oxygen-cli 1.40.1 → 1.40.2-beta.1

package/transpiled/mongodb/lib/cmap/auth/aws_temporary_credentials.js

@@ -0,0 +1,167 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.LegacyAWSTemporaryCredentialProvider = exports.AWSSDKCredentialProvider = exports.AWSTemporaryCredentialProvider = void 0;
+
+const deps_1 = require("../../deps");
+
+const error_1 = require("../../error");
+
+const utils_1 = require("../../utils");
+
+const AWS_RELATIVE_URI = 'http://169.254.170.2';
+const AWS_EC2_URI = 'http://169.254.169.254';
+const AWS_EC2_PATH = '/latest/meta-data/iam/security-credentials';
+/**
+ * @internal
+ *
+ * Fetches temporary AWS credentials.
+ */
+
+class AWSTemporaryCredentialProvider {
+  static get awsSDK() {
+    AWSTemporaryCredentialProvider._awsSDK ??= (0, deps_1.getAwsCredentialProvider)();
+    return AWSTemporaryCredentialProvider._awsSDK;
+  }
+
+  static get isAWSSDKInstalled() {
+    return !('kModuleError' in AWSTemporaryCredentialProvider.awsSDK);
+  }
+
+}
+
+exports.AWSTemporaryCredentialProvider = AWSTemporaryCredentialProvider;
+/** @internal */
+
+class AWSSDKCredentialProvider extends AWSTemporaryCredentialProvider {
+  /**
+   * Create the SDK credentials provider.
+   * @param credentialsProvider - The credentials provider.
+   */
+  constructor(credentialsProvider) {
+    super();
+
+    if (credentialsProvider) {
+      this._provider = credentialsProvider;
+    }
+  }
+  /**
+   * The AWS SDK caches credentials automatically and handles refresh when the credentials have expired.
+   * To ensure this occurs, we need to cache the `provider` returned by the AWS sdk and re-use it when fetching credentials.
+   */
+
+
+  get provider() {
+    if ('kModuleError' in AWSTemporaryCredentialProvider.awsSDK) {
+      throw AWSTemporaryCredentialProvider.awsSDK.kModuleError;
+    }
+
+    if (this._provider) {
+      return this._provider;
+    }
+
+    let {
+      AWS_STS_REGIONAL_ENDPOINTS = '',
+      AWS_REGION = ''
+    } = process.env;
+    AWS_STS_REGIONAL_ENDPOINTS = AWS_STS_REGIONAL_ENDPOINTS.toLowerCase();
+    AWS_REGION = AWS_REGION.toLowerCase();
+    /** The option setting should work only for users who have explicit settings in their environment, the driver should not encode "defaults" */
+
+    const awsRegionSettingsExist = AWS_REGION.length !== 0 && AWS_STS_REGIONAL_ENDPOINTS.length !== 0;
+    /**
+     * The following regions use the global AWS STS endpoint, sts.amazonaws.com, by default
+     * https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html
+     */
+
+    const LEGACY_REGIONS = new Set(['ap-northeast-1', 'ap-south-1', 'ap-southeast-1', 'ap-southeast-2', 'aws-global', 'ca-central-1', 'eu-central-1', 'eu-north-1', 'eu-west-1', 'eu-west-2', 'eu-west-3', 'sa-east-1', 'us-east-1', 'us-east-2', 'us-west-1', 'us-west-2']);
+    /**
+     * If AWS_STS_REGIONAL_ENDPOINTS is set to regional, users are opting into the new behavior of respecting the region settings
+     *
+     * If AWS_STS_REGIONAL_ENDPOINTS is set to legacy, then "old" regions need to keep using the global setting.
+     * Technically the SDK gets this wrong, it reaches out to 'sts.us-east-1.amazonaws.com' when it should be 'sts.amazonaws.com'.
+     * That is not our bug to fix here. We leave that up to the SDK.
+     */
+
+    const useRegionalSts = AWS_STS_REGIONAL_ENDPOINTS === 'regional' || AWS_STS_REGIONAL_ENDPOINTS === 'legacy' && !LEGACY_REGIONS.has(AWS_REGION);
+    this._provider = awsRegionSettingsExist && useRegionalSts ? AWSTemporaryCredentialProvider.awsSDK.fromNodeProviderChain({
+      clientConfig: {
+        region: AWS_REGION
+      }
+    }) : AWSTemporaryCredentialProvider.awsSDK.fromNodeProviderChain();
+    return this._provider;
+  }
+
+  async getCredentials() {
+    /*
+     * Creates a credential provider that will attempt to find credentials from the
+     * following sources (listed in order of precedence):
+     *
+     * - Environment variables exposed via process.env
+     * - SSO credentials from token cache
+     * - Web identity token credentials
+     * - Shared credentials and config ini files
+     * - The EC2/ECS Instance Metadata Service
+     */
+    try {
+      const creds = await this.provider();
+      return {
+        AccessKeyId: creds.accessKeyId,
+        SecretAccessKey: creds.secretAccessKey,
+        Token: creds.sessionToken,
+        Expiration: creds.expiration
+      };
+    } catch (error) {
+      throw new error_1.MongoAWSError(error.message, {
+        cause: error
+      });
+    }
+  }
+
+}
+
+exports.AWSSDKCredentialProvider = AWSSDKCredentialProvider;
+/**
+ * @internal
+ * Fetches credentials manually (without the AWS SDK), as outlined in the [Obtaining Credentials](https://github.com/mongodb/specifications/blob/master/source/auth/auth.md#obtaining-credentials)
+ * section of the Auth spec.
+ */
+
+class LegacyAWSTemporaryCredentialProvider extends AWSTemporaryCredentialProvider {
+  async getCredentials() {
+    // If the environment variable AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
+    // is set then drivers MUST assume that it was set by an AWS ECS agent
+    if (process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI) {
+      return await (0, utils_1.request)(`${AWS_RELATIVE_URI}${process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI}`);
+    } // Otherwise assume we are on an EC2 instance
+    // get a token
+
+
+    const token = await (0, utils_1.request)(`${AWS_EC2_URI}/latest/api/token`, {
+      method: 'PUT',
+      json: false,
+      headers: {
+        'X-aws-ec2-metadata-token-ttl-seconds': 30
+      }
+    }); // get role name
+
+    const roleName = await (0, utils_1.request)(`${AWS_EC2_URI}/${AWS_EC2_PATH}`, {
+      json: false,
+      headers: {
+        'X-aws-ec2-metadata-token': token
+      }
+    }); // get temp credentials
+
+    const creds = await (0, utils_1.request)(`${AWS_EC2_URI}/${AWS_EC2_PATH}/${roleName}`, {
+      headers: {
+        'X-aws-ec2-metadata-token': token
+      }
+    });
+    return creds;
+  }
+
+}
+
+exports.LegacyAWSTemporaryCredentialProvider = LegacyAWSTemporaryCredentialProvider;

package/transpiled/mongodb/lib/cmap/auth/gssapi.js

@@ -0,0 +1,207 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.GSSAPI = exports.GSSAPICanonicalizationValue = void 0;
+exports.performGSSAPICanonicalizeHostName = performGSSAPICanonicalizeHostName;
+exports.resolveCname = resolveCname;
+
+const dns = require("dns");
+
+const deps_1 = require("../../deps");
+
+const error_1 = require("../../error");
+
+const utils_1 = require("../../utils");
+
+const auth_provider_1 = require("./auth_provider");
+/** @public */
+
+
+exports.GSSAPICanonicalizationValue = Object.freeze({
+  on: true,
+  off: false,
+  none: 'none',
+  forward: 'forward',
+  forwardAndReverse: 'forwardAndReverse'
+});
+
+async function externalCommand(connection, command) {
+  const response = await connection.command((0, utils_1.ns)('$external.$cmd'), command);
+  return response;
+}
+
+let krb;
+
+class GSSAPI extends auth_provider_1.AuthProvider {
+  async auth(authContext) {
+    const {
+      connection,
+      credentials
+    } = authContext;
+
+    if (credentials == null) {
+      throw new error_1.MongoMissingCredentialsError('Credentials required for GSSAPI authentication');
+    }
+
+    const {
+      username
+    } = credentials;
+    const client = await makeKerberosClient(authContext);
+    const payload = await client.step('');
+    const saslStartResponse = await externalCommand(connection, saslStart(payload));
+    const negotiatedPayload = await negotiate(client, 10, saslStartResponse.payload);
+    const saslContinueResponse = await externalCommand(connection, saslContinue(negotiatedPayload, saslStartResponse.conversationId));
+    const finalizePayload = await finalize(client, username, saslContinueResponse.payload);
+    await externalCommand(connection, {
+      saslContinue: 1,
+      conversationId: saslContinueResponse.conversationId,
+      payload: finalizePayload
+    });
+  }
+
+}
+
+exports.GSSAPI = GSSAPI;
+
+async function makeKerberosClient(authContext) {
+  const {
+    hostAddress
+  } = authContext.options;
+  const {
+    credentials
+  } = authContext;
+
+  if (!hostAddress || typeof hostAddress.host !== 'string' || !credentials) {
+    throw new error_1.MongoInvalidArgumentError('Connection must have host and port and credentials defined.');
+  }
+
+  loadKrb();
+
+  if ('kModuleError' in krb) {
+    throw krb['kModuleError'];
+  }
+
+  const {
+    initializeClient
+  } = krb;
+  const {
+    username,
+    password
+  } = credentials;
+  const mechanismProperties = credentials.mechanismProperties;
+  const serviceName = mechanismProperties.SERVICE_NAME ?? 'mongodb';
+  const host = await performGSSAPICanonicalizeHostName(hostAddress.host, mechanismProperties);
+  const initOptions = {};
+
+  if (password != null) {
+    // TODO(NODE-5139): These do not match the typescript options in initializeClient
+    Object.assign(initOptions, {
+      user: username,
+      password: password
+    });
+  }
+
+  const spnHost = mechanismProperties.SERVICE_HOST ?? host;
+  let spn = `${serviceName}${process.platform === 'win32' ? '/' : '@'}${spnHost}`;
+
+  if ('SERVICE_REALM' in mechanismProperties) {
+    spn = `${spn}@${mechanismProperties.SERVICE_REALM}`;
+  }
+
+  return await initializeClient(spn, initOptions);
+}
+
+function saslStart(payload) {
+  return {
+    saslStart: 1,
+    mechanism: 'GSSAPI',
+    payload,
+    autoAuthorize: 1
+  };
+}
+
+function saslContinue(payload, conversationId) {
+  return {
+    saslContinue: 1,
+    conversationId,
+    payload
+  };
+}
+
+async function negotiate(client, retries, payload) {
+  try {
+    const response = await client.step(payload);
+    return response || '';
+  } catch (error) {
+    if (retries === 0) {
+      // Retries exhausted, raise error
+      throw error;
+    } // Adjust number of retries and call step again
+
+
+    return await negotiate(client, retries - 1, payload);
+  }
+}
+
+async function finalize(client, user, payload) {
+  // GSS Client Unwrap
+  const response = await client.unwrap(payload);
+  return await client.wrap(response || '', {
+    user
+  });
+}
+
+async function performGSSAPICanonicalizeHostName(host, mechanismProperties) {
+  const mode = mechanismProperties.CANONICALIZE_HOST_NAME;
+
+  if (!mode || mode === exports.GSSAPICanonicalizationValue.none) {
+    return host;
+  } // If forward and reverse or true
+
+
+  if (mode === exports.GSSAPICanonicalizationValue.on || mode === exports.GSSAPICanonicalizationValue.forwardAndReverse) {
+    // Perform the lookup of the ip address.
+    const {
+      address
+    } = await dns.promises.lookup(host);
+
+    try {
+      // Perform a reverse ptr lookup on the ip address.
+      const results = await dns.promises.resolvePtr(address); // If the ptr did not error but had no results, return the host.
+
+      return results.length > 0 ? results[0] : host;
+    } catch {
+      // This can error as ptr records may not exist for all ips. In this case
+      // fallback to a cname lookup as dns.lookup() does not return the
+      // cname.
+      return await resolveCname(host);
+    }
+  } else {
+    // The case for forward is just to resolve the cname as dns.lookup()
+    // will not return it.
+    return await resolveCname(host);
+  }
+}
+
+async function resolveCname(host) {
+  // Attempt to resolve the host name
+  try {
+    const results = await dns.promises.resolveCname(host); // Get the first resolved host id
+
+    return results.length > 0 ? results[0] : host;
+  } catch {
+    return host;
+  }
+}
+/**
+ * Load the Kerberos library.
+ */
+
+
+function loadKrb() {
+  if (!krb) {
+    krb = (0, deps_1.getKerberos)();
+  }
+}

package/transpiled/mongodb/lib/cmap/auth/mongo_credentials.js

@@ -0,0 +1,193 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.MongoCredentials = exports.DEFAULT_ALLOWED_HOSTS = void 0;
+
+const error_1 = require("../../error");
+
+const gssapi_1 = require("./gssapi");
+
+const providers_1 = require("./providers");
+/**
+ * @see https://github.com/mongodb/specifications/blob/master/source/auth/auth.md
+ */
+
+
+function getDefaultAuthMechanism(hello) {
+  if (hello) {
+    // If hello contains saslSupportedMechs, use scram-sha-256
+    // if it is available, else scram-sha-1
+    if (Array.isArray(hello.saslSupportedMechs)) {
+      return hello.saslSupportedMechs.includes(providers_1.AuthMechanism.MONGODB_SCRAM_SHA256) ? providers_1.AuthMechanism.MONGODB_SCRAM_SHA256 : providers_1.AuthMechanism.MONGODB_SCRAM_SHA1;
+    }
+  } // Default auth mechanism for 4.0 and higher.
+
+
+  return providers_1.AuthMechanism.MONGODB_SCRAM_SHA256;
+}
+
+const ALLOWED_ENVIRONMENT_NAMES = ['test', 'azure', 'gcp', 'k8s'];
+const ALLOWED_HOSTS_ERROR = 'Auth mechanism property ALLOWED_HOSTS must be an array of strings.';
+/** @internal */
+
+exports.DEFAULT_ALLOWED_HOSTS = ['*.mongodb.net', '*.mongodb-qa.net', '*.mongodb-dev.net', '*.mongodbgov.net', 'localhost', '127.0.0.1', '::1'];
+/** Error for when the token audience is missing in the environment. */
+
+const TOKEN_RESOURCE_MISSING_ERROR = 'TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is azure or gcp.';
+/**
+ * A representation of the credentials used by MongoDB
+ * @public
+ */
+
+class MongoCredentials {
+  constructor(options) {
+    this.username = options.username ?? '';
+    this.password = options.password;
+    this.source = options.source;
+
+    if (!this.source && options.db) {
+      this.source = options.db;
+    }
+
+    this.mechanism = options.mechanism || providers_1.AuthMechanism.MONGODB_DEFAULT;
+    this.mechanismProperties = options.mechanismProperties || {};
+
+    if (this.mechanism.match(/MONGODB-AWS/i)) {
+      if (!this.username && process.env.AWS_ACCESS_KEY_ID) {
+        this.username = process.env.AWS_ACCESS_KEY_ID;
+      }
+
+      if (!this.password && process.env.AWS_SECRET_ACCESS_KEY) {
+        this.password = process.env.AWS_SECRET_ACCESS_KEY;
+      }
+
+      if (this.mechanismProperties.AWS_SESSION_TOKEN == null && process.env.AWS_SESSION_TOKEN != null) {
+        this.mechanismProperties = { ...this.mechanismProperties,
+          AWS_SESSION_TOKEN: process.env.AWS_SESSION_TOKEN
+        };
+      }
+    }
+
+    if (this.mechanism === providers_1.AuthMechanism.MONGODB_OIDC && !this.mechanismProperties.ALLOWED_HOSTS) {
+      this.mechanismProperties = { ...this.mechanismProperties,
+        ALLOWED_HOSTS: exports.DEFAULT_ALLOWED_HOSTS
+      };
+    }
+
+    Object.freeze(this.mechanismProperties);
+    Object.freeze(this);
+  }
+  /** Determines if two MongoCredentials objects are equivalent */
+
+
+  equals(other) {
+    return this.mechanism === other.mechanism && this.username === other.username && this.password === other.password && this.source === other.source;
+  }
+  /**
+   * If the authentication mechanism is set to "default", resolves the authMechanism
+   * based on the server version and server supported sasl mechanisms.
+   *
+   * @param hello - A hello response from the server
+   */
+
+
+  resolveAuthMechanism(hello) {
+    // If the mechanism is not "default", then it does not need to be resolved
+    if (this.mechanism.match(/DEFAULT/i)) {
+      return new MongoCredentials({
+        username: this.username,
+        password: this.password,
+        source: this.source,
+        mechanism: getDefaultAuthMechanism(hello),
+        mechanismProperties: this.mechanismProperties
+      });
+    }
+
+    return this;
+  }
+
+  validate() {
+    if ((this.mechanism === providers_1.AuthMechanism.MONGODB_GSSAPI || this.mechanism === providers_1.AuthMechanism.MONGODB_PLAIN || this.mechanism === providers_1.AuthMechanism.MONGODB_SCRAM_SHA1 || this.mechanism === providers_1.AuthMechanism.MONGODB_SCRAM_SHA256) && !this.username) {
+      throw new error_1.MongoMissingCredentialsError(`Username required for mechanism '${this.mechanism}'`);
+    }
+
+    if (this.mechanism === providers_1.AuthMechanism.MONGODB_OIDC) {
+      if (this.username && this.mechanismProperties.ENVIRONMENT && this.mechanismProperties.ENVIRONMENT !== 'azure') {
+        throw new error_1.MongoInvalidArgumentError(`username and ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' may not be used together for mechanism '${this.mechanism}'.`);
+      }
+
+      if (this.username && this.password) {
+        throw new error_1.MongoInvalidArgumentError(`No password is allowed in ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' for '${this.mechanism}'.`);
+      }
+
+      if ((this.mechanismProperties.ENVIRONMENT === 'azure' || this.mechanismProperties.ENVIRONMENT === 'gcp') && !this.mechanismProperties.TOKEN_RESOURCE) {
+        throw new error_1.MongoInvalidArgumentError(TOKEN_RESOURCE_MISSING_ERROR);
+      }
+
+      if (this.mechanismProperties.ENVIRONMENT && !ALLOWED_ENVIRONMENT_NAMES.includes(this.mechanismProperties.ENVIRONMENT)) {
+        throw new error_1.MongoInvalidArgumentError(`Currently only a ENVIRONMENT in ${ALLOWED_ENVIRONMENT_NAMES.join(',')} is supported for mechanism '${this.mechanism}'.`);
+      }
+
+      if (!this.mechanismProperties.ENVIRONMENT && !this.mechanismProperties.OIDC_CALLBACK && !this.mechanismProperties.OIDC_HUMAN_CALLBACK) {
+        throw new error_1.MongoInvalidArgumentError(`Either a ENVIRONMENT, OIDC_CALLBACK, or OIDC_HUMAN_CALLBACK must be specified for mechanism '${this.mechanism}'.`);
+      }
+
+      if (this.mechanismProperties.ALLOWED_HOSTS) {
+        const hosts = this.mechanismProperties.ALLOWED_HOSTS;
+
+        if (!Array.isArray(hosts)) {
+          throw new error_1.MongoInvalidArgumentError(ALLOWED_HOSTS_ERROR);
+        }
+
+        for (const host of hosts) {
+          if (typeof host !== 'string') {
+            throw new error_1.MongoInvalidArgumentError(ALLOWED_HOSTS_ERROR);
+          }
+        }
+      }
+    }
+
+    if (providers_1.AUTH_MECHS_AUTH_SRC_EXTERNAL.has(this.mechanism)) {
+      if (this.source != null && this.source !== '$external') {
+        // TODO(NODE-3485): Replace this with a MongoAuthValidationError
+        throw new error_1.MongoAPIError(`Invalid source '${this.source}' for mechanism '${this.mechanism}' specified.`);
+      }
+    }
+
+    if (this.mechanism === providers_1.AuthMechanism.MONGODB_PLAIN && this.source == null) {
+      // TODO(NODE-3485): Replace this with a MongoAuthValidationError
+      throw new error_1.MongoAPIError('PLAIN Authentication Mechanism needs an auth source');
+    }
+
+    if (this.mechanism === providers_1.AuthMechanism.MONGODB_X509 && this.password != null) {
+      if (this.password === '') {
+        Reflect.set(this, 'password', undefined);
+        return;
+      } // TODO(NODE-3485): Replace this with a MongoAuthValidationError
+
+
+      throw new error_1.MongoAPIError(`Password not allowed for mechanism MONGODB-X509`);
+    }
+
+    const canonicalization = this.mechanismProperties.CANONICALIZE_HOST_NAME ?? false;
+
+    if (!Object.values(gssapi_1.GSSAPICanonicalizationValue).includes(canonicalization)) {
+      throw new error_1.MongoAPIError(`Invalid CANONICALIZE_HOST_NAME value: ${canonicalization}`);
+    }
+  }
+
+  static merge(creds, options) {
+    return new MongoCredentials({
+      username: options.username ?? creds?.username ?? '',
+      password: options.password ?? creds?.password ?? '',
+      mechanism: options.mechanism ?? creds?.mechanism ?? providers_1.AuthMechanism.MONGODB_DEFAULT,
+      mechanismProperties: options.mechanismProperties ?? creds?.mechanismProperties ?? {},
+      source: options.source ?? options.db ?? creds?.source ?? 'admin'
+    });
+  }
+
+}
+
+exports.MongoCredentials = MongoCredentials;