fix(NODE-7548): SCRAM authentication fails on non-Node runtimes

etc/bundle-driver.mjs

@@ -17,15 +17,14 @@ await esbuild.build({
   entryPoints: [path.join(rootDir, 'test/mongodb_all.ts')],
   bundle: true,
   outfile: outputBundleFile,
-  platform: 'node',
+  platform: 'browser',
   format: 'cjs',
-  target: 'node20',
+  target: 'chrome112',
   external: [
     '@aws-sdk/credential-providers',
     '@mongodb-js/saslprep',
     '@mongodb-js/zstd',
     '@napi-rs/snappy*',
-    'bson',
     'gcp-metadata',
     'kerberos',
     'mongodb-client-encryption',

src/bson.ts

@@ -55,6 +55,11 @@ export const readInt32LE = (buffer: Uint8Array, offset: number): number => {
   return NumberUtils.getInt32LE(buffer, offset);
 };
 
+// readUint8, reads a single unsigned byte from buffer at given offset
+export const readUint8 = (buffer: Uint8Array, offset: number): number => {
+  return buffer[offset];
+};
+
 export const setUint32LE = (destination: Uint8Array, offset: number, value: number): 4 => {
   destination[offset] = value;
   value >>>= 8;

src/cmap/auth/scram.ts

@@ -166,11 +166,10 @@ async function continueScramConversation(
   const clientKey = await HMAC(cryptoMethod, saltedPassword, 'Client Key');
   const serverKey = await HMAC(cryptoMethod, saltedPassword, 'Server Key');
   const storedKey = await H(cryptoMethod, clientKey);
-  const authMessage = [
-    clientFirstMessageBare(username, nonce),
-    payload.toString('utf8'),
-    withoutProof
-  ].join(',');
+  const firstMessageBytes = clientFirstMessageBare(username, nonce);
+  const firstMessage = ByteUtils.toUTF8(firstMessageBytes, 0, firstMessageBytes.length, true);
+  const payloadString = ByteUtils.toUTF8(payload.buffer, 0, payload.buffer.length, true);
+  const authMessage = [firstMessage, payloadString, withoutProof].join(',');
 
   const clientSignature = await HMAC(cryptoMethod, storedKey, authMessage);
   const clientProof = `p=${xor(clientKey, clientSignature)}`;
@@ -205,7 +204,7 @@ async function continueScramConversation(
 }
 
 function parsePayload(payload: Binary) {
-  const payloadStr = payload.toString('utf8');
+  const payloadStr = ByteUtils.toUTF8(payload.buffer, 0, payload.buffer.length, true);
   const dict: Document = {};
   const parts = payloadStr.split(',');
   for (let i = 0; i < parts.length; i++) {

test/mongodb_bundled.ts

@@ -109,6 +109,7 @@ export const {
   decompress,
   decorateWithExplain,
   DEFAULT_ALLOWED_HOSTS,
+  DEFAULT_KEEP_ALIVE_INITIAL_DELAY_MS,
   DEFAULT_MAX_DOCUMENT_LENGTH,
   DEFAULT_PK_FACTORY,
   DeleteManyOperation,
@@ -176,6 +177,7 @@ export const {
   ListIndexesOperation,
   Long,
   makeClientMetadata,
+  makeSocket,
   MAX_SUPPORTED_SERVER_VERSION,
   MAX_SUPPORTED_WIRE_VERSION,
   MaxKey,

test/tools/runner/vm_context_helper.ts

@@ -5,13 +5,23 @@ import { isBuiltin } from 'node:module';
 import * as path from 'node:path';
 import * as vm from 'node:vm';
 
+import * as process from 'process';
+
 import { ALLOWED_DRIVER_REQUIRE_PROPERTY_NAME } from '../../mongodb_all';
 
+/**
+ * Debug logging for bundled test environment issues
+ */
+function debug(msg: unknown) {
+  if (process.env.MONGODB_BUNDLE_DEBUG) {
+    console.log(`[BUNDLE_DEBUG] ${msg}`);
+  }
+}
+
 const allowedModules = new Set([
   '@aws-sdk/credential-providers',
   '@mongodb-js/saslprep',
   '@mongodb-js/zstd',
-  'bson',
   'gcp-metadata',
   'kerberos',
   'mongodb-client-encryption',
@@ -27,7 +37,6 @@ const exposedGlobals = new Set([
   'AbortController',
   'AbortSignal',
   'BigInt',
-  'Buffer',
   'Date',
   'Error',
   'Headers',
@@ -42,8 +51,9 @@ const exposedGlobals = new Set([
   'console',
   'crypto',
   'performance',
-  'process',
 
+  'atob',
+  'btoa',
   'clearImmediate',
   'clearInterval',
   'clearTimeout',
@@ -68,7 +78,10 @@ function createRestrictedRequire() {
     if (shouldBlock) {
       throw new Error(`Access to core module '${moduleName}' is restricted in this context`);
     }
-    return require(moduleName);
+
+    const required = require(moduleName);
+    debug(`Loaded external module: ${moduleName}`);
+    return required;
   } as NodeJS.Require;
 }
 
@@ -80,7 +93,13 @@ const context = {
 
   // Needed for some modules
   global: undefined as any,
-  globalThis: undefined as any
+  globalThis: undefined as any,
+
+  TextEncoder: undefined,
+  TextDecoder: undefined,
+
+  atob: undefined,
+  btoa: undefined
 };
 
 // Expose allowed globals in the context
@@ -90,12 +109,41 @@ for (const globalName of exposedGlobals) {
   }
 }
 
+// Ensure TextEncoder/TextDecoder are always available (needed for webByteUtils)
+if (!context.TextEncoder && typeof TextEncoder !== 'undefined') {
+  context.TextEncoder = TextEncoder;
+}
+if (!context.TextDecoder && typeof TextDecoder !== 'undefined') {
+  context.TextDecoder = TextDecoder;
+}
+
+// Ensure btoa/atob are available (needed for webByteUtils base64 encoding)
+if (!context.btoa && typeof btoa !== 'undefined') {
+  context.btoa = btoa;
+}
+if (!context.atob && typeof atob !== 'undefined') {
+  context.atob = atob;
+}
+
 // Create a sandbox context with necessary globals
 const sandbox = vm.createContext(context);
 
 // Make globalThis point to the sandbox
 sandbox.globalThis = sandbox;
 
+export { sandbox };
+
+// Diagnostic: Check if Buffer is accessible in the VM context
+if (process.env.MONGODB_BUNDLE_DEBUG) {
+  try {
+    const testScript = new vm.Script('typeof Buffer');
+    const bufferType = testScript.runInContext(sandbox);
+    debug(`In VM context, typeof Buffer = ${bufferType}`);
+  } catch (e) {
+    debug(`Error checking Buffer in context: ${(e as Error).message}`);
+  }
+}
+
 /**
  * Load the bundled MongoDB driver module in a VM context
  * This allows us to control the globals that the driver has access to

test/unit/client-side-encryption/state_machine.test.ts

@@ -15,6 +15,7 @@ import {
   Db,
   type FindOptions,
   MongoClient,
+  runNodelessTests,
   squashError,
   StateMachine
 } from '../../mongodb';
@@ -60,6 +61,10 @@ describe('StateMachine', function () {
     let clientStub;
 
     beforeEach(function () {
+      if (runNodelessTests) {
+        // sinon doesn't work in nodeless tests
+        this.skip();
+      }
       this.sinon = sinon.createSandbox();
       runCommandStub = this.sinon.stub().resolves({});
       dbStub = this.sinon.createStubInstance(Db, {

test/unit/cmap/commands.test.ts

@@ -1,8 +1,15 @@
 import * as BSON from 'bson';
 import { expect } from 'chai';
 
+// eslint-disable-next-line @typescript-eslint/no-restricted-imports
+import { readInt32LE } from '../../../src/bson';
 import { DocumentSequence, OpMsgRequest, OpReply } from '../../mongodb';
 
+// Helper to decode UTF-8 string from Uint8Array
+function utf8Slice(buffer: Uint8Array, start: number, end: number): string {
+  return BSON.ByteUtils.toUTF8(buffer, start, end, false);
+}
+
 describe('commands', function () {
   describe('OpMsgRequest', function () {
     describe('#toBin', function () {
@@ -41,12 +48,12 @@ describe('commands', function () {
 
           it('sets the length of the document sequence', function () {
             // Bytes starting at index 1 is a 4 byte length.
-            expect(buffers[3].readInt32LE(1)).to.equal(25);
+            expect(readInt32LE(buffers[3], 1)).to.equal(25);
           });
 
           it('sets the name of the first field to be replaced', function () {
             // Bytes starting at index 5 is the field name.
-            expect(buffers[3].toString('utf8', 5, 10)).to.equal('field');
+            expect(utf8Slice(buffers[3], 5, 10)).to.equal('field');
           });
         });
 
@@ -81,12 +88,12 @@ describe('commands', function () {
 
           it('sets the length of the first document sequence', function () {
             // Bytes starting at index 1 is a 4 byte length.
-            expect(buffers[3].readInt32LE(1)).to.equal(28);
+            expect(readInt32LE(buffers[3], 1)).to.equal(28);
           });
 
           it('sets the name of the first field to be replaced', function () {
             // Bytes starting at index 5 is the field name.
-            expect(buffers[3].toString('utf8', 5, 13)).to.equal('fieldOne');
+            expect(utf8Slice(buffers[3], 5, 13)).to.equal('fieldOne');
           });
 
           it('sets the document sequence sections second type to 1', function () {
@@ -96,12 +103,12 @@ describe('commands', function () {
 
           it('sets the length of the second document sequence', function () {
             // Bytes starting at index 1 is a 4 byte length.
-            expect(buffers[3].readInt32LE(30)).to.equal(28);
+            expect(readInt32LE(buffers[3], 30)).to.equal(28);
           });
 
           it('sets the name of the second field to be replaced', function () {
             // Bytes starting at index 33 is the field name.
-            expect(buffers[3].toString('utf8', 34, 42)).to.equal('fieldTwo');
+            expect(utf8Slice(buffers[3], 34, 42)).to.equal('fieldTwo');
           });
         });
       });

test/unit/cmap/connect.test.ts

@@ -21,7 +21,8 @@ import {
   MongoClientAuthProviders,
   MongoCredentials,
   MongoNetworkError,
-  prepareHandshakeDocument
+  prepareHandshakeDocument,
+  runNodelessTests
 } from '../../mongodb';
 import { genClusterTime } from '../../tools/common';
 import * as mock from '../../tools/mongodb-mock/index';
@@ -467,6 +468,11 @@ describe('Connect Tests', function () {
     );
 
     before(function (done) {
+      if (runNodelessTests) {
+        // sinon doesn't work in nodeless tests
+        this.skip();
+      }
+
       // @SECLEVEL=0 allows the legacy test certificate (signed with SHA-1/1024-bit RSA)
       // to be accepted by OpenSSL 3.x, which rejects at the default security level.
       tlsServer = tls.createServer(

test/unit/cmap/wire_protocol/on_demand/document.test.ts

@@ -1,7 +1,8 @@
 import { Binary, BSON, BSONError, BSONType, ObjectId, Timestamp } from 'bson';
 import { expect } from 'chai';
 
-import { OnDemandDocument } from '../../../../mongodb';
+import { OnDemandDocument, runNodelessTests } from '../../../../mongodb';
+import { ensureTypeByName } from '../../../../tools/utils';
 
 describe('class OnDemandDocument', () => {
   context('when given an empty BSON sequence', () => {
@@ -124,15 +125,32 @@ describe('class OnDemandDocument', () => {
     });
 
     it('throws if required is set to true and element name does not exist', () => {
-      expect(() => document.get('blah!', BSONType.bool, true)).to.throw(BSONError);
+      if (runNodelessTests) {
+        try {
+          document.get('blah!', BSONType.bool, true);
+        } catch (e) {
+          ensureTypeByName(e, 'BSONError');
+        }
+      } else {
+        expect(() => document.get('blah!', BSONType.bool, true)).to.throw(BSONError);
+      }
       expect(document).to.have.nested.property('cache.blah!', false);
     });
 
     it('throws if requested type is unsupported', () => {
-      expect(() => {
-        // @ts-expect-error: checking a bad BSON type
-        document.get('unsupportedType', BSONType.regex);
-      }).to.throw(BSONError, /unsupported/i);
+      if (runNodelessTests) {
+        try {
+          // @ts-expect-error: checking a bad BSON type
+          document.get('unsupportedType', BSONType.regex, true);
+        } catch (e) {
+          ensureTypeByName(e, 'BSONError');
+        }
+      } else {
+        expect(() => {
+          // @ts-expect-error: checking a bad BSON type
+          document.get('unsupportedType', BSONType.regex);
+        }).to.throw(BSONError, /unsupported/i);
+      }
     });
 
     it('caches the value', () => {
@@ -245,15 +263,31 @@ describe('class OnDemandDocument', () => {
     });
 
     it('throws if required is set to true and element name does not exist', () => {
-      expect(() => document.getNumber('blah!', true)).to.throw(BSONError);
+      if (runNodelessTests) {
+        try {
+          document.getNumber('blah!', true);
+        } catch (e) {
+          ensureTypeByName(e, 'BSONError');
+        }
+      } else {
+        expect(() => document.getNumber('blah!', true)).to.throw(BSONError);
+      }
     });
 
     it('throws if required is set to true and element is not numeric', () => {
       // just making sure this test does not fail for the non-exist reason
       expect(document.has('string')).to.be.true;
-      expect(() => {
-        document.getNumber('string', true);
-      }).to.throw(BSONError);
+      if (runNodelessTests) {
+        try {
+          document.getNumber('string', true);
+        } catch (e) {
+          ensureTypeByName(e, 'BSONError');
+        }
+      } else {
+        expect(() => {
+          document.getNumber('string', true);
+        }).to.throw();
+      }
     });
 
     it('returns null if required is set to false and element does not exist', () => {