oxygen-cli 1.40.2-beta.1 → 1.41.0

package/transpiled/mongodb/lib/cmap/auth/aws_temporary_credentials.js

@@ -1,167 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.LegacyAWSTemporaryCredentialProvider = exports.AWSSDKCredentialProvider = exports.AWSTemporaryCredentialProvider = void 0;
-
-const deps_1 = require("../../deps");
-
-const error_1 = require("../../error");
-
-const utils_1 = require("../../utils");
-
-const AWS_RELATIVE_URI = 'http://169.254.170.2';
-const AWS_EC2_URI = 'http://169.254.169.254';
-const AWS_EC2_PATH = '/latest/meta-data/iam/security-credentials';
-/**
- * @internal
- *
- * Fetches temporary AWS credentials.
- */
-
-class AWSTemporaryCredentialProvider {
-  static get awsSDK() {
-    AWSTemporaryCredentialProvider._awsSDK ??= (0, deps_1.getAwsCredentialProvider)();
-    return AWSTemporaryCredentialProvider._awsSDK;
-  }
-
-  static get isAWSSDKInstalled() {
-    return !('kModuleError' in AWSTemporaryCredentialProvider.awsSDK);
-  }
-
-}
-
-exports.AWSTemporaryCredentialProvider = AWSTemporaryCredentialProvider;
-/** @internal */
-
-class AWSSDKCredentialProvider extends AWSTemporaryCredentialProvider {
-  /**
-   * Create the SDK credentials provider.
-   * @param credentialsProvider - The credentials provider.
-   */
-  constructor(credentialsProvider) {
-    super();
-
-    if (credentialsProvider) {
-      this._provider = credentialsProvider;
-    }
-  }
-  /**
-   * The AWS SDK caches credentials automatically and handles refresh when the credentials have expired.
-   * To ensure this occurs, we need to cache the `provider` returned by the AWS sdk and re-use it when fetching credentials.
-   */
-
-
-  get provider() {
-    if ('kModuleError' in AWSTemporaryCredentialProvider.awsSDK) {
-      throw AWSTemporaryCredentialProvider.awsSDK.kModuleError;
-    }
-
-    if (this._provider) {
-      return this._provider;
-    }
-
-    let {
-      AWS_STS_REGIONAL_ENDPOINTS = '',
-      AWS_REGION = ''
-    } = process.env;
-    AWS_STS_REGIONAL_ENDPOINTS = AWS_STS_REGIONAL_ENDPOINTS.toLowerCase();
-    AWS_REGION = AWS_REGION.toLowerCase();
-    /** The option setting should work only for users who have explicit settings in their environment, the driver should not encode "defaults" */
-
-    const awsRegionSettingsExist = AWS_REGION.length !== 0 && AWS_STS_REGIONAL_ENDPOINTS.length !== 0;
-    /**
-     * The following regions use the global AWS STS endpoint, sts.amazonaws.com, by default
-     * https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html
-     */
-
-    const LEGACY_REGIONS = new Set(['ap-northeast-1', 'ap-south-1', 'ap-southeast-1', 'ap-southeast-2', 'aws-global', 'ca-central-1', 'eu-central-1', 'eu-north-1', 'eu-west-1', 'eu-west-2', 'eu-west-3', 'sa-east-1', 'us-east-1', 'us-east-2', 'us-west-1', 'us-west-2']);
-    /**
-     * If AWS_STS_REGIONAL_ENDPOINTS is set to regional, users are opting into the new behavior of respecting the region settings
-     *
-     * If AWS_STS_REGIONAL_ENDPOINTS is set to legacy, then "old" regions need to keep using the global setting.
-     * Technically the SDK gets this wrong, it reaches out to 'sts.us-east-1.amazonaws.com' when it should be 'sts.amazonaws.com'.
-     * That is not our bug to fix here. We leave that up to the SDK.
-     */
-
-    const useRegionalSts = AWS_STS_REGIONAL_ENDPOINTS === 'regional' || AWS_STS_REGIONAL_ENDPOINTS === 'legacy' && !LEGACY_REGIONS.has(AWS_REGION);
-    this._provider = awsRegionSettingsExist && useRegionalSts ? AWSTemporaryCredentialProvider.awsSDK.fromNodeProviderChain({
-      clientConfig: {
-        region: AWS_REGION
-      }
-    }) : AWSTemporaryCredentialProvider.awsSDK.fromNodeProviderChain();
-    return this._provider;
-  }
-
-  async getCredentials() {
-    /*
-     * Creates a credential provider that will attempt to find credentials from the
-     * following sources (listed in order of precedence):
-     *
-     * - Environment variables exposed via process.env
-     * - SSO credentials from token cache
-     * - Web identity token credentials
-     * - Shared credentials and config ini files
-     * - The EC2/ECS Instance Metadata Service
-     */
-    try {
-      const creds = await this.provider();
-      return {
-        AccessKeyId: creds.accessKeyId,
-        SecretAccessKey: creds.secretAccessKey,
-        Token: creds.sessionToken,
-        Expiration: creds.expiration
-      };
-    } catch (error) {
-      throw new error_1.MongoAWSError(error.message, {
-        cause: error
-      });
-    }
-  }
-
-}
-
-exports.AWSSDKCredentialProvider = AWSSDKCredentialProvider;
-/**
- * @internal
- * Fetches credentials manually (without the AWS SDK), as outlined in the [Obtaining Credentials](https://github.com/mongodb/specifications/blob/master/source/auth/auth.md#obtaining-credentials)
- * section of the Auth spec.
- */
-
-class LegacyAWSTemporaryCredentialProvider extends AWSTemporaryCredentialProvider {
-  async getCredentials() {
-    // If the environment variable AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
-    // is set then drivers MUST assume that it was set by an AWS ECS agent
-    if (process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI) {
-      return await (0, utils_1.request)(`${AWS_RELATIVE_URI}${process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI}`);
-    } // Otherwise assume we are on an EC2 instance
-    // get a token
-
-
-    const token = await (0, utils_1.request)(`${AWS_EC2_URI}/latest/api/token`, {
-      method: 'PUT',
-      json: false,
-      headers: {
-        'X-aws-ec2-metadata-token-ttl-seconds': 30
-      }
-    }); // get role name
-
-    const roleName = await (0, utils_1.request)(`${AWS_EC2_URI}/${AWS_EC2_PATH}`, {
-      json: false,
-      headers: {
-        'X-aws-ec2-metadata-token': token
-      }
-    }); // get temp credentials
-
-    const creds = await (0, utils_1.request)(`${AWS_EC2_URI}/${AWS_EC2_PATH}/${roleName}`, {
-      headers: {
-        'X-aws-ec2-metadata-token': token
-      }
-    });
-    return creds;
-  }
-
-}
-
-exports.LegacyAWSTemporaryCredentialProvider = LegacyAWSTemporaryCredentialProvider;

package/transpiled/mongodb/lib/cmap/auth/gssapi.js

@@ -1,207 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.GSSAPI = exports.GSSAPICanonicalizationValue = void 0;
-exports.performGSSAPICanonicalizeHostName = performGSSAPICanonicalizeHostName;
-exports.resolveCname = resolveCname;
-
-const dns = require("dns");
-
-const deps_1 = require("../../deps");
-
-const error_1 = require("../../error");
-
-const utils_1 = require("../../utils");
-
-const auth_provider_1 = require("./auth_provider");
-/** @public */
-
-
-exports.GSSAPICanonicalizationValue = Object.freeze({
-  on: true,
-  off: false,
-  none: 'none',
-  forward: 'forward',
-  forwardAndReverse: 'forwardAndReverse'
-});
-
-async function externalCommand(connection, command) {
-  const response = await connection.command((0, utils_1.ns)('$external.$cmd'), command);
-  return response;
-}
-
-let krb;
-
-class GSSAPI extends auth_provider_1.AuthProvider {
-  async auth(authContext) {
-    const {
-      connection,
-      credentials
-    } = authContext;
-
-    if (credentials == null) {
-      throw new error_1.MongoMissingCredentialsError('Credentials required for GSSAPI authentication');
-    }
-
-    const {
-      username
-    } = credentials;
-    const client = await makeKerberosClient(authContext);
-    const payload = await client.step('');
-    const saslStartResponse = await externalCommand(connection, saslStart(payload));
-    const negotiatedPayload = await negotiate(client, 10, saslStartResponse.payload);
-    const saslContinueResponse = await externalCommand(connection, saslContinue(negotiatedPayload, saslStartResponse.conversationId));
-    const finalizePayload = await finalize(client, username, saslContinueResponse.payload);
-    await externalCommand(connection, {
-      saslContinue: 1,
-      conversationId: saslContinueResponse.conversationId,
-      payload: finalizePayload
-    });
-  }
-
-}
-
-exports.GSSAPI = GSSAPI;
-
-async function makeKerberosClient(authContext) {
-  const {
-    hostAddress
-  } = authContext.options;
-  const {
-    credentials
-  } = authContext;
-
-  if (!hostAddress || typeof hostAddress.host !== 'string' || !credentials) {
-    throw new error_1.MongoInvalidArgumentError('Connection must have host and port and credentials defined.');
-  }
-
-  loadKrb();
-
-  if ('kModuleError' in krb) {
-    throw krb['kModuleError'];
-  }
-
-  const {
-    initializeClient
-  } = krb;
-  const {
-    username,
-    password
-  } = credentials;
-  const mechanismProperties = credentials.mechanismProperties;
-  const serviceName = mechanismProperties.SERVICE_NAME ?? 'mongodb';
-  const host = await performGSSAPICanonicalizeHostName(hostAddress.host, mechanismProperties);
-  const initOptions = {};
-
-  if (password != null) {
-    // TODO(NODE-5139): These do not match the typescript options in initializeClient
-    Object.assign(initOptions, {
-      user: username,
-      password: password
-    });
-  }
-
-  const spnHost = mechanismProperties.SERVICE_HOST ?? host;
-  let spn = `${serviceName}${process.platform === 'win32' ? '/' : '@'}${spnHost}`;
-
-  if ('SERVICE_REALM' in mechanismProperties) {
-    spn = `${spn}@${mechanismProperties.SERVICE_REALM}`;
-  }
-
-  return await initializeClient(spn, initOptions);
-}
-
-function saslStart(payload) {
-  return {
-    saslStart: 1,
-    mechanism: 'GSSAPI',
-    payload,
-    autoAuthorize: 1
-  };
-}
-
-function saslContinue(payload, conversationId) {
-  return {
-    saslContinue: 1,
-    conversationId,
-    payload
-  };
-}
-
-async function negotiate(client, retries, payload) {
-  try {
-    const response = await client.step(payload);
-    return response || '';
-  } catch (error) {
-    if (retries === 0) {
-      // Retries exhausted, raise error
-      throw error;
-    } // Adjust number of retries and call step again
-
-
-    return await negotiate(client, retries - 1, payload);
-  }
-}
-
-async function finalize(client, user, payload) {
-  // GSS Client Unwrap
-  const response = await client.unwrap(payload);
-  return await client.wrap(response || '', {
-    user
-  });
-}
-
-async function performGSSAPICanonicalizeHostName(host, mechanismProperties) {
-  const mode = mechanismProperties.CANONICALIZE_HOST_NAME;
-
-  if (!mode || mode === exports.GSSAPICanonicalizationValue.none) {
-    return host;
-  } // If forward and reverse or true
-
-
-  if (mode === exports.GSSAPICanonicalizationValue.on || mode === exports.GSSAPICanonicalizationValue.forwardAndReverse) {
-    // Perform the lookup of the ip address.
-    const {
-      address
-    } = await dns.promises.lookup(host);
-
-    try {
-      // Perform a reverse ptr lookup on the ip address.
-      const results = await dns.promises.resolvePtr(address); // If the ptr did not error but had no results, return the host.
-
-      return results.length > 0 ? results[0] : host;
-    } catch {
-      // This can error as ptr records may not exist for all ips. In this case
-      // fallback to a cname lookup as dns.lookup() does not return the
-      // cname.
-      return await resolveCname(host);
-    }
-  } else {
-    // The case for forward is just to resolve the cname as dns.lookup()
-    // will not return it.
-    return await resolveCname(host);
-  }
-}
-
-async function resolveCname(host) {
-  // Attempt to resolve the host name
-  try {
-    const results = await dns.promises.resolveCname(host); // Get the first resolved host id
-
-    return results.length > 0 ? results[0] : host;
-  } catch {
-    return host;
-  }
-}
-/**
- * Load the Kerberos library.
- */
-
-
-function loadKrb() {
-  if (!krb) {
-    krb = (0, deps_1.getKerberos)();
-  }
-}

package/transpiled/mongodb/lib/cmap/auth/mongo_credentials.js

@@ -1,193 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.MongoCredentials = exports.DEFAULT_ALLOWED_HOSTS = void 0;
-
-const error_1 = require("../../error");
-
-const gssapi_1 = require("./gssapi");
-
-const providers_1 = require("./providers");
-/**
- * @see https://github.com/mongodb/specifications/blob/master/source/auth/auth.md
- */
-
-
-function getDefaultAuthMechanism(hello) {
-  if (hello) {
-    // If hello contains saslSupportedMechs, use scram-sha-256
-    // if it is available, else scram-sha-1
-    if (Array.isArray(hello.saslSupportedMechs)) {
-      return hello.saslSupportedMechs.includes(providers_1.AuthMechanism.MONGODB_SCRAM_SHA256) ? providers_1.AuthMechanism.MONGODB_SCRAM_SHA256 : providers_1.AuthMechanism.MONGODB_SCRAM_SHA1;
-    }
-  } // Default auth mechanism for 4.0 and higher.
-
-
-  return providers_1.AuthMechanism.MONGODB_SCRAM_SHA256;
-}
-
-const ALLOWED_ENVIRONMENT_NAMES = ['test', 'azure', 'gcp', 'k8s'];
-const ALLOWED_HOSTS_ERROR = 'Auth mechanism property ALLOWED_HOSTS must be an array of strings.';
-/** @internal */
-
-exports.DEFAULT_ALLOWED_HOSTS = ['*.mongodb.net', '*.mongodb-qa.net', '*.mongodb-dev.net', '*.mongodbgov.net', 'localhost', '127.0.0.1', '::1'];
-/** Error for when the token audience is missing in the environment. */
-
-const TOKEN_RESOURCE_MISSING_ERROR = 'TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is azure or gcp.';
-/**
- * A representation of the credentials used by MongoDB
- * @public
- */
-
-class MongoCredentials {
-  constructor(options) {
-    this.username = options.username ?? '';
-    this.password = options.password;
-    this.source = options.source;
-
-    if (!this.source && options.db) {
-      this.source = options.db;
-    }
-
-    this.mechanism = options.mechanism || providers_1.AuthMechanism.MONGODB_DEFAULT;
-    this.mechanismProperties = options.mechanismProperties || {};
-
-    if (this.mechanism.match(/MONGODB-AWS/i)) {
-      if (!this.username && process.env.AWS_ACCESS_KEY_ID) {
-        this.username = process.env.AWS_ACCESS_KEY_ID;
-      }
-
-      if (!this.password && process.env.AWS_SECRET_ACCESS_KEY) {
-        this.password = process.env.AWS_SECRET_ACCESS_KEY;
-      }
-
-      if (this.mechanismProperties.AWS_SESSION_TOKEN == null && process.env.AWS_SESSION_TOKEN != null) {
-        this.mechanismProperties = { ...this.mechanismProperties,
-          AWS_SESSION_TOKEN: process.env.AWS_SESSION_TOKEN
-        };
-      }
-    }
-
-    if (this.mechanism === providers_1.AuthMechanism.MONGODB_OIDC && !this.mechanismProperties.ALLOWED_HOSTS) {
-      this.mechanismProperties = { ...this.mechanismProperties,
-        ALLOWED_HOSTS: exports.DEFAULT_ALLOWED_HOSTS
-      };
-    }
-
-    Object.freeze(this.mechanismProperties);
-    Object.freeze(this);
-  }
-  /** Determines if two MongoCredentials objects are equivalent */
-
-
-  equals(other) {
-    return this.mechanism === other.mechanism && this.username === other.username && this.password === other.password && this.source === other.source;
-  }
-  /**
-   * If the authentication mechanism is set to "default", resolves the authMechanism
-   * based on the server version and server supported sasl mechanisms.
-   *
-   * @param hello - A hello response from the server
-   */
-
-
-  resolveAuthMechanism(hello) {
-    // If the mechanism is not "default", then it does not need to be resolved
-    if (this.mechanism.match(/DEFAULT/i)) {
-      return new MongoCredentials({
-        username: this.username,
-        password: this.password,
-        source: this.source,
-        mechanism: getDefaultAuthMechanism(hello),
-        mechanismProperties: this.mechanismProperties
-      });
-    }
-
-    return this;
-  }
-
-  validate() {
-    if ((this.mechanism === providers_1.AuthMechanism.MONGODB_GSSAPI || this.mechanism === providers_1.AuthMechanism.MONGODB_PLAIN || this.mechanism === providers_1.AuthMechanism.MONGODB_SCRAM_SHA1 || this.mechanism === providers_1.AuthMechanism.MONGODB_SCRAM_SHA256) && !this.username) {
-      throw new error_1.MongoMissingCredentialsError(`Username required for mechanism '${this.mechanism}'`);
-    }
-
-    if (this.mechanism === providers_1.AuthMechanism.MONGODB_OIDC) {
-      if (this.username && this.mechanismProperties.ENVIRONMENT && this.mechanismProperties.ENVIRONMENT !== 'azure') {
-        throw new error_1.MongoInvalidArgumentError(`username and ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' may not be used together for mechanism '${this.mechanism}'.`);
-      }
-
-      if (this.username && this.password) {
-        throw new error_1.MongoInvalidArgumentError(`No password is allowed in ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' for '${this.mechanism}'.`);
-      }
-
-      if ((this.mechanismProperties.ENVIRONMENT === 'azure' || this.mechanismProperties.ENVIRONMENT === 'gcp') && !this.mechanismProperties.TOKEN_RESOURCE) {
-        throw new error_1.MongoInvalidArgumentError(TOKEN_RESOURCE_MISSING_ERROR);
-      }
-
-      if (this.mechanismProperties.ENVIRONMENT && !ALLOWED_ENVIRONMENT_NAMES.includes(this.mechanismProperties.ENVIRONMENT)) {
-        throw new error_1.MongoInvalidArgumentError(`Currently only a ENVIRONMENT in ${ALLOWED_ENVIRONMENT_NAMES.join(',')} is supported for mechanism '${this.mechanism}'.`);
-      }
-
-      if (!this.mechanismProperties.ENVIRONMENT && !this.mechanismProperties.OIDC_CALLBACK && !this.mechanismProperties.OIDC_HUMAN_CALLBACK) {
-        throw new error_1.MongoInvalidArgumentError(`Either a ENVIRONMENT, OIDC_CALLBACK, or OIDC_HUMAN_CALLBACK must be specified for mechanism '${this.mechanism}'.`);
-      }
-
-      if (this.mechanismProperties.ALLOWED_HOSTS) {
-        const hosts = this.mechanismProperties.ALLOWED_HOSTS;
-
-        if (!Array.isArray(hosts)) {
-          throw new error_1.MongoInvalidArgumentError(ALLOWED_HOSTS_ERROR);
-        }
-
-        for (const host of hosts) {
-          if (typeof host !== 'string') {
-            throw new error_1.MongoInvalidArgumentError(ALLOWED_HOSTS_ERROR);
-          }
-        }
-      }
-    }
-
-    if (providers_1.AUTH_MECHS_AUTH_SRC_EXTERNAL.has(this.mechanism)) {
-      if (this.source != null && this.source !== '$external') {
-        // TODO(NODE-3485): Replace this with a MongoAuthValidationError
-        throw new error_1.MongoAPIError(`Invalid source '${this.source}' for mechanism '${this.mechanism}' specified.`);
-      }
-    }
-
-    if (this.mechanism === providers_1.AuthMechanism.MONGODB_PLAIN && this.source == null) {
-      // TODO(NODE-3485): Replace this with a MongoAuthValidationError
-      throw new error_1.MongoAPIError('PLAIN Authentication Mechanism needs an auth source');
-    }
-
-    if (this.mechanism === providers_1.AuthMechanism.MONGODB_X509 && this.password != null) {
-      if (this.password === '') {
-        Reflect.set(this, 'password', undefined);
-        return;
-      } // TODO(NODE-3485): Replace this with a MongoAuthValidationError
-
-
-      throw new error_1.MongoAPIError(`Password not allowed for mechanism MONGODB-X509`);
-    }
-
-    const canonicalization = this.mechanismProperties.CANONICALIZE_HOST_NAME ?? false;
-
-    if (!Object.values(gssapi_1.GSSAPICanonicalizationValue).includes(canonicalization)) {
-      throw new error_1.MongoAPIError(`Invalid CANONICALIZE_HOST_NAME value: ${canonicalization}`);
-    }
-  }
-
-  static merge(creds, options) {
-    return new MongoCredentials({
-      username: options.username ?? creds?.username ?? '',
-      password: options.password ?? creds?.password ?? '',
-      mechanism: options.mechanism ?? creds?.mechanism ?? providers_1.AuthMechanism.MONGODB_DEFAULT,
-      mechanismProperties: options.mechanismProperties ?? creds?.mechanismProperties ?? {},
-      source: options.source ?? options.db ?? creds?.source ?? 'admin'
-    });
-  }
-
-}
-
-exports.MongoCredentials = MongoCredentials;