mongodb 7.0.0-dev.20260110.sha.97686403 → 7.0.0-dev.20260114.sha.f6375c99
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/cmap/auth/aws4.js +161 -0
- package/lib/cmap/auth/aws4.js.map +1 -0
- package/lib/cmap/auth/mongodb_aws.js +9 -14
- package/lib/cmap/auth/mongodb_aws.js.map +1 -1
- package/lib/deps.js +0 -13
- package/lib/deps.js.map +1 -1
- package/package.json +2 -1
- package/src/cmap/auth/aws4.ts +207 -0
- package/src/cmap/auth/mongodb_aws.ts +10 -17
- package/src/deps.ts +0 -60
|
@@ -0,0 +1,161 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.aws4Sign = aws4Sign;
|
|
4
|
+
const bson_1 = require("../../bson");
|
|
5
|
+
/**
|
|
6
|
+
* Calculates the SHA-256 hash of a string.
|
|
7
|
+
*
|
|
8
|
+
* @param str - String to hash.
|
|
9
|
+
* @returns Hexadecimal representation of the hash.
|
|
10
|
+
*/
|
|
11
|
+
const getHexSha256 = async (str) => {
|
|
12
|
+
const data = stringToBuffer(str);
|
|
13
|
+
const hashBuffer = await crypto.subtle.digest('SHA-256', data);
|
|
14
|
+
const hashHex = bson_1.BSON.onDemand.ByteUtils.toHex(new Uint8Array(hashBuffer));
|
|
15
|
+
return hashHex;
|
|
16
|
+
};
|
|
17
|
+
/**
|
|
18
|
+
* Calculates the HMAC-SHA256 of a string using the provided key.
|
|
19
|
+
* @param key - Key to use for HMAC calculation. Can be a string or Uint8Array.
|
|
20
|
+
* @param str - String to calculate HMAC for.
|
|
21
|
+
* @returns Uint8Array containing the HMAC-SHA256 digest.
|
|
22
|
+
*/
|
|
23
|
+
const getHmacSha256 = async (key, str) => {
|
|
24
|
+
let keyData;
|
|
25
|
+
if (typeof key === 'string') {
|
|
26
|
+
keyData = stringToBuffer(key);
|
|
27
|
+
}
|
|
28
|
+
else {
|
|
29
|
+
keyData = key;
|
|
30
|
+
}
|
|
31
|
+
const importedKey = await crypto.subtle.importKey('raw', keyData, { name: 'HMAC', hash: { name: 'SHA-256' } }, false, ['sign']);
|
|
32
|
+
const strData = stringToBuffer(str);
|
|
33
|
+
const signature = await crypto.subtle.sign('HMAC', importedKey, strData);
|
|
34
|
+
const digest = new Uint8Array(signature);
|
|
35
|
+
return digest;
|
|
36
|
+
};
|
|
37
|
+
/**
|
|
38
|
+
* Converts header values according to AWS requirements,
|
|
39
|
+
* From https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html#create-canonical-request
|
|
40
|
+
* For values, you must:
|
|
41
|
+
- trim any leading or trailing spaces.
|
|
42
|
+
- convert sequential spaces to a single space.
|
|
43
|
+
* @param value - Header value to convert.
|
|
44
|
+
* @returns - Converted header value.
|
|
45
|
+
*/
|
|
46
|
+
const convertHeaderValue = (value) => {
|
|
47
|
+
return value.toString().trim().replace(/\s+/g, ' ');
|
|
48
|
+
};
|
|
49
|
+
/**
|
|
50
|
+
* Returns a Uint8Array representation of a string, encoded in UTF-8.
|
|
51
|
+
* @param str - String to convert.
|
|
52
|
+
* @returns Uint8Array containing the UTF-8 encoded string.
|
|
53
|
+
*/
|
|
54
|
+
function stringToBuffer(str) {
|
|
55
|
+
const data = new Uint8Array(bson_1.BSON.onDemand.ByteUtils.utf8ByteLength(str));
|
|
56
|
+
bson_1.BSON.onDemand.ByteUtils.encodeUTF8Into(data, str, 0);
|
|
57
|
+
return data;
|
|
58
|
+
}
|
|
59
|
+
/**
|
|
60
|
+
* This method implements AWS Signature 4 logic for a very specific request format.
|
|
61
|
+
* The signing logic is described here: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
|
|
62
|
+
*/
|
|
63
|
+
async function aws4Sign(options, credentials) {
|
|
64
|
+
/**
|
|
65
|
+
* From the spec: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
|
|
66
|
+
*
|
|
67
|
+
* Summary of signing steps
|
|
68
|
+
* 1. Create a canonical request
|
|
69
|
+
* Arrange the contents of your request (host, action, headers, etc.) into a standard canonical format. The canonical request is one of the inputs used to create the string to sign.
|
|
70
|
+
* 2. Create a hash of the canonical request
|
|
71
|
+
* Hash the canonical request using the same algorithm that you used to create the hash of the payload. The hash of the canonical request is a string of lowercase hexadecimal characters.
|
|
72
|
+
* 3. Create a string to sign
|
|
73
|
+
* Create a string to sign with the canonical request and extra information such as the algorithm, request date, credential scope, and the hash of the canonical request.
|
|
74
|
+
* 4. Derive a signing key
|
|
75
|
+
* Use the secret access key to derive the key used to sign the request.
|
|
76
|
+
* 5. Calculate the signature
|
|
77
|
+
* Perform a keyed hash operation on the string to sign using the derived signing key as the hash key.
|
|
78
|
+
* 6. Add the signature to the request
|
|
79
|
+
* Add the calculated signature to an HTTP header or to the query string of the request.
|
|
80
|
+
*/
|
|
81
|
+
// 1: Create a canonical request
|
|
82
|
+
// Date – The date and time used to sign the request.
|
|
83
|
+
const date = options.date;
|
|
84
|
+
// RequestDateTime – The date and time used in the credential scope. This value is the current UTC time in ISO 8601 format (for example, 20130524T000000Z).
|
|
85
|
+
const requestDateTime = date.toISOString().replace(/[:-]|\.\d{3}/g, '');
|
|
86
|
+
// RequestDate – The date used in the credential scope. This value is the current UTC date in YYYYMMDD format (for example, 20130524).
|
|
87
|
+
const requestDate = requestDateTime.substring(0, 8);
|
|
88
|
+
// Method – The HTTP request method. For us, this is always 'POST'.
|
|
89
|
+
const method = options.method;
|
|
90
|
+
// CanonicalUri – The URI-encoded version of the absolute path component URI, starting with the / that follows the domain name and up to the end of the string
|
|
91
|
+
// For our requests, this is always '/'
|
|
92
|
+
const canonicalUri = options.path;
|
|
93
|
+
// CanonicalQueryString – The URI-encoded query string parameters. For our requests, there are no query string parameters, so this is always an empty string.
|
|
94
|
+
const canonicalQuerystring = '';
|
|
95
|
+
// CanonicalHeaders – A list of request headers with their values. Individual header name and value pairs are separated by the newline character ("\n").
|
|
96
|
+
// All of our known/expected headers are included here, there are no extra headers.
|
|
97
|
+
const headers = new Headers({
|
|
98
|
+
'content-length': convertHeaderValue(options.headers['Content-Length']),
|
|
99
|
+
'content-type': convertHeaderValue(options.headers['Content-Type']),
|
|
100
|
+
host: convertHeaderValue(options.host),
|
|
101
|
+
'x-amz-date': convertHeaderValue(requestDateTime),
|
|
102
|
+
'x-mongodb-gs2-cb-flag': convertHeaderValue(options.headers['X-MongoDB-GS2-CB-Flag']),
|
|
103
|
+
'x-mongodb-server-nonce': convertHeaderValue(options.headers['X-MongoDB-Server-Nonce'])
|
|
104
|
+
});
|
|
105
|
+
// If session token is provided, include it in the headers
|
|
106
|
+
if ('sessionToken' in credentials && credentials.sessionToken) {
|
|
107
|
+
headers.append('x-amz-security-token', convertHeaderValue(credentials.sessionToken));
|
|
108
|
+
}
|
|
109
|
+
// Canonical headers are lowercased and sorted.
|
|
110
|
+
const canonicalHeaders = Array.from(headers.entries())
|
|
111
|
+
.map(([key, value]) => `${key.toLowerCase()}:${value}`)
|
|
112
|
+
.sort()
|
|
113
|
+
.join('\n');
|
|
114
|
+
const canonicalHeaderNames = Array.from(headers.keys()).map(header => header.toLowerCase());
|
|
115
|
+
// SignedHeaders – An alphabetically sorted, semicolon-separated list of lowercase request header names.
|
|
116
|
+
const signedHeaders = canonicalHeaderNames.sort().join(';');
|
|
117
|
+
// HashedPayload – A string created using the payload in the body of the HTTP request as input to a hash function. This string uses lowercase hexadecimal characters.
|
|
118
|
+
const hashedPayload = await getHexSha256(options.body);
|
|
119
|
+
// CanonicalRequest – A string that includes the above elements, separated by newline characters.
|
|
120
|
+
const canonicalRequest = [
|
|
121
|
+
method,
|
|
122
|
+
canonicalUri,
|
|
123
|
+
canonicalQuerystring,
|
|
124
|
+
canonicalHeaders + '\n',
|
|
125
|
+
signedHeaders,
|
|
126
|
+
hashedPayload
|
|
127
|
+
].join('\n');
|
|
128
|
+
// 2. Create a hash of the canonical request
|
|
129
|
+
// HashedCanonicalRequest – A string created by using the canonical request as input to a hash function.
|
|
130
|
+
const hashedCanonicalRequest = await getHexSha256(canonicalRequest);
|
|
131
|
+
// 3. Create a string to sign
|
|
132
|
+
// Algorithm – The algorithm used to create the hash of the canonical request. For SigV4, use AWS4-HMAC-SHA256.
|
|
133
|
+
const algorithm = 'AWS4-HMAC-SHA256';
|
|
134
|
+
// CredentialScope – The credential scope, which restricts the resulting signature to the specified Region and service.
|
|
135
|
+
// Has the following format: YYYYMMDD/region/service/aws4_request.
|
|
136
|
+
const credentialScope = `${requestDate}/${options.region}/${options.service}/aws4_request`;
|
|
137
|
+
// StringToSign – A string that includes the above elements, separated by newline characters.
|
|
138
|
+
const stringToSign = [algorithm, requestDateTime, credentialScope, hashedCanonicalRequest].join('\n');
|
|
139
|
+
// 4. Derive a signing key
|
|
140
|
+
// To derive a signing key for SigV4, perform a succession of keyed hash operations (HMAC) on the request date, Region, and service, with your AWS secret access key as the key for the initial hashing operation.
|
|
141
|
+
const dateKey = await getHmacSha256('AWS4' + credentials.secretAccessKey, requestDate);
|
|
142
|
+
const dateRegionKey = await getHmacSha256(dateKey, options.region);
|
|
143
|
+
const dateRegionServiceKey = await getHmacSha256(dateRegionKey, options.service);
|
|
144
|
+
const signingKey = await getHmacSha256(dateRegionServiceKey, 'aws4_request');
|
|
145
|
+
// 5. Calculate the signature
|
|
146
|
+
const signatureBuffer = await getHmacSha256(signingKey, stringToSign);
|
|
147
|
+
const signature = bson_1.BSON.onDemand.ByteUtils.toHex(signatureBuffer);
|
|
148
|
+
// 6. Add the signature to the request
|
|
149
|
+
// Calculate the Authorization header
|
|
150
|
+
const authorizationHeader = [
|
|
151
|
+
'AWS4-HMAC-SHA256 Credential=' + credentials.accessKeyId + '/' + credentialScope,
|
|
152
|
+
'SignedHeaders=' + signedHeaders,
|
|
153
|
+
'Signature=' + signature
|
|
154
|
+
].join(', ');
|
|
155
|
+
// Return the calculated headers
|
|
156
|
+
return {
|
|
157
|
+
Authorization: authorizationHeader,
|
|
158
|
+
'X-Amz-Date': requestDateTime
|
|
159
|
+
};
|
|
160
|
+
}
|
|
161
|
+
//# sourceMappingURL=aws4.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"aws4.js","sourceRoot":"","sources":["../../../src/cmap/auth/aws4.ts"],"names":[],"mappings":";;AA4FA,4BAkHC;AA9MD,qCAAkC;AAwBlC;;;;;GAKG;AACH,MAAM,YAAY,GAAG,KAAK,EAAE,GAAW,EAAmB,EAAE;IAC1D,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1E,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,aAAa,GAAG,KAAK,EAAE,GAAwB,EAAE,GAAW,EAAuB,EAAE;IACzF,IAAI,OAAmB,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,GAAG,CAAC;IAChB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC/C,KAAK,EACL,OAAO,EACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAC3C,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,CAAC,KAAsB,EAAE,EAAE;IACpD,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC,CAAC;AAEF;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,WAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,WAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,QAAQ,CAC5B,OAAwB,EACxB,WAA2B;IAE3B;;;;;;;;;;;;;;;;OAgBG;IAEH,gCAAgC;IAEhC,qDAAqD;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,2JAA2J;IAC3J,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACxE,sIAAsI;IACtI,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,mEAAmE;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,8JAA8J;IAC9J,uCAAuC;IACvC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAClC,6JAA6J;IAC7J,MAAM,oBAAoB,GAAG,EAAE,CAAC;IAEhC,wJAAwJ;IACxJ,mFAAmF;IACnF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,gBAAgB,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACvE,cAAc,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACnE,IAAI,EAAE,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,YAAY,EAAE,kBAAkB,CAAC,eAAe,CAAC;QACjD,uBAAuB,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACrF,wBAAwB,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;KACxF,CAAC,CAAC;IACH,0DAA0D;IAC1D,IAAI,cAAc,IAAI,WAAW,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;QAC9D,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,+CAA+C;IAC/C,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;SACnD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,EAAE,CAAC;SACtD,IAAI,EAAE;SACN,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,oBAAoB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5F,wGAAwG;IACxG,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE5D,qKAAqK;IACrK,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD,iGAAiG;IACjG,MAAM,gBAAgB,GAAG;QACvB,MAAM;QACN,YAAY;QACZ,oBAAoB;QACpB,gBAAgB,GAAG,IAAI;QACvB,aAAa;QACb,aAAa;KACd,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,4CAA4C;IAC5C,wGAAwG;IACxG,MAAM,sBAAsB,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAEpE,6BAA6B;IAC7B,+GAA+G;IAC/G,MAAM,SAAS,GAAG,kBAAkB,CAAC;IACrC,uHAAuH;IACvH,kEAAkE;IAClE,MAAM,eAAe,GAAG,GAAG,WAAW,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,eAAe,CAAC;IAC3F,6FAA6F;IAC7F,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,eAAe,EAAE,sBAAsB,CAAC,CAAC,IAAI,CAC7F,IAAI,CACL,CAAC;IAEF,0BAA0B;IAC1B,kNAAkN;IAClN,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,GAAG,WAAW,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACvF,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,MAAM,oBAAoB,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IAE7E,6BAA6B;IAC7B,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,WAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAEjE,sCAAsC;IACtC,qCAAqC;IACrC,MAAM,mBAAmB,GAAG;QAC1B,8BAA8B,GAAG,WAAW,CAAC,WAAW,GAAG,GAAG,GAAG,eAAe;QAChF,gBAAgB,GAAG,aAAa;QAChC,YAAY,GAAG,SAAS;KACzB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,gCAAgC;IAChC,OAAO;QACL,aAAa,EAAE,mBAAmB;QAClC,YAAY,EAAE,eAAe;KAC9B,CAAC;AACJ,CAAC"}
|
|
@@ -2,11 +2,11 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.MongoDBAWS = void 0;
|
|
4
4
|
const BSON = require("../../bson");
|
|
5
|
-
const deps_1 = require("../../deps");
|
|
6
5
|
const error_1 = require("../../error");
|
|
7
6
|
const utils_1 = require("../../utils");
|
|
8
7
|
const auth_provider_1 = require("./auth_provider");
|
|
9
8
|
const aws_temporary_credentials_1 = require("./aws_temporary_credentials");
|
|
9
|
+
const aws4_1 = require("./aws4");
|
|
10
10
|
const mongo_credentials_1 = require("./mongo_credentials");
|
|
11
11
|
const providers_1 = require("./providers");
|
|
12
12
|
const ASCII_N = 110;
|
|
@@ -27,10 +27,6 @@ class MongoDBAWS extends auth_provider_1.AuthProvider {
|
|
|
27
27
|
if (!authContext.credentials) {
|
|
28
28
|
throw new error_1.MongoMissingCredentialsError('AuthContext must provide credentials.');
|
|
29
29
|
}
|
|
30
|
-
if ('kModuleError' in deps_1.aws4) {
|
|
31
|
-
throw deps_1.aws4['kModuleError'];
|
|
32
|
-
}
|
|
33
|
-
const { sign } = deps_1.aws4;
|
|
34
30
|
if ((0, utils_1.maxWireVersion)(connection) < 9) {
|
|
35
31
|
throw new error_1.MongoCompatibilityError('MONGODB-AWS authentication requires MongoDB version 4.4 or later');
|
|
36
32
|
}
|
|
@@ -40,12 +36,10 @@ class MongoDBAWS extends auth_provider_1.AuthProvider {
|
|
|
40
36
|
const secretAccessKey = credentials.password;
|
|
41
37
|
// Allow the user to specify an AWS session token for authentication with temporary credentials.
|
|
42
38
|
const sessionToken = credentials.mechanismProperties.AWS_SESSION_TOKEN;
|
|
43
|
-
// If all three defined, include sessionToken, else include username and pass
|
|
44
|
-
const awsCredentials =
|
|
39
|
+
// If all three defined, include sessionToken, else only include username and pass
|
|
40
|
+
const awsCredentials = sessionToken
|
|
45
41
|
? { accessKeyId, secretAccessKey, sessionToken }
|
|
46
|
-
: accessKeyId
|
|
47
|
-
? { accessKeyId, secretAccessKey }
|
|
48
|
-
: undefined;
|
|
42
|
+
: { accessKeyId, secretAccessKey };
|
|
49
43
|
const db = credentials.source;
|
|
50
44
|
const nonce = await (0, utils_1.randomBytes)(32);
|
|
51
45
|
// All messages between MongoDB clients and servers are sent as BSON objects
|
|
@@ -74,7 +68,7 @@ class MongoDBAWS extends auth_provider_1.AuthProvider {
|
|
|
74
68
|
throw new error_1.MongoRuntimeError(`Server returned an invalid host: "${host}"`);
|
|
75
69
|
}
|
|
76
70
|
const body = 'Action=GetCallerIdentity&Version=2011-06-15';
|
|
77
|
-
const
|
|
71
|
+
const headers = await (0, aws4_1.aws4Sign)({
|
|
78
72
|
method: 'POST',
|
|
79
73
|
host,
|
|
80
74
|
region: deriveRegion(serverResponse.h),
|
|
@@ -86,11 +80,12 @@ class MongoDBAWS extends auth_provider_1.AuthProvider {
|
|
|
86
80
|
'X-MongoDB-GS2-CB-Flag': 'n'
|
|
87
81
|
},
|
|
88
82
|
path: '/',
|
|
89
|
-
body
|
|
83
|
+
body,
|
|
84
|
+
date: new Date()
|
|
90
85
|
}, awsCredentials);
|
|
91
86
|
const payload = {
|
|
92
|
-
a:
|
|
93
|
-
d:
|
|
87
|
+
a: headers.Authorization,
|
|
88
|
+
d: headers['X-Amz-Date']
|
|
94
89
|
};
|
|
95
90
|
if (sessionToken) {
|
|
96
91
|
payload.t = sessionToken;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mongodb_aws.js","sourceRoot":"","sources":["../../../src/cmap/auth/mongodb_aws.ts"],"names":[],"mappings":";;;AACA,mCAAmC;AACnC,
|
|
1
|
+
{"version":3,"file":"mongodb_aws.js","sourceRoot":"","sources":["../../../src/cmap/auth/mongodb_aws.ts"],"names":[],"mappings":";;;AACA,mCAAmC;AACnC,uCAIqB;AACrB,uCAAyE;AACzE,mDAAiE;AACjE,2EAIqC;AACrC,iCAAkC;AAClC,2DAAuD;AACvD,2CAA4C;AAE5C,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,WAAW,GAAyB;IACxC,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE,KAAK;CAClB,CAAC;AAQF,MAAa,UAAW,SAAQ,4BAAY;IAG1C,YAAY,kBAA0C;QACpD,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,iBAAiB,GAAG,IAAI,oDAAwB,CAAC,kBAAkB,CAAC,CAAC;IAC5E,CAAC;IAEQ,KAAK,CAAC,IAAI,CAAC,WAAwB;QAC1C,MAAM,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC;QACnC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,oCAA4B,CAAC,uCAAuC,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,IAAA,sBAAc,EAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,+BAAuB,CAC/B,kEAAkE,CACnE,CAAC;QACJ,CAAC;QAED,WAAW,CAAC,WAAW,GAAG,MAAM,mBAAmB,CACjD,WAAW,CAAC,WAAW,EACvB,IAAI,CAAC,iBAAiB,CACvB,CAAC;QAEF,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC;QAEpC,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC;QACzC,MAAM,eAAe,GAAG,WAAW,CAAC,QAAQ,CAAC;QAC7C,gGAAgG;QAChG,MAAM,YAAY,GAAG,WAAW,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;QAEvE,kFAAkF;QAClF,MAAM,cAAc,GAAG,YAAY;YACjC,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE;YAChD,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;QAErC,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAW,EAAC,EAAE,CAAC,CAAC;QAEpC,4EAA4E;QAC5E,sDAAsD;QACtD,MAAM,SAAS,GAAG;YAChB,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,aAAa;YACxB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,WAAW,CAAC;SAC/D,CAAC;QAEF,MAAM,iBAAiB,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAA,UAAE,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAE3F,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAGpF,CAAC;QACF,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC;QAC9B,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5C,IAAI,WAAW,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC9B,kBAAkB;YAClB,MAAM,IAAI,yBAAiB,CAAC,+BAA+B,WAAW,CAAC,MAAM,eAAe,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,CAAC,iBAAS,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YACxE,0FAA0F;YAC1F,2FAA2F;YAE3F,kBAAkB;YAClB,MAAM,IAAI,yBAAiB,CAAC,+CAA+C,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACtE,kBAAkB;YAClB,MAAM,IAAI,yBAAiB,CAAC,qCAAqC,IAAI,GAAG,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,IAAI,GAAG,6CAA6C,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,IAAA,eAAQ,EAC5B;YACE,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,MAAM,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;YACtC,OAAO,EAAE,KAAK;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,gBAAgB,EAAE,IAAI,CAAC,MAAM;gBAC7B,wBAAwB,EAAE,iBAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACzD,uBAAuB,EAAE,GAAG;aAC7B;YACD,IAAI,EAAE,GAAG;YACT,IAAI;YACJ,IAAI,EAAE,IAAI,IAAI,EAAE;SACjB,EACD,cAAc,CACf,CAAC;QAEF,MAAM,OAAO,GAA2B;YACtC,CAAC,EAAE,OAAO,CAAC,aAAa;YACxB,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC;SACzB,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,GAAG,YAAY,CAAC;QAC3B,CAAC;QAED,MAAM,YAAY,GAAG;YACnB,YAAY,EAAE,CAAC;YACf,cAAc,EAAE,iBAAiB,CAAC,cAAc;YAChD,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;SAC9C,CAAC;QAEF,MAAM,UAAU,CAAC,OAAO,CAAC,IAAA,UAAE,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IACtE,CAAC;CACF;AA/GD,gCA+GC;AAED,KAAK,UAAU,mBAAmB,CAChC,WAA6B,EAC7B,oBAA8C;IAE9C,SAAS,+BAA+B,CAAC,KAAyB;QAChE,6DAA6D;QAC7D,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YACjD,MAAM,IAAI,oCAA4B,CAAC,oDAAoD,CAAC,CAAC;QAC/F,CAAC;QAED,OAAO,IAAI,oCAAgB,CAAC;YAC1B,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,QAAQ,EAAE,KAAK,CAAC,eAAe;YAC/B,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,SAAS,EAAE,yBAAa,CAAC,WAAW;YACpC,mBAAmB,EAAE;gBACnB,iBAAiB,EAAE,KAAK,CAAC,KAAK;aAC/B;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,oBAAoB,GAAG,MAAM,oBAAoB,CAAC,cAAc,EAAE,CAAC;IAEzE,OAAO,+BAA+B,CAAC,oBAAoB,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;QACnD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}
|
package/lib/deps.js
CHANGED
|
@@ -1,6 +1,5 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.aws4 = void 0;
|
|
4
3
|
exports.getKerberos = getKerberos;
|
|
5
4
|
exports.getZstdLibrary = getZstdLibrary;
|
|
6
5
|
exports.getAwsCredentialProvider = getAwsCredentialProvider;
|
|
@@ -94,18 +93,6 @@ function getSocks() {
|
|
|
94
93
|
return { kModuleError };
|
|
95
94
|
}
|
|
96
95
|
}
|
|
97
|
-
exports.aws4 = loadAws4();
|
|
98
|
-
function loadAws4() {
|
|
99
|
-
let aws4;
|
|
100
|
-
try {
|
|
101
|
-
// eslint-disable-next-line @typescript-eslint/no-require-imports
|
|
102
|
-
aws4 = require('aws4');
|
|
103
|
-
}
|
|
104
|
-
catch (error) {
|
|
105
|
-
aws4 = makeErrorModule(new error_1.MongoMissingDependencyError('Optional module `aws4` not found. Please install it to enable AWS authentication', { cause: error, dependencyName: 'aws4' }));
|
|
106
|
-
}
|
|
107
|
-
return aws4;
|
|
108
|
-
}
|
|
109
96
|
/** A utility function to get the instance of mongodb-client-encryption, if it exists. */
|
|
110
97
|
function getMongoDBClientEncryption() {
|
|
111
98
|
let mongodbClientEncryption = null;
|
package/lib/deps.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"deps.js","sourceRoot":"","sources":["../src/deps.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"deps.js","sourceRoot":"","sources":["../src/deps.ts"],"names":[],"mappings":";;AAqBA,kCAeC;AA0BD,wCAeC;AAsBD,4DAiBC;AAOD,wCAeC;AAiBD,8BAaC;AAsBD,4BAaC;AAGD,gEAoBC;AAjOD,mCAAsD;AAGtD,SAAS,eAAe,CAAC,KAAU;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE;QACtB,GAAG,EAAE,CAAC,CAAM,EAAE,GAAQ,EAAE,EAAE;YACxB,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,KAAK,CAAC;QACd,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAID,SAAgB,WAAW;IACzB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,wEAAwE;QACxE,iEAAiE;QACjE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,GAAG,eAAe,CACxB,IAAI,mCAA2B,CAC7B,2FAA2F,EAC3F,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,CAC7C,CACF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AA0BD,SAAgB,cAAc;IAC5B,IAAI,SAAuE,CAAC;IAC5E,IAAI,CAAC;QACH,iEAAiE;QACjE,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,GAAG,eAAe,CACzB,IAAI,mCAA2B,CAC7B,4FAA4F,EAC5F,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CACzC,CACF,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAsBD,SAAgB,wBAAwB;IAGtC,IAAI,CAAC;QACH,wEAAwE;QACxE,iEAAiE;QACjE,MAAM,kBAAkB,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;QACpE,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,eAAe,CACpB,IAAI,mCAA2B,CAC7B,4DAA4D;YAC1D,4EAA4E,EAC9E,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,+BAA+B,EAAE,CAClE,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,SAAgB,cAAc;IAC5B,IAAI,CAAC;QACH,wEAAwE;QACxE,iEAAiE;QACjE,MAAM,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;QACnD,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,eAAe,CACpB,IAAI,mCAA2B,CAC7B,2CAA2C;YACzC,4EAA4E,EAC9E,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,CACjD,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAiBD,SAAgB,SAAS;IACvB,IAAI,CAAC;QACH,wEAAwE;QACxE,iEAAiE;QACjE,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,IAAI,mCAA2B,CAClD,oFAAoF,EACpF,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,CAC3C,CAAC;QACF,OAAO,EAAE,YAAY,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAsBD,SAAgB,QAAQ;IACtB,IAAI,CAAC;QACH,wEAAwE;QACxE,iEAAiE;QACjE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,IAAI,mCAA2B,CAClD,yFAAyF,EACzF,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,CAC1C,CAAC;QACF,OAAO,EAAE,YAAY,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,SAAgB,0BAA0B;IAGxC,IAAI,uBAAuB,GAAG,IAAI,CAAC;IAEnC,IAAI,CAAC;QACH,yFAAyF;QACzF,kGAAkG;QAClG,4GAA4G;QAC5G,iEAAiE;QACjE,uBAAuB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,IAAI,mCAA2B,CAClD,sHAAsH,EACtH,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAC9D,CAAC;QACF,OAAO,EAAE,YAAY,EAAE,CAAC;IAC1B,CAAC;IAED,OAAO,uBAAuB,CAAC;AACjC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "mongodb",
|
|
3
|
-
"version": "7.0.0-dev.
|
|
3
|
+
"version": "7.0.0-dev.20260114.sha.f6375c99",
|
|
4
4
|
"description": "The official MongoDB driver for Node.js",
|
|
5
5
|
"main": "lib/index.js",
|
|
6
6
|
"files": [
|
|
@@ -81,6 +81,7 @@
|
|
|
81
81
|
"@types/whatwg-url": "^13.0.0",
|
|
82
82
|
"@typescript-eslint/eslint-plugin": "^8.46.3",
|
|
83
83
|
"@typescript-eslint/parser": "^8.31.1",
|
|
84
|
+
"aws4": "^1.13.2",
|
|
84
85
|
"chai": "^4.4.1",
|
|
85
86
|
"chai-subset": "^1.6.0",
|
|
86
87
|
"chalk": "^4.1.2",
|
|
@@ -0,0 +1,207 @@
|
|
|
1
|
+
import { BSON } from '../../bson';
|
|
2
|
+
import { type AWSCredentials } from '../../deps';
|
|
3
|
+
|
|
4
|
+
export type AwsSigv4Options = {
|
|
5
|
+
path: '/';
|
|
6
|
+
body: string;
|
|
7
|
+
host: string;
|
|
8
|
+
method: 'POST';
|
|
9
|
+
headers: {
|
|
10
|
+
'Content-Type': 'application/x-www-form-urlencoded';
|
|
11
|
+
'Content-Length': number;
|
|
12
|
+
'X-MongoDB-Server-Nonce': string;
|
|
13
|
+
'X-MongoDB-GS2-CB-Flag': 'n';
|
|
14
|
+
};
|
|
15
|
+
service: string;
|
|
16
|
+
region: string;
|
|
17
|
+
date: Date;
|
|
18
|
+
};
|
|
19
|
+
|
|
20
|
+
export type SignedHeaders = {
|
|
21
|
+
Authorization: string;
|
|
22
|
+
'X-Amz-Date': string;
|
|
23
|
+
};
|
|
24
|
+
|
|
25
|
+
/**
|
|
26
|
+
* Calculates the SHA-256 hash of a string.
|
|
27
|
+
*
|
|
28
|
+
* @param str - String to hash.
|
|
29
|
+
* @returns Hexadecimal representation of the hash.
|
|
30
|
+
*/
|
|
31
|
+
const getHexSha256 = async (str: string): Promise<string> => {
|
|
32
|
+
const data = stringToBuffer(str);
|
|
33
|
+
const hashBuffer = await crypto.subtle.digest('SHA-256', data);
|
|
34
|
+
const hashHex = BSON.onDemand.ByteUtils.toHex(new Uint8Array(hashBuffer));
|
|
35
|
+
return hashHex;
|
|
36
|
+
};
|
|
37
|
+
|
|
38
|
+
/**
|
|
39
|
+
* Calculates the HMAC-SHA256 of a string using the provided key.
|
|
40
|
+
* @param key - Key to use for HMAC calculation. Can be a string or Uint8Array.
|
|
41
|
+
* @param str - String to calculate HMAC for.
|
|
42
|
+
* @returns Uint8Array containing the HMAC-SHA256 digest.
|
|
43
|
+
*/
|
|
44
|
+
const getHmacSha256 = async (key: string | Uint8Array, str: string): Promise<Uint8Array> => {
|
|
45
|
+
let keyData: Uint8Array;
|
|
46
|
+
if (typeof key === 'string') {
|
|
47
|
+
keyData = stringToBuffer(key);
|
|
48
|
+
} else {
|
|
49
|
+
keyData = key;
|
|
50
|
+
}
|
|
51
|
+
|
|
52
|
+
const importedKey = await crypto.subtle.importKey(
|
|
53
|
+
'raw',
|
|
54
|
+
keyData,
|
|
55
|
+
{ name: 'HMAC', hash: { name: 'SHA-256' } },
|
|
56
|
+
false,
|
|
57
|
+
['sign']
|
|
58
|
+
);
|
|
59
|
+
const strData = stringToBuffer(str);
|
|
60
|
+
const signature = await crypto.subtle.sign('HMAC', importedKey, strData);
|
|
61
|
+
const digest = new Uint8Array(signature);
|
|
62
|
+
return digest;
|
|
63
|
+
};
|
|
64
|
+
|
|
65
|
+
/**
|
|
66
|
+
* Converts header values according to AWS requirements,
|
|
67
|
+
* From https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html#create-canonical-request
|
|
68
|
+
* For values, you must:
|
|
69
|
+
- trim any leading or trailing spaces.
|
|
70
|
+
- convert sequential spaces to a single space.
|
|
71
|
+
* @param value - Header value to convert.
|
|
72
|
+
* @returns - Converted header value.
|
|
73
|
+
*/
|
|
74
|
+
const convertHeaderValue = (value: string | number) => {
|
|
75
|
+
return value.toString().trim().replace(/\s+/g, ' ');
|
|
76
|
+
};
|
|
77
|
+
|
|
78
|
+
/**
|
|
79
|
+
* Returns a Uint8Array representation of a string, encoded in UTF-8.
|
|
80
|
+
* @param str - String to convert.
|
|
81
|
+
* @returns Uint8Array containing the UTF-8 encoded string.
|
|
82
|
+
*/
|
|
83
|
+
function stringToBuffer(str: string): Uint8Array {
|
|
84
|
+
const data = new Uint8Array(BSON.onDemand.ByteUtils.utf8ByteLength(str));
|
|
85
|
+
BSON.onDemand.ByteUtils.encodeUTF8Into(data, str, 0);
|
|
86
|
+
return data;
|
|
87
|
+
}
|
|
88
|
+
|
|
89
|
+
/**
|
|
90
|
+
* This method implements AWS Signature 4 logic for a very specific request format.
|
|
91
|
+
* The signing logic is described here: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
|
|
92
|
+
*/
|
|
93
|
+
export async function aws4Sign(
|
|
94
|
+
options: AwsSigv4Options,
|
|
95
|
+
credentials: AWSCredentials
|
|
96
|
+
): Promise<SignedHeaders> {
|
|
97
|
+
/**
|
|
98
|
+
* From the spec: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
|
|
99
|
+
*
|
|
100
|
+
* Summary of signing steps
|
|
101
|
+
* 1. Create a canonical request
|
|
102
|
+
* Arrange the contents of your request (host, action, headers, etc.) into a standard canonical format. The canonical request is one of the inputs used to create the string to sign.
|
|
103
|
+
* 2. Create a hash of the canonical request
|
|
104
|
+
* Hash the canonical request using the same algorithm that you used to create the hash of the payload. The hash of the canonical request is a string of lowercase hexadecimal characters.
|
|
105
|
+
* 3. Create a string to sign
|
|
106
|
+
* Create a string to sign with the canonical request and extra information such as the algorithm, request date, credential scope, and the hash of the canonical request.
|
|
107
|
+
* 4. Derive a signing key
|
|
108
|
+
* Use the secret access key to derive the key used to sign the request.
|
|
109
|
+
* 5. Calculate the signature
|
|
110
|
+
* Perform a keyed hash operation on the string to sign using the derived signing key as the hash key.
|
|
111
|
+
* 6. Add the signature to the request
|
|
112
|
+
* Add the calculated signature to an HTTP header or to the query string of the request.
|
|
113
|
+
*/
|
|
114
|
+
|
|
115
|
+
// 1: Create a canonical request
|
|
116
|
+
|
|
117
|
+
// Date – The date and time used to sign the request.
|
|
118
|
+
const date = options.date;
|
|
119
|
+
// RequestDateTime – The date and time used in the credential scope. This value is the current UTC time in ISO 8601 format (for example, 20130524T000000Z).
|
|
120
|
+
const requestDateTime = date.toISOString().replace(/[:-]|\.\d{3}/g, '');
|
|
121
|
+
// RequestDate – The date used in the credential scope. This value is the current UTC date in YYYYMMDD format (for example, 20130524).
|
|
122
|
+
const requestDate = requestDateTime.substring(0, 8);
|
|
123
|
+
// Method – The HTTP request method. For us, this is always 'POST'.
|
|
124
|
+
const method = options.method;
|
|
125
|
+
// CanonicalUri – The URI-encoded version of the absolute path component URI, starting with the / that follows the domain name and up to the end of the string
|
|
126
|
+
// For our requests, this is always '/'
|
|
127
|
+
const canonicalUri = options.path;
|
|
128
|
+
// CanonicalQueryString – The URI-encoded query string parameters. For our requests, there are no query string parameters, so this is always an empty string.
|
|
129
|
+
const canonicalQuerystring = '';
|
|
130
|
+
|
|
131
|
+
// CanonicalHeaders – A list of request headers with their values. Individual header name and value pairs are separated by the newline character ("\n").
|
|
132
|
+
// All of our known/expected headers are included here, there are no extra headers.
|
|
133
|
+
const headers = new Headers({
|
|
134
|
+
'content-length': convertHeaderValue(options.headers['Content-Length']),
|
|
135
|
+
'content-type': convertHeaderValue(options.headers['Content-Type']),
|
|
136
|
+
host: convertHeaderValue(options.host),
|
|
137
|
+
'x-amz-date': convertHeaderValue(requestDateTime),
|
|
138
|
+
'x-mongodb-gs2-cb-flag': convertHeaderValue(options.headers['X-MongoDB-GS2-CB-Flag']),
|
|
139
|
+
'x-mongodb-server-nonce': convertHeaderValue(options.headers['X-MongoDB-Server-Nonce'])
|
|
140
|
+
});
|
|
141
|
+
// If session token is provided, include it in the headers
|
|
142
|
+
if ('sessionToken' in credentials && credentials.sessionToken) {
|
|
143
|
+
headers.append('x-amz-security-token', convertHeaderValue(credentials.sessionToken));
|
|
144
|
+
}
|
|
145
|
+
|
|
146
|
+
// Canonical headers are lowercased and sorted.
|
|
147
|
+
const canonicalHeaders = Array.from(headers.entries())
|
|
148
|
+
.map(([key, value]) => `${key.toLowerCase()}:${value}`)
|
|
149
|
+
.sort()
|
|
150
|
+
.join('\n');
|
|
151
|
+
const canonicalHeaderNames = Array.from(headers.keys()).map(header => header.toLowerCase());
|
|
152
|
+
// SignedHeaders – An alphabetically sorted, semicolon-separated list of lowercase request header names.
|
|
153
|
+
const signedHeaders = canonicalHeaderNames.sort().join(';');
|
|
154
|
+
|
|
155
|
+
// HashedPayload – A string created using the payload in the body of the HTTP request as input to a hash function. This string uses lowercase hexadecimal characters.
|
|
156
|
+
const hashedPayload = await getHexSha256(options.body);
|
|
157
|
+
|
|
158
|
+
// CanonicalRequest – A string that includes the above elements, separated by newline characters.
|
|
159
|
+
const canonicalRequest = [
|
|
160
|
+
method,
|
|
161
|
+
canonicalUri,
|
|
162
|
+
canonicalQuerystring,
|
|
163
|
+
canonicalHeaders + '\n',
|
|
164
|
+
signedHeaders,
|
|
165
|
+
hashedPayload
|
|
166
|
+
].join('\n');
|
|
167
|
+
|
|
168
|
+
// 2. Create a hash of the canonical request
|
|
169
|
+
// HashedCanonicalRequest – A string created by using the canonical request as input to a hash function.
|
|
170
|
+
const hashedCanonicalRequest = await getHexSha256(canonicalRequest);
|
|
171
|
+
|
|
172
|
+
// 3. Create a string to sign
|
|
173
|
+
// Algorithm – The algorithm used to create the hash of the canonical request. For SigV4, use AWS4-HMAC-SHA256.
|
|
174
|
+
const algorithm = 'AWS4-HMAC-SHA256';
|
|
175
|
+
// CredentialScope – The credential scope, which restricts the resulting signature to the specified Region and service.
|
|
176
|
+
// Has the following format: YYYYMMDD/region/service/aws4_request.
|
|
177
|
+
const credentialScope = `${requestDate}/${options.region}/${options.service}/aws4_request`;
|
|
178
|
+
// StringToSign – A string that includes the above elements, separated by newline characters.
|
|
179
|
+
const stringToSign = [algorithm, requestDateTime, credentialScope, hashedCanonicalRequest].join(
|
|
180
|
+
'\n'
|
|
181
|
+
);
|
|
182
|
+
|
|
183
|
+
// 4. Derive a signing key
|
|
184
|
+
// To derive a signing key for SigV4, perform a succession of keyed hash operations (HMAC) on the request date, Region, and service, with your AWS secret access key as the key for the initial hashing operation.
|
|
185
|
+
const dateKey = await getHmacSha256('AWS4' + credentials.secretAccessKey, requestDate);
|
|
186
|
+
const dateRegionKey = await getHmacSha256(dateKey, options.region);
|
|
187
|
+
const dateRegionServiceKey = await getHmacSha256(dateRegionKey, options.service);
|
|
188
|
+
const signingKey = await getHmacSha256(dateRegionServiceKey, 'aws4_request');
|
|
189
|
+
|
|
190
|
+
// 5. Calculate the signature
|
|
191
|
+
const signatureBuffer = await getHmacSha256(signingKey, stringToSign);
|
|
192
|
+
const signature = BSON.onDemand.ByteUtils.toHex(signatureBuffer);
|
|
193
|
+
|
|
194
|
+
// 6. Add the signature to the request
|
|
195
|
+
// Calculate the Authorization header
|
|
196
|
+
const authorizationHeader = [
|
|
197
|
+
'AWS4-HMAC-SHA256 Credential=' + credentials.accessKeyId + '/' + credentialScope,
|
|
198
|
+
'SignedHeaders=' + signedHeaders,
|
|
199
|
+
'Signature=' + signature
|
|
200
|
+
].join(', ');
|
|
201
|
+
|
|
202
|
+
// Return the calculated headers
|
|
203
|
+
return {
|
|
204
|
+
Authorization: authorizationHeader,
|
|
205
|
+
'X-Amz-Date': requestDateTime
|
|
206
|
+
};
|
|
207
|
+
}
|
|
@@ -1,6 +1,5 @@
|
|
|
1
1
|
import type { Binary, BSONSerializeOptions } from '../../bson';
|
|
2
2
|
import * as BSON from '../../bson';
|
|
3
|
-
import { aws4 } from '../../deps';
|
|
4
3
|
import {
|
|
5
4
|
MongoCompatibilityError,
|
|
6
5
|
MongoMissingCredentialsError,
|
|
@@ -13,6 +12,7 @@ import {
|
|
|
13
12
|
AWSSDKCredentialProvider,
|
|
14
13
|
type AWSTempCredentials
|
|
15
14
|
} from './aws_temporary_credentials';
|
|
15
|
+
import { aws4Sign } from './aws4';
|
|
16
16
|
import { MongoCredentials } from './mongo_credentials';
|
|
17
17
|
import { AuthMechanism } from './providers';
|
|
18
18
|
|
|
@@ -45,11 +45,6 @@ export class MongoDBAWS extends AuthProvider {
|
|
|
45
45
|
throw new MongoMissingCredentialsError('AuthContext must provide credentials.');
|
|
46
46
|
}
|
|
47
47
|
|
|
48
|
-
if ('kModuleError' in aws4) {
|
|
49
|
-
throw aws4['kModuleError'];
|
|
50
|
-
}
|
|
51
|
-
const { sign } = aws4;
|
|
52
|
-
|
|
53
48
|
if (maxWireVersion(connection) < 9) {
|
|
54
49
|
throw new MongoCompatibilityError(
|
|
55
50
|
'MONGODB-AWS authentication requires MongoDB version 4.4 or later'
|
|
@@ -68,13 +63,10 @@ export class MongoDBAWS extends AuthProvider {
|
|
|
68
63
|
// Allow the user to specify an AWS session token for authentication with temporary credentials.
|
|
69
64
|
const sessionToken = credentials.mechanismProperties.AWS_SESSION_TOKEN;
|
|
70
65
|
|
|
71
|
-
// If all three defined, include sessionToken, else include username and pass
|
|
72
|
-
const awsCredentials =
|
|
73
|
-
accessKeyId
|
|
74
|
-
|
|
75
|
-
: accessKeyId && secretAccessKey
|
|
76
|
-
? { accessKeyId, secretAccessKey }
|
|
77
|
-
: undefined;
|
|
66
|
+
// If all three defined, include sessionToken, else only include username and pass
|
|
67
|
+
const awsCredentials = sessionToken
|
|
68
|
+
? { accessKeyId, secretAccessKey, sessionToken }
|
|
69
|
+
: { accessKeyId, secretAccessKey };
|
|
78
70
|
|
|
79
71
|
const db = credentials.source;
|
|
80
72
|
const nonce = await randomBytes(32);
|
|
@@ -114,7 +106,7 @@ export class MongoDBAWS extends AuthProvider {
|
|
|
114
106
|
}
|
|
115
107
|
|
|
116
108
|
const body = 'Action=GetCallerIdentity&Version=2011-06-15';
|
|
117
|
-
const
|
|
109
|
+
const headers = await aws4Sign(
|
|
118
110
|
{
|
|
119
111
|
method: 'POST',
|
|
120
112
|
host,
|
|
@@ -127,14 +119,15 @@ export class MongoDBAWS extends AuthProvider {
|
|
|
127
119
|
'X-MongoDB-GS2-CB-Flag': 'n'
|
|
128
120
|
},
|
|
129
121
|
path: '/',
|
|
130
|
-
body
|
|
122
|
+
body,
|
|
123
|
+
date: new Date()
|
|
131
124
|
},
|
|
132
125
|
awsCredentials
|
|
133
126
|
);
|
|
134
127
|
|
|
135
128
|
const payload: AWSSaslContinuePayload = {
|
|
136
|
-
a:
|
|
137
|
-
d:
|
|
129
|
+
a: headers.Authorization,
|
|
130
|
+
d: headers['X-Amz-Date']
|
|
138
131
|
};
|
|
139
132
|
|
|
140
133
|
if (sessionToken) {
|
package/src/deps.ts
CHANGED
|
@@ -203,66 +203,6 @@ export function getSocks(): SocksLib | { kModuleError: MongoMissingDependencyErr
|
|
|
203
203
|
}
|
|
204
204
|
}
|
|
205
205
|
|
|
206
|
-
interface AWS4 {
|
|
207
|
-
/**
|
|
208
|
-
* Created these inline types to better assert future usage of this API
|
|
209
|
-
* @param options - options for request
|
|
210
|
-
* @param credentials - AWS credential details, sessionToken should be omitted entirely if its false-y
|
|
211
|
-
*/
|
|
212
|
-
sign(
|
|
213
|
-
this: void,
|
|
214
|
-
options: {
|
|
215
|
-
path: '/';
|
|
216
|
-
body: string;
|
|
217
|
-
host: string;
|
|
218
|
-
method: 'POST';
|
|
219
|
-
headers: {
|
|
220
|
-
'Content-Type': 'application/x-www-form-urlencoded';
|
|
221
|
-
'Content-Length': number;
|
|
222
|
-
'X-MongoDB-Server-Nonce': string;
|
|
223
|
-
'X-MongoDB-GS2-CB-Flag': 'n';
|
|
224
|
-
};
|
|
225
|
-
service: string;
|
|
226
|
-
region: string;
|
|
227
|
-
},
|
|
228
|
-
credentials:
|
|
229
|
-
| {
|
|
230
|
-
accessKeyId: string;
|
|
231
|
-
secretAccessKey: string;
|
|
232
|
-
sessionToken: string;
|
|
233
|
-
}
|
|
234
|
-
| {
|
|
235
|
-
accessKeyId: string;
|
|
236
|
-
secretAccessKey: string;
|
|
237
|
-
}
|
|
238
|
-
| undefined
|
|
239
|
-
): {
|
|
240
|
-
headers: {
|
|
241
|
-
Authorization: string;
|
|
242
|
-
'X-Amz-Date': string;
|
|
243
|
-
};
|
|
244
|
-
};
|
|
245
|
-
}
|
|
246
|
-
|
|
247
|
-
export const aws4: AWS4 | { kModuleError: MongoMissingDependencyError } = loadAws4();
|
|
248
|
-
|
|
249
|
-
function loadAws4() {
|
|
250
|
-
let aws4: AWS4 | { kModuleError: MongoMissingDependencyError };
|
|
251
|
-
try {
|
|
252
|
-
// eslint-disable-next-line @typescript-eslint/no-require-imports
|
|
253
|
-
aws4 = require('aws4');
|
|
254
|
-
} catch (error) {
|
|
255
|
-
aws4 = makeErrorModule(
|
|
256
|
-
new MongoMissingDependencyError(
|
|
257
|
-
'Optional module `aws4` not found. Please install it to enable AWS authentication',
|
|
258
|
-
{ cause: error, dependencyName: 'aws4' }
|
|
259
|
-
)
|
|
260
|
-
);
|
|
261
|
-
}
|
|
262
|
-
|
|
263
|
-
return aws4;
|
|
264
|
-
}
|
|
265
|
-
|
|
266
206
|
/** A utility function to get the instance of mongodb-client-encryption, if it exists. */
|
|
267
207
|
export function getMongoDBClientEncryption():
|
|
268
208
|
| typeof import('mongodb-client-encryption')
|