oxygen-cli 1.40.1 → 1.40.2-beta.1

package/transpiled/mongodb/lib/client-side-encryption/crypto_callbacks.js

@@ -0,0 +1,95 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.hmacSha256Hook = exports.hmacSha512Hook = exports.aes256CtrDecryptHook = exports.aes256CtrEncryptHook = exports.aes256CbcDecryptHook = exports.aes256CbcEncryptHook = void 0;
+exports.makeAES256Hook = makeAES256Hook;
+exports.randomHook = randomHook;
+exports.sha256Hook = sha256Hook;
+exports.makeHmacHook = makeHmacHook;
+exports.signRsaSha256Hook = signRsaSha256Hook;
+
+const crypto = require("crypto");
+
+function makeAES256Hook(method, mode) {
+  return function (key, iv, input, output) {
+    let result;
+
+    try {
+      const cipher = crypto[method](mode, key, iv);
+      cipher.setAutoPadding(false);
+      result = cipher.update(input);
+      const final = cipher.final();
+
+      if (final.length > 0) {
+        result = Buffer.concat([result, final]);
+      }
+    } catch (e) {
+      return e;
+    }
+
+    result.copy(output);
+    return result.length;
+  };
+}
+
+function randomHook(buffer, count) {
+  try {
+    crypto.randomFillSync(buffer, 0, count);
+  } catch (e) {
+    return e;
+  }
+
+  return count;
+}
+
+function sha256Hook(input, output) {
+  let result;
+
+  try {
+    result = crypto.createHash('sha256').update(input).digest();
+  } catch (e) {
+    return e;
+  }
+
+  result.copy(output);
+  return result.length;
+}
+
+function makeHmacHook(algorithm) {
+  return (key, input, output) => {
+    let result;
+
+    try {
+      result = crypto.createHmac(algorithm, key).update(input).digest();
+    } catch (e) {
+      return e;
+    }
+
+    result.copy(output);
+    return result.length;
+  };
+}
+
+function signRsaSha256Hook(key, input, output) {
+  let result;
+
+  try {
+    const signer = crypto.createSign('sha256WithRSAEncryption');
+    const privateKey = Buffer.from(`-----BEGIN PRIVATE KEY-----\n${key.toString('base64')}\n-----END PRIVATE KEY-----\n`);
+    result = signer.update(input).end().sign(privateKey);
+  } catch (e) {
+    return e;
+  }
+
+  result.copy(output);
+  return result.length;
+}
+
+exports.aes256CbcEncryptHook = makeAES256Hook('createCipheriv', 'aes-256-cbc');
+exports.aes256CbcDecryptHook = makeAES256Hook('createDecipheriv', 'aes-256-cbc');
+exports.aes256CtrEncryptHook = makeAES256Hook('createCipheriv', 'aes-256-ctr');
+exports.aes256CtrDecryptHook = makeAES256Hook('createDecipheriv', 'aes-256-ctr');
+exports.hmacSha512Hook = makeHmacHook('sha512');
+exports.hmacSha256Hook = makeHmacHook('sha256');

package/transpiled/mongodb/lib/client-side-encryption/errors.js

@@ -0,0 +1,171 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.MongoCryptKMSRequestNetworkTimeoutError = exports.MongoCryptAzureKMSRequestError = exports.MongoCryptCreateEncryptedCollectionError = exports.MongoCryptCreateDataKeyError = exports.MongoCryptInvalidArgumentError = exports.MongoCryptError = void 0;
+
+const error_1 = require("../error");
+/**
+ * @public
+ * An error indicating that something went wrong specifically with MongoDB Client Encryption
+ */
+
+
+class MongoCryptError extends error_1.MongoError {
+  /**
+   * **Do not use this constructor!**
+   *
+   * Meant for internal use only.
+   *
+   * @remarks
+   * This class is only meant to be constructed within the driver. This constructor is
+   * not subject to semantic versioning compatibility guarantees and may change at any time.
+   *
+   * @public
+   **/
+  constructor(message, options = {}) {
+    super(message, options);
+  }
+
+  get name() {
+    return 'MongoCryptError';
+  }
+
+}
+
+exports.MongoCryptError = MongoCryptError;
+/**
+ * @public
+ *
+ * An error indicating an invalid argument was provided to an encryption API.
+ */
+
+class MongoCryptInvalidArgumentError extends MongoCryptError {
+  /**
+   * **Do not use this constructor!**
+   *
+   * Meant for internal use only.
+   *
+   * @remarks
+   * This class is only meant to be constructed within the driver. This constructor is
+   * not subject to semantic versioning compatibility guarantees and may change at any time.
+   *
+   * @public
+   **/
+  constructor(message) {
+    super(message);
+  }
+
+  get name() {
+    return 'MongoCryptInvalidArgumentError';
+  }
+
+}
+
+exports.MongoCryptInvalidArgumentError = MongoCryptInvalidArgumentError;
+/**
+ * @public
+ * An error indicating that `ClientEncryption.createEncryptedCollection()` failed to create data keys
+ */
+
+class MongoCryptCreateDataKeyError extends MongoCryptError {
+  /**
+   * **Do not use this constructor!**
+   *
+   * Meant for internal use only.
+   *
+   * @remarks
+   * This class is only meant to be constructed within the driver. This constructor is
+   * not subject to semantic versioning compatibility guarantees and may change at any time.
+   *
+   * @public
+   **/
+  constructor(encryptedFields, {
+    cause
+  }) {
+    super(`Unable to complete creating data keys: ${cause.message}`, {
+      cause
+    });
+    this.encryptedFields = encryptedFields;
+  }
+
+  get name() {
+    return 'MongoCryptCreateDataKeyError';
+  }
+
+}
+
+exports.MongoCryptCreateDataKeyError = MongoCryptCreateDataKeyError;
+/**
+ * @public
+ * An error indicating that `ClientEncryption.createEncryptedCollection()` failed to create a collection
+ */
+
+class MongoCryptCreateEncryptedCollectionError extends MongoCryptError {
+  /**
+   * **Do not use this constructor!**
+   *
+   * Meant for internal use only.
+   *
+   * @remarks
+   * This class is only meant to be constructed within the driver. This constructor is
+   * not subject to semantic versioning compatibility guarantees and may change at any time.
+   *
+   * @public
+   **/
+  constructor(encryptedFields, {
+    cause
+  }) {
+    super(`Unable to create collection: ${cause.message}`, {
+      cause
+    });
+    this.encryptedFields = encryptedFields;
+  }
+
+  get name() {
+    return 'MongoCryptCreateEncryptedCollectionError';
+  }
+
+}
+
+exports.MongoCryptCreateEncryptedCollectionError = MongoCryptCreateEncryptedCollectionError;
+/**
+ * @public
+ * An error indicating that mongodb-client-encryption failed to auto-refresh Azure KMS credentials.
+ */
+
+class MongoCryptAzureKMSRequestError extends MongoCryptError {
+  /**
+   * **Do not use this constructor!**
+   *
+   * Meant for internal use only.
+   *
+   * @remarks
+   * This class is only meant to be constructed within the driver. This constructor is
+   * not subject to semantic versioning compatibility guarantees and may change at any time.
+   *
+   * @public
+   **/
+  constructor(message, body) {
+    super(message);
+    this.body = body;
+  }
+
+  get name() {
+    return 'MongoCryptAzureKMSRequestError';
+  }
+
+}
+
+exports.MongoCryptAzureKMSRequestError = MongoCryptAzureKMSRequestError;
+/** @public */
+
+class MongoCryptKMSRequestNetworkTimeoutError extends MongoCryptError {
+  get name() {
+    return 'MongoCryptKMSRequestNetworkTimeoutError';
+  }
+
+}
+
+exports.MongoCryptKMSRequestNetworkTimeoutError = MongoCryptKMSRequestNetworkTimeoutError;

package/transpiled/mongodb/lib/client-side-encryption/mongocryptd_manager.js

@@ -0,0 +1,98 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.MongocryptdManager = void 0;
+
+const error_1 = require("../error");
+/**
+ * @internal
+ * An internal class that handles spawning a mongocryptd.
+ */
+
+
+class MongocryptdManager {
+  constructor(extraOptions = {}) {
+    this.spawnPath = '';
+    this.spawnArgs = [];
+    this.uri = typeof extraOptions.mongocryptdURI === 'string' && extraOptions.mongocryptdURI.length > 0 ? extraOptions.mongocryptdURI : MongocryptdManager.DEFAULT_MONGOCRYPTD_URI;
+    this.bypassSpawn = !!extraOptions.mongocryptdBypassSpawn;
+
+    if (Object.hasOwn(extraOptions, 'mongocryptdSpawnPath') && extraOptions.mongocryptdSpawnPath) {
+      this.spawnPath = extraOptions.mongocryptdSpawnPath;
+    }
+
+    if (Object.hasOwn(extraOptions, 'mongocryptdSpawnArgs') && Array.isArray(extraOptions.mongocryptdSpawnArgs)) {
+      this.spawnArgs = this.spawnArgs.concat(extraOptions.mongocryptdSpawnArgs);
+    }
+
+    if (this.spawnArgs.filter(arg => typeof arg === 'string').every(arg => arg.indexOf('--idleShutdownTimeoutSecs') < 0)) {
+      this.spawnArgs.push('--idleShutdownTimeoutSecs', '60');
+    }
+  }
+  /**
+   * Will check to see if a mongocryptd is up. If it is not up, it will attempt
+   * to spawn a mongocryptd in a detached process, and then wait for it to be up.
+   */
+
+
+  async spawn() {
+    const cmdName = this.spawnPath || 'mongocryptd'; // eslint-disable-next-line @typescript-eslint/no-require-imports
+
+    const {
+      spawn
+    } = require('child_process'); // Spawned with stdio: ignore and detached: true
+    // to ensure child can outlive parent.
+
+
+    this._child = spawn(cmdName, this.spawnArgs, {
+      stdio: 'ignore',
+      detached: true
+    });
+
+    this._child.on('error', () => {// From the FLE spec:
+      // "The stdout and stderr of the spawned process MUST not be exposed in the driver
+      // (e.g. redirect to /dev/null). Users can pass the argument --logpath to
+      // extraOptions.mongocryptdSpawnArgs if they need to inspect mongocryptd logs.
+      // If spawning is necessary, the driver MUST spawn mongocryptd whenever server
+      // selection on the MongoClient to mongocryptd fails. If the MongoClient fails to
+      // connect after spawning, the server selection error is propagated to the user."
+      // The AutoEncrypter and MongoCryptdManager should work together to spawn
+      // mongocryptd whenever necessary.  Additionally, the `mongocryptd` intentionally
+      // shuts down after 60s and gets respawned when necessary.  We rely on server
+      // selection timeouts when connecting to the `mongocryptd` to inform users that something
+      // has been configured incorrectly.  For those reasons, we suppress stderr from
+      // the `mongocryptd` process and immediately unref the process.
+    }); // unref child to remove handle from event loop
+
+
+    this._child.unref();
+  }
+  /**
+   * @returns the result of `fn` or rejects with an error.
+   */
+
+
+  async withRespawn(fn) {
+    try {
+      const result = await fn();
+      return result;
+    } catch (err) {
+      // If we are not bypassing spawning, then we should retry once on a MongoTimeoutError (server selection error)
+      const shouldSpawn = err instanceof error_1.MongoNetworkTimeoutError && !this.bypassSpawn;
+
+      if (!shouldSpawn) {
+        throw err;
+      }
+    }
+
+    await this.spawn();
+    const result = await fn();
+    return result;
+  }
+
+}
+
+exports.MongocryptdManager = MongocryptdManager;
+MongocryptdManager.DEFAULT_MONGOCRYPTD_URI = 'mongodb://localhost:27020';

package/transpiled/mongodb/lib/client-side-encryption/providers/aws.js

@@ -0,0 +1,34 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.loadAWSCredentials = loadAWSCredentials;
+
+const aws_temporary_credentials_1 = require("../../cmap/auth/aws_temporary_credentials");
+/**
+ * @internal
+ */
+
+
+async function loadAWSCredentials(kmsProviders, provider) {
+  const credentialProvider = new aws_temporary_credentials_1.AWSSDKCredentialProvider(provider); // We shouldn't ever receive a response from the AWS SDK that doesn't have a `SecretAccessKey`
+  // or `AccessKeyId`.  However, TS says these fields are optional.  We provide empty strings
+  // and let libmongocrypt error if we're unable to fetch the required keys.
+
+  const {
+    SecretAccessKey = '',
+    AccessKeyId = '',
+    Token
+  } = await credentialProvider.getCredentials();
+  const aws = {
+    secretAccessKey: SecretAccessKey,
+    accessKeyId: AccessKeyId
+  }; // the AWS session token is only required for temporary credentials so only attach it to the
+  // result if it's present in the response from the aws sdk
+
+  Token != null && (aws.sessionToken = Token);
+  return { ...kmsProviders,
+    aws
+  };
+}

package/transpiled/mongodb/lib/client-side-encryption/providers/azure.js

@@ -0,0 +1,186 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.tokenCache = exports.AzureCredentialCache = exports.AZURE_BASE_URL = void 0;
+exports.addAzureParams = addAzureParams;
+exports.prepareRequest = prepareRequest;
+exports.fetchAzureKMSToken = fetchAzureKMSToken;
+exports.loadAzureCredentials = loadAzureCredentials;
+
+const error_1 = require("../../error");
+
+const utils_1 = require("../../utils");
+
+const errors_1 = require("../errors");
+
+const MINIMUM_TOKEN_REFRESH_IN_MILLISECONDS = 6000;
+/** Base URL for getting Azure tokens. */
+
+exports.AZURE_BASE_URL = 'http://169.254.169.254/metadata/identity/oauth2/token?';
+/**
+ * @internal
+ */
+
+class AzureCredentialCache {
+  constructor() {
+    this.cachedToken = null;
+  }
+
+  async getToken() {
+    if (this.cachedToken == null || this.needsRefresh(this.cachedToken)) {
+      this.cachedToken = await this._getToken();
+    }
+
+    return {
+      accessToken: this.cachedToken.accessToken
+    };
+  }
+
+  needsRefresh(token) {
+    const timeUntilExpirationMS = token.expiresOnTimestamp - Date.now();
+    return timeUntilExpirationMS <= MINIMUM_TOKEN_REFRESH_IN_MILLISECONDS;
+  }
+  /**
+   * exposed for testing
+   */
+
+
+  resetCache() {
+    this.cachedToken = null;
+  }
+  /**
+   * exposed for testing
+   */
+
+
+  _getToken() {
+    return fetchAzureKMSToken();
+  }
+
+}
+
+exports.AzureCredentialCache = AzureCredentialCache;
+/** @internal */
+
+exports.tokenCache = new AzureCredentialCache();
+/** @internal */
+
+async function parseResponse(response) {
+  const {
+    status,
+    body: rawBody
+  } = response;
+
+  const body = (() => {
+    try {
+      return JSON.parse(rawBody);
+    } catch {
+      throw new errors_1.MongoCryptAzureKMSRequestError('Malformed JSON body in GET request.');
+    }
+  })();
+
+  if (status !== 200) {
+    throw new errors_1.MongoCryptAzureKMSRequestError('Unable to complete request.', body);
+  }
+
+  if (!body.access_token) {
+    throw new errors_1.MongoCryptAzureKMSRequestError('Malformed response body - missing field `access_token`.');
+  }
+
+  if (!body.expires_in) {
+    throw new errors_1.MongoCryptAzureKMSRequestError('Malformed response body - missing field `expires_in`.');
+  }
+
+  const expiresInMS = Number(body.expires_in) * 1000;
+
+  if (Number.isNaN(expiresInMS)) {
+    throw new errors_1.MongoCryptAzureKMSRequestError('Malformed response body - unable to parse int from `expires_in` field.');
+  }
+
+  return {
+    accessToken: body.access_token,
+    expiresOnTimestamp: Date.now() + expiresInMS
+  };
+}
+/**
+ * @internal
+ * Get the Azure endpoint URL.
+ */
+
+
+function addAzureParams(url, resource, username) {
+  url.searchParams.append('api-version', '2018-02-01');
+  url.searchParams.append('resource', resource);
+
+  if (username) {
+    url.searchParams.append('client_id', username);
+  }
+
+  return url;
+}
+/**
+ * @internal
+ *
+ * parses any options provided by prose tests to `fetchAzureKMSToken` and merges them with
+ * the default values for headers and the request url.
+ */
+
+
+function prepareRequest(options) {
+  const url = new URL(options.url?.toString() ?? exports.AZURE_BASE_URL);
+  addAzureParams(url, 'https://vault.azure.net');
+  const headers = { ...options.headers,
+    'Content-Type': 'application/json',
+    Metadata: true
+  };
+  return {
+    headers,
+    url
+  };
+}
+/**
+ * @internal
+ *
+ * `AzureKMSRequestOptions` allows prose tests to modify the http request sent to the idms
+ * servers.  This is required to simulate different server conditions.  No options are expected to
+ * be set outside of tests.
+ *
+ * exposed for CSFLE
+ * [prose test 18](https://github.com/mongodb/specifications/tree/master/source/client-side-encryption/tests#azure-imds-credentials)
+ */
+
+
+async function fetchAzureKMSToken(options = {}) {
+  const {
+    headers,
+    url
+  } = prepareRequest(options);
+
+  try {
+    const response = await (0, utils_1.get)(url, {
+      headers
+    });
+    return await parseResponse(response);
+  } catch (error) {
+    if (error instanceof error_1.MongoNetworkTimeoutError) {
+      throw new errors_1.MongoCryptAzureKMSRequestError(`[Azure KMS] ${error.message}`);
+    }
+
+    throw error;
+  }
+}
+/**
+ * @internal
+ *
+ * @throws Will reject with a `MongoCryptError` if the http request fails or the http response is malformed.
+ */
+
+
+async function loadAzureCredentials(kmsProviders) {
+  const azure = await exports.tokenCache.getToken();
+  return { ...kmsProviders,
+    azure
+  };
+}

package/transpiled/mongodb/lib/client-side-encryption/providers/gcp.js

@@ -0,0 +1,29 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.loadGCPCredentials = loadGCPCredentials;
+
+const deps_1 = require("../../deps");
+/** @internal */
+
+
+async function loadGCPCredentials(kmsProviders) {
+  const gcpMetadata = (0, deps_1.getGcpMetadata)();
+
+  if ('kModuleError' in gcpMetadata) {
+    return kmsProviders;
+  }
+
+  const {
+    access_token: accessToken
+  } = await gcpMetadata.instance({
+    property: 'service-accounts/default/token'
+  });
+  return { ...kmsProviders,
+    gcp: {
+      accessToken
+    }
+  };
+}

package/transpiled/mongodb/lib/client-side-encryption/providers/index.js

@@ -0,0 +1,58 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.isEmptyCredentials = isEmptyCredentials;
+exports.refreshKMSCredentials = refreshKMSCredentials;
+
+const aws_1 = require("./aws");
+
+const azure_1 = require("./azure");
+
+const gcp_1 = require("./gcp");
+/**
+ * Auto credential fetching should only occur when the provider is defined on the kmsProviders map
+ * and the settings are an empty object.
+ *
+ * This is distinct from a nullish provider key.
+ *
+ * @internal - exposed for testing purposes only
+ */
+
+
+function isEmptyCredentials(providerName, kmsProviders) {
+  const provider = kmsProviders[providerName];
+
+  if (provider == null) {
+    return false;
+  }
+
+  return typeof provider === 'object' && Object.keys(provider).length === 0;
+}
+/**
+ * Load cloud provider credentials for the user provided KMS providers.
+ * Credentials will only attempt to get loaded if they do not exist
+ * and no existing credentials will get overwritten.
+ *
+ * @internal
+ */
+
+
+async function refreshKMSCredentials(kmsProviders, credentialProviders) {
+  let finalKMSProviders = kmsProviders;
+
+  if (isEmptyCredentials('aws', kmsProviders)) {
+    finalKMSProviders = await (0, aws_1.loadAWSCredentials)(finalKMSProviders, credentialProviders?.aws);
+  }
+
+  if (isEmptyCredentials('gcp', kmsProviders)) {
+    finalKMSProviders = await (0, gcp_1.loadGCPCredentials)(finalKMSProviders);
+  }
+
+  if (isEmptyCredentials('azure', kmsProviders)) {
+    finalKMSProviders = await (0, azure_1.loadAzureCredentials)(finalKMSProviders);
+  }
+
+  return finalKMSProviders;
+}