stockhub-sms 1.0.0

package/backend-project/node_modules/mongodb/src/cmap/auth/auth_provider.ts

@@ -0,0 +1,73 @@
+import type { Document } from '../../bson';
+import { MongoRuntimeError } from '../../error';
+import type { HandshakeDocument } from '../connect';
+import type { Connection, ConnectionOptions } from '../connection';
+import type { MongoCredentials } from './mongo_credentials';
+
+/**
+ * Context used during authentication
+ * @internal
+ */
+export class AuthContext {
+  /** The connection to authenticate */
+  connection: Connection;
+  /** The credentials to use for authentication */
+  credentials?: MongoCredentials;
+  /** If the context is for reauthentication. */
+  reauthenticating = false;
+  /** The options passed to the `connect` method */
+  options: ConnectionOptions;
+
+  /** A response from an initial auth attempt, only some mechanisms use this (e.g, SCRAM) */
+  response?: Document;
+  /** A random nonce generated for use in an authentication conversation */
+  nonce?: Buffer;
+
+  constructor(
+    connection: Connection,
+    credentials: MongoCredentials | undefined,
+    options: ConnectionOptions
+  ) {
+    this.connection = connection;
+    this.credentials = credentials;
+    this.options = options;
+  }
+}
+
+export abstract class AuthProvider {
+  /**
+   * Prepare the handshake document before the initial handshake.
+   *
+   * @param handshakeDoc - The document used for the initial handshake on a connection
+   * @param authContext - Context for authentication flow
+   */
+  async prepare(
+    handshakeDoc: HandshakeDocument,
+    _authContext: AuthContext
+  ): Promise<HandshakeDocument> {
+    return handshakeDoc;
+  }
+
+  /**
+   * Authenticate
+   *
+   * @param context - A shared context for authentication flow
+   */
+  abstract auth(context: AuthContext): Promise<void>;
+
+  /**
+   * Reauthenticate.
+   * @param context - The shared auth context.
+   */
+  async reauth(context: AuthContext): Promise<void> {
+    if (context.reauthenticating) {
+      throw new MongoRuntimeError('Reauthentication already in progress.');
+    }
+    try {
+      context.reauthenticating = true;
+      await this.auth(context);
+    } finally {
+      context.reauthenticating = false;
+    }
+  }
+}

package/backend-project/node_modules/mongodb/src/cmap/auth/gssapi.ts

@@ -0,0 +1,204 @@
+import * as dns from 'dns';
+
+import { getKerberos, type Kerberos, type KerberosClient } from '../../deps';
+import { MongoInvalidArgumentError, MongoMissingCredentialsError } from '../../error';
+import { ns } from '../../utils';
+import type { Connection } from '../connection';
+import { type AuthContext, AuthProvider } from './auth_provider';
+
+/** @public */
+export const GSSAPICanonicalizationValue = Object.freeze({
+  on: true,
+  off: false,
+  none: 'none',
+  forward: 'forward',
+  forwardAndReverse: 'forwardAndReverse'
+} as const);
+
+/** @public */
+export type GSSAPICanonicalizationValue =
+  (typeof GSSAPICanonicalizationValue)[keyof typeof GSSAPICanonicalizationValue];
+
+type MechanismProperties = {
+  CANONICALIZE_HOST_NAME?: GSSAPICanonicalizationValue;
+  SERVICE_HOST?: string;
+  SERVICE_NAME?: string;
+  SERVICE_REALM?: string;
+};
+
+async function externalCommand(
+  connection: Connection,
+  command: ReturnType<typeof saslStart> | ReturnType<typeof saslContinue>
+): Promise<{ payload: string; conversationId: any }> {
+  return connection.commandAsync(ns('$external.$cmd'), command, undefined) as Promise<{
+    payload: string;
+    conversationId: any;
+  }>;
+}
+
+let krb: typeof Kerberos;
+
+export class GSSAPI extends AuthProvider {
+  override async auth(authContext: AuthContext): Promise<void> {
+    const { connection, credentials } = authContext;
+    if (credentials == null) {
+      throw new MongoMissingCredentialsError('Credentials required for GSSAPI authentication');
+    }
+
+    const { username } = credentials;
+
+    const client = await makeKerberosClient(authContext);
+
+    const payload = await client.step('');
+
+    const saslStartResponse = await externalCommand(connection, saslStart(payload));
+
+    const negotiatedPayload = await negotiate(client, 10, saslStartResponse.payload);
+
+    const saslContinueResponse = await externalCommand(
+      connection,
+      saslContinue(negotiatedPayload, saslStartResponse.conversationId)
+    );
+
+    const finalizePayload = await finalize(client, username, saslContinueResponse.payload);
+
+    await externalCommand(connection, {
+      saslContinue: 1,
+      conversationId: saslContinueResponse.conversationId,
+      payload: finalizePayload
+    });
+  }
+}
+
+async function makeKerberosClient(authContext: AuthContext): Promise<KerberosClient> {
+  const { hostAddress } = authContext.options;
+  const { credentials } = authContext;
+  if (!hostAddress || typeof hostAddress.host !== 'string' || !credentials) {
+    throw new MongoInvalidArgumentError(
+      'Connection must have host and port and credentials defined.'
+    );
+  }
+
+  loadKrb();
+  if ('kModuleError' in krb) {
+    throw krb['kModuleError'];
+  }
+  const { initializeClient } = krb;
+
+  const { username, password } = credentials;
+  const mechanismProperties = credentials.mechanismProperties as MechanismProperties;
+
+  const serviceName = mechanismProperties.SERVICE_NAME ?? 'mongodb';
+
+  const host = await performGSSAPICanonicalizeHostName(hostAddress.host, mechanismProperties);
+
+  const initOptions = {};
+  if (password != null) {
+    // TODO(NODE-5139): These do not match the typescript options in initializeClient
+    Object.assign(initOptions, { user: username, password: password });
+  }
+
+  const spnHost = mechanismProperties.SERVICE_HOST ?? host;
+  let spn = `${serviceName}${process.platform === 'win32' ? '/' : '@'}${spnHost}`;
+  if ('SERVICE_REALM' in mechanismProperties) {
+    spn = `${spn}@${mechanismProperties.SERVICE_REALM}`;
+  }
+
+  return initializeClient(spn, initOptions);
+}
+
+function saslStart(payload: string) {
+  return {
+    saslStart: 1,
+    mechanism: 'GSSAPI',
+    payload,
+    autoAuthorize: 1
+  } as const;
+}
+
+function saslContinue(payload: string, conversationId: number) {
+  return {
+    saslContinue: 1,
+    conversationId,
+    payload
+  } as const;
+}
+
+async function negotiate(
+  client: KerberosClient,
+  retries: number,
+  payload: string
+): Promise<string> {
+  try {
+    const response = await client.step(payload);
+    return response || '';
+  } catch (error) {
+    if (retries === 0) {
+      // Retries exhausted, raise error
+      throw error;
+    }
+    // Adjust number of retries and call step again
+    return negotiate(client, retries - 1, payload);
+  }
+}
+
+async function finalize(client: KerberosClient, user: string, payload: string): Promise<string> {
+  // GSS Client Unwrap
+  const response = await client.unwrap(payload);
+  return client.wrap(response || '', { user });
+}
+
+export async function performGSSAPICanonicalizeHostName(
+  host: string,
+  mechanismProperties: MechanismProperties
+): Promise<string> {
+  const mode = mechanismProperties.CANONICALIZE_HOST_NAME;
+  if (!mode || mode === GSSAPICanonicalizationValue.none) {
+    return host;
+  }
+
+  // If forward and reverse or true
+  if (
+    mode === GSSAPICanonicalizationValue.on ||
+    mode === GSSAPICanonicalizationValue.forwardAndReverse
+  ) {
+    // Perform the lookup of the ip address.
+    const { address } = await dns.promises.lookup(host);
+
+    try {
+      // Perform a reverse ptr lookup on the ip address.
+      const results = await dns.promises.resolvePtr(address);
+      // If the ptr did not error but had no results, return the host.
+      return results.length > 0 ? results[0] : host;
+    } catch (error) {
+      // This can error as ptr records may not exist for all ips. In this case
+      // fallback to a cname lookup as dns.lookup() does not return the
+      // cname.
+      return resolveCname(host);
+    }
+  } else {
+    // The case for forward is just to resolve the cname as dns.lookup()
+    // will not return it.
+    return resolveCname(host);
+  }
+}
+
+export async function resolveCname(host: string): Promise<string> {
+  // Attempt to resolve the host name
+  try {
+    const results = await dns.promises.resolveCname(host);
+    // Get the first resolved host id
+    return results.length > 0 ? results[0] : host;
+  } catch {
+    return host;
+  }
+}
+
+/**
+ * Load the Kerberos library.
+ */
+function loadKrb() {
+  if (!krb) {
+    krb = getKerberos();
+  }
+}

package/backend-project/node_modules/mongodb/src/cmap/auth/mongo_credentials.ts

@@ -0,0 +1,278 @@
+// Resolves the default auth mechanism according to
+// Resolves the default auth mechanism according to
+import type { Document } from '../../bson';
+import {
+  MongoAPIError,
+  MongoAzureError,
+  MongoInvalidArgumentError,
+  MongoMissingCredentialsError
+} from '../../error';
+import { GSSAPICanonicalizationValue } from './gssapi';
+import type { OIDCRefreshFunction, OIDCRequestFunction } from './mongodb_oidc';
+import { AUTH_MECHS_AUTH_SRC_EXTERNAL, AuthMechanism } from './providers';
+
+// https://github.com/mongodb/specifications/blob/master/source/auth/auth.rst
+function getDefaultAuthMechanism(hello?: Document): AuthMechanism {
+  if (hello) {
+    // If hello contains saslSupportedMechs, use scram-sha-256
+    // if it is available, else scram-sha-1
+    if (Array.isArray(hello.saslSupportedMechs)) {
+      return hello.saslSupportedMechs.includes(AuthMechanism.MONGODB_SCRAM_SHA256)
+        ? AuthMechanism.MONGODB_SCRAM_SHA256
+        : AuthMechanism.MONGODB_SCRAM_SHA1;
+    }
+
+    // Fallback to legacy selection method. If wire version >= 3, use scram-sha-1
+    if (hello.maxWireVersion >= 3) {
+      return AuthMechanism.MONGODB_SCRAM_SHA1;
+    }
+  }
+
+  // Default for wireprotocol < 3
+  return AuthMechanism.MONGODB_CR;
+}
+
+const ALLOWED_PROVIDER_NAMES: AuthMechanismProperties['PROVIDER_NAME'][] = ['aws', 'azure'];
+const ALLOWED_HOSTS_ERROR = 'Auth mechanism property ALLOWED_HOSTS must be an array of strings.';
+
+/** @internal */
+export const DEFAULT_ALLOWED_HOSTS = [
+  '*.mongodb.net',
+  '*.mongodb-dev.net',
+  '*.mongodbgov.net',
+  'localhost',
+  '127.0.0.1',
+  '::1'
+];
+
+/** Error for when the token audience is missing in the environment. */
+const TOKEN_AUDIENCE_MISSING_ERROR =
+  'TOKEN_AUDIENCE must be set in the auth mechanism properties when PROVIDER_NAME is azure.';
+
+/** @public */
+export interface AuthMechanismProperties extends Document {
+  SERVICE_HOST?: string;
+  SERVICE_NAME?: string;
+  SERVICE_REALM?: string;
+  CANONICALIZE_HOST_NAME?: GSSAPICanonicalizationValue;
+  AWS_SESSION_TOKEN?: string;
+  /** @experimental */
+  REQUEST_TOKEN_CALLBACK?: OIDCRequestFunction;
+  /** @experimental */
+  REFRESH_TOKEN_CALLBACK?: OIDCRefreshFunction;
+  /** @experimental */
+  PROVIDER_NAME?: 'aws' | 'azure';
+  /** @experimental */
+  ALLOWED_HOSTS?: string[];
+  /** @experimental */
+  TOKEN_AUDIENCE?: string;
+}
+
+/** @public */
+export interface MongoCredentialsOptions {
+  username?: string;
+  password: string;
+  source: string;
+  db?: string;
+  mechanism?: AuthMechanism;
+  mechanismProperties: AuthMechanismProperties;
+}
+
+/**
+ * A representation of the credentials used by MongoDB
+ * @public
+ */
+export class MongoCredentials {
+  /** The username used for authentication */
+  readonly username: string;
+  /** The password used for authentication */
+  readonly password: string;
+  /** The database that the user should authenticate against */
+  readonly source: string;
+  /** The method used to authenticate */
+  readonly mechanism: AuthMechanism;
+  /** Special properties used by some types of auth mechanisms */
+  readonly mechanismProperties: AuthMechanismProperties;
+
+  constructor(options: MongoCredentialsOptions) {
+    this.username = options.username ?? '';
+    this.password = options.password;
+    this.source = options.source;
+    if (!this.source && options.db) {
+      this.source = options.db;
+    }
+    this.mechanism = options.mechanism || AuthMechanism.MONGODB_DEFAULT;
+    this.mechanismProperties = options.mechanismProperties || {};
+
+    if (this.mechanism.match(/MONGODB-AWS/i)) {
+      if (!this.username && process.env.AWS_ACCESS_KEY_ID) {
+        this.username = process.env.AWS_ACCESS_KEY_ID;
+      }
+
+      if (!this.password && process.env.AWS_SECRET_ACCESS_KEY) {
+        this.password = process.env.AWS_SECRET_ACCESS_KEY;
+      }
+
+      if (
+        this.mechanismProperties.AWS_SESSION_TOKEN == null &&
+        process.env.AWS_SESSION_TOKEN != null
+      ) {
+        this.mechanismProperties = {
+          ...this.mechanismProperties,
+          AWS_SESSION_TOKEN: process.env.AWS_SESSION_TOKEN
+        };
+      }
+    }
+
+    if (this.mechanism === AuthMechanism.MONGODB_OIDC && !this.mechanismProperties.ALLOWED_HOSTS) {
+      this.mechanismProperties = {
+        ...this.mechanismProperties,
+        ALLOWED_HOSTS: DEFAULT_ALLOWED_HOSTS
+      };
+    }
+
+    Object.freeze(this.mechanismProperties);
+    Object.freeze(this);
+  }
+
+  /** Determines if two MongoCredentials objects are equivalent */
+  equals(other: MongoCredentials): boolean {
+    return (
+      this.mechanism === other.mechanism &&
+      this.username === other.username &&
+      this.password === other.password &&
+      this.source === other.source
+    );
+  }
+
+  /**
+   * If the authentication mechanism is set to "default", resolves the authMechanism
+   * based on the server version and server supported sasl mechanisms.
+   *
+   * @param hello - A hello response from the server
+   */
+  resolveAuthMechanism(hello?: Document): MongoCredentials {
+    // If the mechanism is not "default", then it does not need to be resolved
+    if (this.mechanism.match(/DEFAULT/i)) {
+      return new MongoCredentials({
+        username: this.username,
+        password: this.password,
+        source: this.source,
+        mechanism: getDefaultAuthMechanism(hello),
+        mechanismProperties: this.mechanismProperties
+      });
+    }
+
+    return this;
+  }
+
+  validate(): void {
+    if (
+      (this.mechanism === AuthMechanism.MONGODB_GSSAPI ||
+        this.mechanism === AuthMechanism.MONGODB_CR ||
+        this.mechanism === AuthMechanism.MONGODB_PLAIN ||
+        this.mechanism === AuthMechanism.MONGODB_SCRAM_SHA1 ||
+        this.mechanism === AuthMechanism.MONGODB_SCRAM_SHA256) &&
+      !this.username
+    ) {
+      throw new MongoMissingCredentialsError(`Username required for mechanism '${this.mechanism}'`);
+    }
+
+    if (this.mechanism === AuthMechanism.MONGODB_OIDC) {
+      if (this.username && this.mechanismProperties.PROVIDER_NAME) {
+        throw new MongoInvalidArgumentError(
+          `username and PROVIDER_NAME may not be used together for mechanism '${this.mechanism}'.`
+        );
+      }
+
+      if (
+        this.mechanismProperties.PROVIDER_NAME === 'azure' &&
+        !this.mechanismProperties.TOKEN_AUDIENCE
+      ) {
+        throw new MongoAzureError(TOKEN_AUDIENCE_MISSING_ERROR);
+      }
+
+      if (
+        this.mechanismProperties.PROVIDER_NAME &&
+        !ALLOWED_PROVIDER_NAMES.includes(this.mechanismProperties.PROVIDER_NAME)
+      ) {
+        throw new MongoInvalidArgumentError(
+          `Currently only a PROVIDER_NAME in ${ALLOWED_PROVIDER_NAMES.join(
+            ','
+          )} is supported for mechanism '${this.mechanism}'.`
+        );
+      }
+
+      if (
+        this.mechanismProperties.REFRESH_TOKEN_CALLBACK &&
+        !this.mechanismProperties.REQUEST_TOKEN_CALLBACK
+      ) {
+        throw new MongoInvalidArgumentError(
+          `A REQUEST_TOKEN_CALLBACK must be provided when using a REFRESH_TOKEN_CALLBACK for mechanism '${this.mechanism}'`
+        );
+      }
+
+      if (
+        !this.mechanismProperties.PROVIDER_NAME &&
+        !this.mechanismProperties.REQUEST_TOKEN_CALLBACK
+      ) {
+        throw new MongoInvalidArgumentError(
+          `Either a PROVIDER_NAME or a REQUEST_TOKEN_CALLBACK must be specified for mechanism '${this.mechanism}'.`
+        );
+      }
+
+      if (this.mechanismProperties.ALLOWED_HOSTS) {
+        const hosts = this.mechanismProperties.ALLOWED_HOSTS;
+        if (!Array.isArray(hosts)) {
+          throw new MongoInvalidArgumentError(ALLOWED_HOSTS_ERROR);
+        }
+        for (const host of hosts) {
+          if (typeof host !== 'string') {
+            throw new MongoInvalidArgumentError(ALLOWED_HOSTS_ERROR);
+          }
+        }
+      }
+    }
+
+    if (AUTH_MECHS_AUTH_SRC_EXTERNAL.has(this.mechanism)) {
+      if (this.source != null && this.source !== '$external') {
+        // TODO(NODE-3485): Replace this with a MongoAuthValidationError
+        throw new MongoAPIError(
+          `Invalid source '${this.source}' for mechanism '${this.mechanism}' specified.`
+        );
+      }
+    }
+
+    if (this.mechanism === AuthMechanism.MONGODB_PLAIN && this.source == null) {
+      // TODO(NODE-3485): Replace this with a MongoAuthValidationError
+      throw new MongoAPIError('PLAIN Authentication Mechanism needs an auth source');
+    }
+
+    if (this.mechanism === AuthMechanism.MONGODB_X509 && this.password != null) {
+      if (this.password === '') {
+        Reflect.set(this, 'password', undefined);
+        return;
+      }
+      // TODO(NODE-3485): Replace this with a MongoAuthValidationError
+      throw new MongoAPIError(`Password not allowed for mechanism MONGODB-X509`);
+    }
+
+    const canonicalization = this.mechanismProperties.CANONICALIZE_HOST_NAME ?? false;
+    if (!Object.values(GSSAPICanonicalizationValue).includes(canonicalization)) {
+      throw new MongoAPIError(`Invalid CANONICALIZE_HOST_NAME value: ${canonicalization}`);
+    }
+  }
+
+  static merge(
+    creds: MongoCredentials | undefined,
+    options: Partial<MongoCredentialsOptions>
+  ): MongoCredentials {
+    return new MongoCredentials({
+      username: options.username ?? creds?.username ?? '',
+      password: options.password ?? creds?.password ?? '',
+      mechanism: options.mechanism ?? creds?.mechanism ?? AuthMechanism.MONGODB_DEFAULT,
+      mechanismProperties: options.mechanismProperties ?? creds?.mechanismProperties ?? {},
+      source: options.source ?? options.db ?? creds?.source ?? 'admin'
+    });
+  }
+}

package/backend-project/node_modules/mongodb/src/cmap/auth/mongocr.ts

@@ -0,0 +1,42 @@
+import * as crypto from 'crypto';
+
+import { MongoMissingCredentialsError } from '../../error';
+import { ns } from '../../utils';
+import { type AuthContext, AuthProvider } from './auth_provider';
+
+export class MongoCR extends AuthProvider {
+  override async auth(authContext: AuthContext): Promise<void> {
+    const { connection, credentials } = authContext;
+    if (!credentials) {
+      throw new MongoMissingCredentialsError('AuthContext must provide credentials.');
+    }
+
+    const { username, password, source } = credentials;
+
+    const { nonce } = await connection.commandAsync(
+      ns(`${source}.$cmd`),
+      { getnonce: 1 },
+      undefined
+    );
+
+    const hashPassword = crypto
+      .createHash('md5')
+      .update(`${username}:mongo:${password}`, 'utf8')
+      .digest('hex');
+
+    // Final key
+    const key = crypto
+      .createHash('md5')
+      .update(`${nonce}${username}${hashPassword}`, 'utf8')
+      .digest('hex');
+
+    const authenticateCommand = {
+      authenticate: 1,
+      user: username,
+      nonce,
+      key
+    };
+
+    await connection.commandAsync(ns(`${source}.$cmd`), authenticateCommand, undefined);
+  }
+}