Merge pull request #19792 from Budibase/merge-back/cloud-c61e3c8e7481

Merge Cloud changes back to master

Author: budibase-release-automation[bot]

packages/server/src/integrations/mongodb.ts

@@ -386,6 +386,17 @@ export class MongoIntegration implements IntegrationBase {
   }
 
   async connect() {
+    const { tlsCAFile, tlsCertificateKeyFile, tlsCRLFile } = this.client.options
+    if (
+      !environment.SELF_HOSTED &&
+      (tlsCAFile !== undefined ||
+        tlsCertificateKeyFile !== undefined ||
+        tlsCRLFile !== undefined)
+    ) {
+      throw new Error(
+        "MongoDB TLS file options are only supported on self-hosted installations"
+      )
+    }
     return this.client.connect()
   }
 

packages/server/src/integrations/tests/mongodb.spec.ts

@@ -1,9 +1,15 @@
-import { buildMongoClientOptions, MongoDBConfig } from "../mongodb"
+import { promises as fs } from "fs"
+import { MongoClient } from "mongodb"
+import {
+  buildMongoClientOptions,
+  MongoIntegration,
+  type MongoDBConfig,
+} from "../mongodb"
 import { withEnv } from "../../environment"
 
 describe("MongoDB Integration", () => {
   const baseConfig: MongoDBConfig = {
-    connectionString: "mongodb://localhost:27017",
+    connectionString: "mongodb://example.com:27017",
     db: "test",
     tlsCertificateKeyFile: "/etc/passwd",
     tlsCAFile: "/etc/shadow",
@@ -25,4 +31,115 @@ describe("MongoDB Integration", () => {
       })
     })
   })
+
+  describe("connection string TLS file options", () => {
+    const fileOptions = ["tlsCAFile", "tlsCertificateKeyFile", "tlsCRLFile"]
+    const policyError =
+      "MongoDB TLS file options are only supported on self-hosted installations"
+
+    it.each([
+      { name: "mongodb with TLS", scheme: "mongodb", tls: "tls=true&" },
+      { name: "mongodb with SSL alias", scheme: "mongodb", tls: "ssl=true&" },
+      { name: "mongodb+srv with TLS", scheme: "mongodb+srv", tls: "tls=true&" },
+      { name: "mongodb+srv with implicit TLS", scheme: "mongodb+srv", tls: "" },
+    ])(
+      "rejects normalized $name URI file options on cloud",
+      async ({ scheme, tls }) => {
+        await withEnv({ SELF_HOSTED: undefined }, async () => {
+          for (const option of fileOptions) {
+            const encoded = [...option]
+              .map(
+                character =>
+                  `%${character.charCodeAt(0).toString(16).padStart(2, "0")}`
+              )
+              .join("")
+            for (const key of [option, option.toUpperCase(), encoded]) {
+              const integration = new MongoIntegration({
+                ...baseConfig,
+                connectionString: `${scheme}://example.com/test?${tls}${key}=/file.pem`,
+              })
+              await expect(integration.connect()).rejects.toThrow(policyError)
+            }
+          }
+        })
+      }
+    )
+
+    it("returns the usual verification failure without reading a file or connecting", async () => {
+      const readFile = jest.spyOn(fs, "readFile")
+      const connect = jest.spyOn(MongoClient.prototype, "connect")
+      try {
+        await withEnv({ SELF_HOSTED: undefined }, async () => {
+          const integration = new MongoIntegration({
+            ...baseConfig,
+            connectionString:
+              "mongodb://example.com/?tls=true&tlsCertificateKeyFile=/file.pem",
+          })
+          await expect(integration.testConnection()).resolves.toEqual({
+            connected: false,
+            error: policyError,
+          })
+        })
+        expect(readFile).not.toHaveBeenCalled()
+        expect(connect).not.toHaveBeenCalled()
+      } finally {
+        readFile.mockRestore()
+        connect.mockRestore()
+      }
+    })
+
+    it("preserves ordinary cloud URI settings", async () => {
+      await withEnv({ SELF_HOSTED: undefined }, async () => {
+        const integration = new MongoIntegration({
+          ...baseConfig,
+          connectionString:
+            "mongodb://example.com/test?tls=true&replicaSet=rs0&appName=tlsCAFile%3D%2Ffile.pem&readPreference=secondary",
+        })
+
+        expect(integration["client"].options).toMatchObject({
+          tls: true,
+          dbName: "test",
+          replicaSet: "rs0",
+          appName: "tlsCAFile=/file.pem",
+          readPreference: { mode: "secondary" },
+        })
+        expect(integration["client"].options.tlsCAFile).toBeUndefined()
+        expect(
+          integration["client"].options.tlsCertificateKeyFile
+        ).toBeUndefined()
+        expect(integration["client"].options.tlsCRLFile).toBeUndefined()
+
+        const connect = jest
+          .spyOn(integration["client"], "connect")
+          .mockResolvedValue(integration["client"])
+        await integration.connect()
+        expect(connect).toHaveBeenCalledTimes(1)
+      })
+    })
+
+    it("preserves self-hosted URI TLS file options", async () => {
+      await withEnv({ SELF_HOSTED: "true" }, async () => {
+        const integration = new MongoIntegration({
+          ...baseConfig,
+          tlsCAFile: "",
+          tlsCertificateKeyFile: "",
+          connectionString:
+            "mongodb://example.com/?tls=true&TLSCAFILE=/ca.pem&%74lsCertificateKeyFile=/key.pem&TlScRlFiLe=/crl.pem",
+        })
+
+        expect(integration["client"].options).toMatchObject({
+          tls: true,
+          tlsCAFile: "/ca.pem",
+          tlsCertificateKeyFile: "/key.pem",
+          tlsCRLFile: "/crl.pem",
+        })
+
+        const connect = jest
+          .spyOn(integration["client"], "connect")
+          .mockResolvedValue(integration["client"])
+        await integration.connect()
+        expect(connect).toHaveBeenCalledTimes(1)
+      })
+    })
+  })
 })