fix(NODE-7548): SCRAM authentication fails on non-Node runtimes by PavelSafronov · Pull Request #4932 · mongodb/node-mongodb-native

PavelSafronov · 2026-04-30T21:56:04Z

Description

Summary of Changes

This fixes the deno-specific issue where SCRAM is broken. The bug happens because we are invoking toString implicitly, and this results in a behavior change. The fix is to convert the bytes to string explicitly.

Part of the reason that this was not caught in testing is because we were still targeting node when creating the bundle.

Switching bundler to web exposed a few issues:

removed last few Buffer.readInt32LE calls
skipped more tests in nodeless where sinon can cause test failures
supply globals that are not available in web (TextDecoder, TextEncoder, atob, btoa)
export the created sandbox so our tests can verify that we aren't exporting things like Buffer
update tests that verify error types
update the bundle barrow file with missing exports

Notes for Reviewers

What is the motivation for this change?

Customer-created ticket. Driver is broken infor deno.

Release Highlight

Release notes highlight

Double check the following

Lint is passing (npm run check:lint)
Self-review completed using the steps outlined here
PR title follows the correct format: type(NODE-xxxx)[!]: description
- Example: feat(NODE-1234)!: rewriting everything in coffeescript
Changes are covered by tests
New TODOs have a related JIRA ticket

… call also updated bundling logic to correctly remove Buffer. 9 tests are currently failing, with failures that are not related to scram. Co-authored-by: Copilot <copilot@github.com>

Co-authored-by: Copilot <copilot@github.com>

Copilot

Pull request overview

This PR addresses SCRAM authentication and unit test failures when running the driver in “nodeless” (non-Node) runtimes by replacing Node-specific Buffer APIs with runtime-neutral utilities, adjusting the bundling configuration, and conditionally adapting/skipping tests that rely on Node-only behavior.

Changes:

Update SCRAM message parsing/encoding to use ByteUtils UTF-8 helpers instead of Binary#toString('utf8').
Adjust unit tests to run in nodeless environments (conditional assertions, avoiding Buffer APIs, skipping sinon-dependent tests).
Change the driver bundling setup to platform: 'browser' and tighten the VM sandbox globals used by bundled tests.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
test/unit/utils.test.ts	Makes `compareObjectId` tests conditional for nodeless behavior differences.
test/unit/sessions.test.ts	Avoids `instanceof Long` checks in nodeless by using `ensureTypeByName`.
test/unit/nodeless.test.ts	Adds assertions about the VM sandbox not exposing Node globals.
test/unit/commands.test.ts	Replaces Buffer read methods with runtime-neutral helpers.
test/unit/cmap/wire_protocol/on_demand/document.test.ts	Adapts throw assertions for nodeless runtime differences (needs tightening to avoid false positives).
test/unit/cmap/connect.test.ts	Skips sinon-based socket tests when running nodeless.
test/unit/cmap/commands.test.ts	Removes Buffer-specific `toString` usage for document sequence name assertions.
test/unit/client-side-encryption/state_machine.test.ts	Skips sinon-based tests for nodeless runs.
test/tools/runner/vm_context_helper.ts	Updates VM sandbox globals and adds bundle debugging hooks; exports `sandbox`.
test/mongodb_bundled.ts	Exposes additional exports needed by bundled/nodeless tests (`makeSocket`, keep-alive constant).
src/cmap/auth/scram.ts	Switches SCRAM auth message decoding/parsing to `ByteUtils.toUTF8`.
src/bson.ts	Adds `readUint8` helper alongside existing buffer read helpers (needs bounds validation).
etc/bundle-driver.mjs	Bundles with `platform: 'browser'`/`chrome112` and bundles `bson` instead of externalizing it.

Comments suppressed due to low confidence (1)

src/cmap/auth/scram.ts:213

parsePayload currently decodes payload.buffer using payload.buffer.length, which can include unwritten bytes (see Binary.position). It also assumes payload is always a Binary, but other code already handles response.payload being a Uint8Array—r.payload may be as well. Consider normalizing inside parsePayload (accept Binary | Uint8Array) and decode only the actual payload length.

function parsePayload(payload: Binary) {
  const payloadStr = ByteUtils.toUTF8(payload.buffer, 0, payload.buffer.length, true);
  const dict: Document = {};
  const parts = payloadStr.split(',');
  for (let i = 0; i < parts.length; i++) {
    const valueParts = (parts[i].match(/^([^=]*)=(.*)$/) ?? []).slice(1);
    dict[valueParts[0]] = valueParts[1];
  }

- use Binary.position instead of buffer.length - add a validateBufferInputs call to readUint8 - add expect.fail in cases where we expect an exception

tadjik1

thanks @PavelSafronov! I left few small questions, please let me know what you think.
Can you also please take a look at lint errors?

And I guess you spotted another bug by switching the environment:

[2026/05/06 01:26:35.258]   34) Unified test format runner (valid-pass)
[2026/05/06 01:26:35.258]        poc-sessions
[2026/05/06 01:26:35.258]          Server supports implicit sessions:
[2026/05/06 01:26:35.258]      TypeError: [last.command.lsid.id](http://last.command.lsid.id/).buffer.equals is not a function
[2026/05/06 01:26:35.258]       at assertSameLsidOnLastTwoCommands (test/tools/unified-spec-runner/operations.ts:147:38)
[2026/05/06 01:26:35.258]       at executeOperationAndCheck (test/tools/unified-spec-runner/operations.ts:1037:20)
[2026/05/06 01:26:35.258]       at runUnifiedTest (test/tools/unified-spec-runner/runner.ts:239:39)
[2026/05/06 01:26:35.258]       at processTicksAndRejections (node:internal/process/task_queues:104:5)
[2026/05/06 01:26:35.258]       at async Context.<anonymous> (test/tools/unified-spec-runner/runner.ts:349:13)[2026/05/06 01:26:35.258]   34) Unified test format runner (valid-pass)
[2026/05/06 01:26:35.258]        poc-sessions
[2026/05/06 01:26:35.258]          Server supports implicit sessions:
[2026/05/06 01:26:35.258]      TypeError: [last.command.lsid.id](http://last.command.lsid.id/).buffer.equals is not a function
[2026/05/06 01:26:35.258]       at assertSameLsidOnLastTwoCommands (test/tools/unified-spec-runner/operations.ts:147:38)
[2026/05/06 01:26:35.258]       at executeOperationAndCheck (test/tools/unified-spec-runner/operations.ts:1037:20)
[2026/05/06 01:26:35.258]       at runUnifiedTest (test/tools/unified-spec-runner/runner.ts:239:39)
[2026/05/06 01:26:35.258]       at processTicksAndRejections (node:internal/process/task_queues:104:5)
[2026/05/06 01:26:35.258]       at async Context.<anonymous> (test/tools/unified-spec-runner/runner.ts:349:13)[2026/05/06 01:26:35.258]   34) Unified test format runner (valid-pass)
[2026/05/06 01:26:35.258]        poc-sessions
[2026/05/06 01:26:35.258]          Server supports implicit sessions:
[2026/05/06 01:26:35.258]      TypeError: [last.command.lsid.id](http://last.command.lsid.id/).buffer.equals is not a function
[2026/05/06 01:26:35.258]       at assertSameLsidOnLastTwoCommands (test/tools/unified-spec-runner/operations.ts:147:38)
[2026/05/06 01:26:35.258]       at executeOperationAndCheck (test/tools/unified-spec-runner/operations.ts:1037:20)
[2026/05/06 01:26:35.258]       at runUnifiedTest (test/tools/unified-spec-runner/runner.ts:239:39)
[2026/05/06 01:26:35.258]       at processTicksAndRejections (node:internal/process/task_queues:104:5)
[2026/05/06 01:26:35.258]       at async Context.<anonymous> (test/tools/unified-spec-runner/runner.ts:349:13)

TypeError: last.command.lsid.id.buffer.equals is not a function

- lint fixes - use payload.position - add comments about NODE-7576

tadjik1 · 2026-05-08T11:32:43Z

-    withoutProof
-  ].join(',');
+  const firstMessageBytes = clientFirstMessageBare(username, nonce);
+  const firstMessage = ByteUtils.toUTF8(firstMessageBytes, 0, firstMessageBytes.length, true);


It seems that fatal=true is going to change the behaviour of this part (from the js-bson docs):

/** Create a string from utf8 code units, fatal=true will throw an error if UTF-8 bytes are invalid, fatal=false will insert replacement characters */ toUTF8: (buffer: Uint8Array, start: number, end: number, fatal: boolean) => string;

Before toString() didn't throw error, and instead replaced bad bytes silently. Now we are going to throw TypeError in case of invalid UTF8.
(and the same for parsePayload)

Suggested change

const firstMessage = ByteUtils.toUTF8(firstMessageBytes, 0, firstMessageBytes.length, true);

const firstMessage = ByteUtils.toUTF8(firstMessageBytes, 0, firstMessageBytes.length, false);

Great catch, updating.

tadjik1 · 2026-05-08T11:33:17Z

+  requires: {
+    predicate: _test => {
+      if (runNodelessTests) {
+        return 'Test is not node specific and should be run in nodeless environments';


Suggested change

return 'Test is not node specific and should be run in nodeless environments';

return 'Test is node specific and should not be run in nodeless environments';

Changed, and added a bit more context.

tadjik1

thanks @PavelSafronov, great work! I have left, I believe, 2 last small comments, to preserve existing behaviour and small typo fix. Everything else is looking really good 👍

- avoid throwing by toUTF8 - clarify comments

tadjik1

LGTM

will merge on complete CI run

addaleax · 2026-05-11T10:04:44Z

+  const firstMessageBytes = clientFirstMessageBare(username, nonce);
+  const firstMessage = ByteUtils.toUTF8(firstMessageBytes, 0, firstMessageBytes.length, false);
+  const payloadString = ByteUtils.toUTF8(payload.buffer, 0, payload.position, false);
+  const authMessage = [firstMessage, payloadString, withoutProof].join(',');


Might be a bit interesting to think about how this could have been prevented ... it's a bit unfortunate that TS lets you call .join() on arrays that contain non-primitives.

Maybe if we enforced the usage of template strings instead of joining fixed-length arrays, this could be avoided? It's technically still valid JS, but I'm pretty sure at least in the devtools codebases this would result in linter failures

Suggested change

const authMessage = [firstMessage, payloadString, withoutProof].join(',');

const authMessage = `${firstMessage},${payloadString},${withoutProof}`;

addaleax · 2026-05-11T10:06:05Z

                          bsonType: 'int',
                          algorithm: 'AEAD_AES_256_CBC_HMAC_SHA_512-Random',
-                          keyId: [new UUID(dataKey)]
+                          keyId: [new UUID(dataKey.toHexString(true))]


Can you explain why the changes here are necessary/how they tie into the rest of the PR? Passing a BSON UUID value here should work just fine

addaleax · 2026-05-11T10:07:17Z

-  globalThis: undefined as any
+  globalThis: undefined as any,
+
+  // These are needed for webByteUtils and are not available in the browser.


Huh? These APIs come from browsers and were only adopted in server-side runtimes later

PavelSafronov and others added 5 commits April 29, 2026 14:56

fix issue with scram that impacts deno, by avoiding implicit toString…

f678190

… call also updated bundling logic to correctly remove Buffer. 9 tests are currently failing, with failures that are not related to scram. Co-authored-by: Copilot <copilot@github.com>

remove two more toString calls, replace with ByteUtils.toUTF8 calls

cc1dea2

fix bundled unit tests

b1d102a

Co-authored-by: Copilot <copilot@github.com>

add test to check for Node properties on non-node sandbox

ced412f

lint

d0e7fdf

PavelSafronov marked this pull request as ready for review May 5, 2026 22:24

PavelSafronov requested a review from a team as a code owner May 5, 2026 22:24

Copilot AI review requested due to automatic review settings May 5, 2026 22:24

Copilot started reviewing on behalf of PavelSafronov May 5, 2026 22:25 View session

Copilot AI reviewed May 5, 2026

View reviewed changes

PavelSafronov marked this pull request as draft May 5, 2026 22:31

PavelSafronov marked this pull request as ready for review May 5, 2026 22:42

PavelSafronov added 3 commits May 5, 2026 15:49

remove debug code, add comments

c202e61

remove debug statement

fce3dce

pr feedback:

eeef194

- use Binary.position instead of buffer.length - add a validateBufferInputs call to readUint8 - add expect.fail in cases where we expect an exception

tadjik1 self-assigned this May 6, 2026

tadjik1 added the Primary Review In Review with primary reviewer, not yet ready for team's eyes label May 6, 2026

tadjik1 reviewed May 6, 2026

View reviewed changes

Comment thread src/cmap/auth/scram.ts Outdated

tadjik1 reviewed May 6, 2026

View reviewed changes

Comment thread test/unit/utils.test.ts

tadjik1 requested changes May 6, 2026

View reviewed changes

PavelSafronov and others added 10 commits May 6, 2026 09:05

pr feedback:

ddf8f3f

- lint fixes - use payload.position - add comments about NODE-7576

Merge branch 'main' into node-7548-scram-deno

00e8b36

fix broken nodeless tests

4ae5259

lint fixes

ddf9c51

explicit string conversion in tests

9ef574a

lint

4e62eca

skip some node-only tests

7979bd1

add a missing type to bundler

a58ba8d

tests without metadata now inherit parent metadata

e1825c0

skip another node test

6193546

pass string to UUID constructor, so it doesn't throw on a bundled type

0b72911

tadjik1 reviewed May 8, 2026

View reviewed changes

tadjik1 requested changes May 8, 2026

View reviewed changes

pr feedback:

49dfe25

- avoid throwing by toUTF8 - clarify comments

tadjik1 approved these changes May 8, 2026

View reviewed changes

addaleax reviewed May 11, 2026

View reviewed changes

	const firstMessage = ByteUtils.toUTF8(firstMessageBytes, 0, firstMessageBytes.length, true);
	const firstMessage = ByteUtils.toUTF8(firstMessageBytes, 0, firstMessageBytes.length, false);

	return 'Test is not node specific and should be run in nodeless environments';
	return 'Test is node specific and should not be run in nodeless environments';

	const authMessage = [firstMessage, payloadString, withoutProof].join(',');
	const authMessage = `${firstMessage},${payloadString},${withoutProof}`;

Conversation

PavelSafronov commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Summary of Changes

Notes for Reviewers

What is the motivation for this change?

Release Highlight

Release notes highlight

Double check the following

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tadjik1 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tadjik1 May 8, 2026

Choose a reason for hiding this comment

Uh oh!

PavelSafronov May 8, 2026

Choose a reason for hiding this comment

Uh oh!

tadjik1 May 8, 2026

Choose a reason for hiding this comment

Uh oh!

PavelSafronov May 8, 2026

Choose a reason for hiding this comment

Uh oh!

tadjik1 left a comment

Choose a reason for hiding this comment

Uh oh!

tadjik1 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

addaleax May 11, 2026

Choose a reason for hiding this comment

Uh oh!

addaleax May 11, 2026

Choose a reason for hiding this comment

Uh oh!

addaleax May 11, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

PavelSafronov commented Apr 30, 2026 •

edited

Loading

tadjik1 left a comment •

edited

Loading

tadjik1 left a comment •

edited

Loading