken(connection, credentials, entry.serverInfo, reauthenticating, callbackHash, requestCallback, refreshCallback);
                 try {
-                    const result = await finishAuth(entry.tokenResult, undefined, connection, credentials);
-                    return result;
+                    result = await this.finishAuthentication(connection, credentials, tokenResult, reauthenticating ? undefined : response?.speculativeAuthenticate?.conversationId);
                 }
                 catch (error) {
-                    // If authentication errors when using a cached token we remove it from
-                    // the cache.
-                    this.cache.deleteEntry(connection.address, credentials.username || '', request || null, refresh || null);
-                    throw error;
+                    // If we are reauthenticating and this errors with reauthentication
+                    // required, we need to do the entire process over again and clear
+                    // the cache entry.
+                    if (reauthenticating &&
+                        error instanceof error_1.MongoError &&
+                        error.code === error_1.MONGODB_ERROR_CODES.Reauthenticate) {
+                        this.cache.deleteEntry(connection.address, credentials.username, callbackHash);
+                        result = await this.execute(connection, credentials, reauthenticating);
+                    }
+                    else {
+                        throw error;
+                    }
                 }
             }
-            else {
-                // Remove the expired entry from the cache.
-                this.cache.deleteEntry(connection.address, credentials.username || '', request || null, refresh || null);
-                // Execute a refresh of the token and finish auth.
-                return this.refreshAndFinish(connection, credentials, entry.serverResult, entry.tokenResult);
-            }
         }
         else {
-            // No entry means to start with the step one saslStart.
-            const result = await connection.commandAsync((0, utils_1.ns)(credentials.source), startCommandDocument(credentials), undefined);
-            const stepOne = bson_1.BSON.deserialize(result.payload.buffer);
-            // Call the request callback and finish auth.
-            return this.requestAndFinish(connection, credentials, stepOne, result.conversationId);
+            // No entry in the cache requires us to do all authentication steps
+            // from start to finish, including getting a fresh token for the cache.
+            const startDocument = await this.startAuthentication(connection, credentials, reauthenticating, response);
+            const conversationId = startDocument.conversationId;
+            const serverResult = bson_1.BSON.deserialize(startDocument.payload.buffer);
+            const tokenResult = await this.fetchAccessToken(connection, credentials, serverResult, reauthenticating, callbackHash, requestCallback, refreshCallback);
+            result = await this.finishAuthentication(connection, credentials, tokenResult, conversationId);
         }
+        return result;
     }
     /**
-     * Execute the refresh callback if it exists, otherwise the request callback, then
-     * finish the authentication.
+     * Starts the callback authentication process. If there is a speculative
+     * authentication document from the initial handshake, then we will use that
+     * value to get the issuer, otherwise we will send the saslStart command.
      */
-    async refreshAndFinish(connection, credentials, stepOneResult, tokenResult, conversationId) {
-        const request = credentials.mechanismProperties.REQUEST_TOKEN_CALLBACK;
-        const refresh = credentials.mechanismProperties.REFRESH_TOKEN_CALLBACK;
-        // If a refresh callback exists, use it. Otherwise use the request callback.
-        if (refresh) {
-            const result = await refresh(credentials.username, stepOneResult, tokenResult, TIMEOUT_MS);
-            // Validate the result.
-            if (!result || !result.accessToken) {
-                throw new error_1.MongoMissingCredentialsError('REFRESH_TOKEN_CALLBACK must return a valid object with an accessToken');
-            }
-            // Cache a new entry and continue with the saslContinue.
-            this.cache.addEntry(connection.address, credentials.username || '', request || null, refresh, result, stepOneResult);
-            return finishAuth(result, conversationId, connection, credentials);
+    async startAuthentication(connection, credentials, reauthenticating, response) {
+        let result;
+        if (!reauthenticating && response?.speculativeAuthenticate) {
+            result = response.speculativeAuthenticate;
         }
         else {
-            // Fallback to using the request callback.
-            return this.requestAndFinish(connection, credentials, stepOneResult, conversationId);
+            result = await connection.commandAsync((0, utils_1.ns)(credentials.source), startCommandDocument(credentials), undefined);
         }
+        return result;
     }
     /**
-     * Execute the request callback and finish authentication.
+     * Finishes the callback authentication process.
      */
-    async requestAndFinish(connection, credentials, stepOneResult, conversationId) {
-        // Call the request callback.
-        const request = credentials.mechanismProperties.REQUEST_TOKEN_CALLBACK;
-        const refresh = credentials.mechanismProperties.REFRESH_TOKEN_CALLBACK;
-        // Always clear expired entries from the cache on each finish as cleanup.
-        this.cache.deleteExpiredEntries();
-        if (!request) {
-            // Request callback must be present.
-            throw new error_1.MongoInvalidArgumentError('Auth mechanism property REQUEST_TOKEN_CALLBACK is required.');
+    async finishAuthentication(connection, credentials, tokenResult, conversationId) {
+        const result = await connection.commandAsync((0, utils_1.ns)(credentials.source), finishCommandDocument(tokenResult.accessToken, conversationId), undefined);
+        return result;
+    }
+    /**
+     * Fetches an access token using either the request or refresh callbacks and
+     * puts it in the cache.
+     */
+    async fetchAccessToken(connection, credentials, serverInfo, reauthenticating, callbackHash, requestCallback, refreshCallback) {
+        // Get the token from the cache.
+        const entry = this.cache.getEntry(connection.address, credentials.username, callbackHash);
+        let result;
+        const context = { timeoutSeconds: TIMEOUT_S, version: OIDC_VERSION };
+        // Check if there's a token in the cache.
+        if (entry) {
+            // If the cache entry is valid, return the token result.
+            if (entry.isValid() && !reauthenticating) {
+                return entry.tokenResult;
+            }
+            // If the cache entry is not valid, remove it from the cache and first attempt
+            // to use the refresh callback to get a new token. If no refresh callback
+            // exists, then fallback to the request callback.
+            if (refreshCallback) {
+                context.refreshToken = entry.tokenResult.refreshToken;
+                result = await refreshCallback(serverInfo, context);
+            }
+            else {
+                result = await requestCallback(serverInfo, context);
+            }
         }
-        const tokenResult = await request(credentials.username, stepOneResult, TIMEOUT_MS);
-        // Validate the result.
-        if (!tokenResult || !tokenResult.accessToken) {
-            throw new error_1.MongoMissingCredentialsError('REQUEST_TOKEN_CALLBACK must return a valid object with an accessToken');
+        else {
+            // With no token in the cache we use the request callback.
+            result = await requestCallback(serverInfo, context);
+        }
+        // Validate that the result returned by the callback is acceptable. If it is not
+        // we must clear the token result from the cache.
+        if (isCallbackResultInvalid(result)) {
+            this.cache.deleteEntry(connection.address, credentials.username, callbackHash);
+            throw new error_1.MongoMissingCredentialsError(CALLBACK_RESULT_ERROR);
         }
-        // Cache a new entry and continue with the saslContinue.
-        this.cache.addEntry(connection.address, credentials.username || '', request, refresh || null, tokenResult, stepOneResult);
-        return finishAuth(tokenResult, conversationId, connection, credentials);
+        // Cleanup the cache.
+        this.cache.deleteExpiredEntries();
+        // Put the new entry into the cache.
+        this.cache.addEntry(connection.address, credentials.username || '', callbackHash, result, serverInfo);
+        return result;
     }
 }
 exports.CallbackWorkflow = CallbackWorkflow;
 /**
- * Cache the result of the user supplied callback and execute the
- * step two saslContinue.
- */
-async function finishAuth(result, conversationId, connection, credentials) {
-    // Execute the step two saslContinue.
-    return connection.commandAsync((0, utils_1.ns)(credentials.source), continueCommandDocument(result.accessToken, conversationId), undefined);
-}
-/**
- * Generate the saslStart command document.
+ * Generate the finishing command document for authentication. Will be a
+ * saslStart or saslContinue depending on the presence of a conversation id.
  */
-function startCommandDocument(credentials) {
-    const payload = {};
-    if (credentials.username) {
-        payload.n = credentials.username;
-    }
-    return {
-        saslStart: 1,
-        autoAuthorize: 1,
-        mechanism: providers_1.AuthMechanism.MONGODB_OIDC,
-        payload: new bson_1.Binary(bson_1.BSON.serialize(payload))
-    };
-}
-/**
- * Generate the saslContinue command document.
- */
-function continueCommandDocument(token, conversationId) {
-    if (conversationId) {
+function finishCommandDocument(token, conversationId) {
+    if (conversationId != null && typeof conversationId === 'number') {
         return {
             saslContinue: 1,
             conversationId: conversationId,
@@ -175,4 +174,31 @@ function continueCommandDocument(token, conversationId) {
         payload: new bson_1.Binary(bson_1.BSON.serialize({ jwt: token }))
     };
 }
+/**
+ * Determines if a result returned from a request or refresh callback
+ * function is invalid. This means the result is nullish, doesn't contain
+ * the accessToken required field, and does not contain extra fields.
+ */
+function isCallbackResultInvalid(tokenResult) {
+    if (tokenResult == null || typeof tokenResult !== 'object')
+        return true;
+    if (!('accessToken' in tokenResult))
+        return true;
+    return !Object.getOwnPropertyNames(tokenResult).every(prop => RESULT_PROPERTIES.includes(prop));
+}
+/**
+ * Generate the saslStart command document.
+ */
+function startCommandDocument(credentials) {
+    const payload = {};
+    if (credentials.username) {
+        payload.n = credentials.username;
+    }
+    return {
+        saslStart: 1,
+        autoAuthorize: 1,
+        mechanism: providers_1.AuthMechanism.MONGODB_OIDC,
+        payload: new bson_1.Binary(bson_1.BSON.serialize(payload))
+    };
+}
 //# sourceMappingURL=callback_workflow.js.map

package/lib/cmap/auth/mongodb_oidc/callback_workflow.js.map

@@ -1 +1 @@
-{"version":3,"file":"callback_workflow.js","sourceRoot":"","sources":["../../../../src/cmap/auth/mongodb_oidc/callback_workflow.ts"],"names":[],"mappings":";;;AAAA,+BAAmD;AAEnD,0CAAyF;AACzF,0CAAoC;AAIpC,4CAA6C;AAC7C,2DAAsD;AAGtD,+BAA+B;AAC/B,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B;;;GAGG;AACH,MAAa,gBAAgB;IAG3B;;OAEG;IACH;QACE,IAAI,CAAC,KAAK,GAAG,IAAI,mCAAe,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,eAAe;QACb,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,OAAO,CACX,UAAsB,EACtB,WAA6B,EAC7B,cAAc,GAAG,KAAK;QAEtB,MAAM,OAAO,GAAG,WAAW,CAAC,mBAAmB,CAAC,sBAAsB,CAAC;QACvE,MAAM,OAAO,GAAG,WAAW,CAAC,mBAAmB,CAAC,sBAAsB,CAAC;QAEvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAC/B,UAAU,CAAC,OAAO,EAClB,WAAW,CAAC,QAAQ,EACpB,OAAO,IAAI,IAAI,EACf,OAAO,IAAI,IAAI,CAChB,CAAC;QACF,IAAI,KAAK,EAAE;YACT,oEAAoE;YACpE,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE;gBACtC,uDAAuD;gBACvD,IAAI;oBACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;oBACvF,OAAO,MAAM,CAAC;iBACf;gBAAC,OAAO,KAAK,EAAE;oBACd,uEAAuE;oBACvE,aAAa;oBACb,IAAI,CAAC,KAAK,CAAC,WAAW,CACpB,UAAU,CAAC,OAAO,EAClB,WAAW,CAAC,QAAQ,IAAI,EAAE,EAC1B,OAAO,IAAI,IAAI,EACf,OAAO,IAAI,IAAI,CAChB,CAAC;oBACF,MAAM,KAAK,CAAC;iBACb;aACF;iBAAM;gBACL,2CAA2C;gBAC3C,IAAI,CAAC,KAAK,CAAC,WAAW,CACpB,UAAU,CAAC,OAAO,EAClB,WAAW,CAAC,QAAQ,IAAI,EAAE,EAC1B,OAAO,IAAI,IAAI,EACf,OAAO,IAAI,IAAI,CAChB,CAAC;gBACF,kDAAkD;gBAClD,OAAO,IAAI,CAAC,gBAAgB,CAC1B,UAAU,EACV,WAAW,EACX,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,WAAW,CAClB,CAAC;aACH;SACF;aAAM;YACL,uDAAuD;YACvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,CAC1C,IAAA,UAAE,EAAC,WAAW,CAAC,MAAM,CAAC,EACtB,oBAAoB,CAAC,WAAW,CAAC,EACjC,SAAS,CACV,CAAC;YACF,MAAM,OAAO,GAAG,WAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAA6B,CAAC;YACpF,6CAA6C;YAC7C,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;SACvF;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,gBAAgB,CAC5B,UAAsB,EACtB,WAA6B,EAC7B,aAAuC,EACvC,WAAmC,EACnC,cAAuB;QAEvB,MAAM,OAAO,GAAG,WAAW,CAAC,mBAAmB,CAAC,sBAAsB,CAAC;QACvE,MAAM,OAAO,GAAG,WAAW,CAAC,mBAAmB,CAAC,sBAAsB,CAAC;QACvE,4EAA4E;QAC5E,IAAI,OAAO,EAAE;YACX,MAAM,MAAM,GAA2B,MAAM,OAAO,CAClD,WAAW,CAAC,QAAQ,EACpB,aAAa,EACb,WAAW,EACX,UAAU,CACX,CAAC;YACF,uBAAuB;YACvB,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;gBAClC,MAAM,IAAI,oCAA4B,CACpC,uEAAuE,CACxE,CAAC;aACH;YACD,wDAAwD;YACxD,IAAI,CAAC,KAAK,CAAC,QAAQ,CACjB,UAAU,CAAC,OAAO,EAClB,WAAW,CAAC,QAAQ,IAAI,EAAE,EAC1B,OAAO,IAAI,IAAI,EACf,OAAO,EACP,MAAM,EACN,aAAa,CACd,CAAC;YACF,OAAO,UAAU,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;SACpE;aAAM;YACL,0CAA0C;YAC1C,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;SACtF;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAC5B,UAAsB,EACtB,WAA6B,EAC7B,aAAuC,EACvC,cAAuB;QAEvB,6BAA6B;QAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,mBAAmB,CAAC,sBAAsB,CAAC;QACvE,MAAM,OAAO,GAAG,WAAW,CAAC,mBAAmB,CAAC,sBAAsB,CAAC;QACvE,yEAAyE;QACzE,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE;YACZ,oCAAoC;YACpC,MAAM,IAAI,iCAAyB,CACjC,6DAA6D,CAC9D,CAAC;SACH;QACD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;QACnF,uBAAuB;QACvB,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE;YAC5C,MAAM,IAAI,oCAA4B,CACpC,uEAAuE,CACxE,CAAC;SACH;QACD,wDAAwD;QACxD,IAAI,CAAC,KAAK,CAAC,QAAQ,CACjB,UAAU,CAAC,OAAO,EAClB,WAAW,CAAC,QAAQ,IAAI,EAAE,EAC1B,OAAO,EACP,OAAO,IAAI,IAAI,EACf,WAAW,EACX,aAAa,CACd,CAAC;QACF,OAAO,UAAU,CAAC,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAC1E,CAAC;CACF;AAxLD,4CAwLC;AAED;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,MAA8B,EAC9B,cAAkC,EAClC,UAAsB,EACtB,WAA6B;IAE7B,qCAAqC;IACrC,OAAO,UAAU,CAAC,YAAY,CAC5B,IAAA,UAAE,EAAC,WAAW,CAAC,MAAM,CAAC,EACtB,uBAAuB,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,EAC3D,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,WAA6B;IACzD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,WAAW,CAAC,QAAQ,EAAE;QACxB,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC;KAClC;IACD,OAAO;QACL,SAAS,EAAE,CAAC;QACZ,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,yBAAa,CAAC,YAAY;QACrC,OAAO,EAAE,IAAI,aAAM,CAAC,WAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAAC,KAAa,EAAE,cAAuB;IACrE,IAAI,cAAc,EAAE;QAClB,OAAO;YACL,YAAY,EAAE,CAAC;YACf,cAAc,EAAE,cAAc;YAC9B,OAAO,EAAE,IAAI,aAAM,CAAC,WAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;SACpD,CAAC;KACH;IACD,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,gCAAgC;IAChC,OAAO;QACL,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,yBAAa,CAAC,YAAY;QACrC,OAAO,EAAE,IAAI,aAAM,CAAC,WAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;KACpD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"callback_workflow.js","sourceRoot":"","sources":["../../../../src/cmap/auth/mongodb_oidc/callback_workflow.ts"],"names":[],"mappings":";;;AAAA,+BAAmD;AAEnD,0CAA+F;AAC/F,0CAAoC;AAWpC,4CAA6C;AAC7C,+DAA0D;AAC1D,2DAAsD;AAEtD,kDAAkD;AAClD,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,2BAA2B;AAC3B,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,kDAAkD;AAClD,MAAM,iBAAiB,GAAG,CAAC,aAAa,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;AAE9E,yDAAyD;AACzD,MAAM,qBAAqB,GACzB,8EAA8E,CAAC;AAEjF;;;GAGG;AACH,MAAa,gBAAgB;IAI3B;;OAEG;IACH;QACE,IAAI,CAAC,KAAK,GAAG,IAAI,mCAAe,EAAE,CAAC;QACnC,IAAI,CAAC,aAAa,GAAG,IAAI,uCAAiB,EAAE,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,WAA6B;QACjD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACnD,QAAQ,CAAC,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC;QACjC,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,UAAsB,EACtB,WAA6B,EAC7B,gBAAyB,EACzB,QAAmB;QAEnB,6DAA6D;QAC7D,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CACxF,UAAU,EACV,WAAW,CACZ,CAAC;QACF,2CAA2C;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC1F,IAAI,MAAM,CAAC;QACX,IAAI,KAAK,EAAE;YACT,0EAA0E;YAC1E,4DAA4D;YAC5D,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE;gBACxC,2EAA2E;gBAC3E,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CACtC,UAAU,EACV,WAAW,EACX,KAAK,CAAC,WAAW,EACjB,QAAQ,EAAE,uBAAuB,EAAE,cAAc,CAClD,CAAC;aACH;iBAAM;gBACL,uEAAuE;gBACvE,+BAA+B;gBAC/B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAC7C,UAAU,EACV,WAAW,EACX,KAAK,CAAC,UAAU,EAChB,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,eAAe,CAChB,CAAC;gBACF,IAAI;oBACF,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CACtC,UAAU,EACV,WAAW,EACX,WAAW,EACX,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,uBAAuB,EAAE,cAAc,CACjF,CAAC;iBACH;gBAAC,OAAO,KAAK,EAAE;oBACd,mEAAmE;oBACnE,kEAAkE;oBAClE,mBAAmB;oBACnB,IACE,gBAAgB;wBAChB,KAAK,YAAY,kBAAU;wBAC3B,KAAK,CAAC,IAAI,KAAK,2BAAmB,CAAC,cAAc,EACjD;wBACA,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;wBAC/E,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;qBACxE;yBAAM;wBACL,MAAM,KAAK,CAAC;qBACb;iBACF;aACF;SACF;aAAM;YACL,mEAAmE;YACnE,uEAAuE;YACvE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAClD,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,QAAQ,CACT,CAAC;YACF,MAAM,cAAc,GAAG,aAAa,CAAC,cAAc,CAAC;YACpD,MAAM,YAAY,GAAG,WAAI,CAAC,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAkB,CAAC;YACrF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAC7C,UAAU,EACV,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,eAAe,CAChB,CAAC;YACF,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CACtC,UAAU,EACV,WAAW,EACX,WAAW,EACX,cAAc,CACf,CAAC;SACH;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,mBAAmB,CAC/B,UAAsB,EACtB,WAA6B,EAC7B,gBAAyB,EACzB,QAAmB;QAEnB,IAAI,MAAM,CAAC;QACX,IAAI,CAAC,gBAAgB,IAAI,QAAQ,EAAE,uBAAuB,EAAE;YAC1D,MAAM,GAAG,QAAQ,CAAC,uBAAuB,CAAC;SAC3C;aAAM;YACL,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,CACpC,IAAA,UAAE,EAAC,WAAW,CAAC,MAAM,CAAC,EACtB,oBAAoB,CAAC,WAAW,CAAC,EACjC,SAAS,CACV,CAAC;SACH;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,oBAAoB,CAChC,UAAsB,EACtB,WAA6B,EAC7B,WAA8B,EAC9B,cAAuB;QAEvB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,CAC1C,IAAA,UAAE,EAAC,WAAW,CAAC,MAAM,CAAC,EACtB,qBAAqB,CAAC,WAAW,CAAC,WAAW,EAAE,cAAc,CAAC,EAC9D,SAAS,CACV,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,gBAAgB,CAC5B,UAAsB,EACtB,WAA6B,EAC7B,UAAyB,EACzB,gBAAyB,EACzB,YAAoB,EACpB,eAAoC,EACpC,eAAqC;QAErC,gCAAgC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC1F,IAAI,MAAM,CAAC;QACX,MAAM,OAAO,GAAwB,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QAC1F,yCAAyC;QACzC,IAAI,KAAK,EAAE;YACT,wDAAwD;YACxD,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE;gBACxC,OAAO,KAAK,CAAC,WAAW,CAAC;aAC1B;YACD,8EAA8E;YAC9E,yEAAyE;YACzE,iDAAiD;YACjD,IAAI,eAAe,EAAE;gBACnB,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC;gBACtD,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;aACrD;iBAAM;gBACL,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;aACrD;SACF;aAAM;YACL,0DAA0D;YAC1D,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;SACrD;QACD,gFAAgF;QAChF,iDAAiD;QACjD,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YAC/E,MAAM,IAAI,oCAA4B,CAAC,qBAAqB,CAAC,CAAC;SAC/D;QACD,qBAAqB;QACrB,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAClC,oCAAoC;QACpC,IAAI,CAAC,KAAK,CAAC,QAAQ,CACjB,UAAU,CAAC,OAAO,EAClB,WAAW,CAAC,QAAQ,IAAI,EAAE,EAC1B,YAAY,EACZ,MAAM,EACN,UAAU,CACX,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAlND,4CAkNC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,KAAa,EAAE,cAAuB;IACnE,IAAI,cAAc,IAAI,IAAI,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE;QAChE,OAAO;YACL,YAAY,EAAE,CAAC;YACf,cAAc,EAAE,cAAc;YAC9B,OAAO,EAAE,IAAI,aAAM,CAAC,WAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;SACpD,CAAC;KACH;IACD,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,gCAAgC;IAChC,OAAO;QACL,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,yBAAa,CAAC,YAAY;QACrC,OAAO,EAAE,IAAI,aAAM,CAAC,WAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,WAAoB;IACnD,IAAI,WAAW,IAAI,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,CAAC,CAAC,aAAa,IAAI,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAClG,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,WAA6B;IACzD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,WAAW,CAAC,QAAQ,EAAE;QACxB,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC;KAClC;IACD,OAAO;QACL,SAAS,EAAE,CAAC;QACZ,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,yBAAa,CAAC,YAAY;QACrC,OAAO,EAAE,IAAI,aAAM,CAAC,WAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;KAC7C,CAAC;AACJ,CAAC"}