Skip to content

fix(devtools-connect): do not mutate the client options passed in COMPASS-9694 - #958

Merged
dudaschar merged 1 commit into
mainfrom
COMPASS-9694-client-mutation
Nov 5, 2026
Merged

dudaschar merged 1 commit into
mainfrom
COMPASS-9694-client-mutation

Conversation

@dudaschar

Copy link
Copy Markdown
Collaborator

Description

connectMongoClient merged its result into the caller's clientOptions object. lodash merge() modifies its first argument, so nested options of the caller (for example authMechanismProperties) were changed during connect, and the OIDC callbacks of that connection ended up in them.

This was introduced in #628, which removed the { __skipPingOnConnect: true } object that used to be the merge target. Before that, options were merged into a fresh object.

Callers that keep and reuse their options across connections are affected. In mongosh this breaks keeps authentication state when resetting connection options (OIDC e2e), which fetches a token twice instead of once after bumping to this version of devtools-connect (mongodb-js/mongosh#2899). Compass is not affected, because it deep-clones the options before each call.

The merge now goes into a new object, and a test checks that the options passed in stay unchanged.

Open Questions

Checklist

@dudaschar dudaschar self-assigned this Nov 5, 2026
@dudaschar
dudaschar requested review from a team as code owners November 5, 2026 10:11
@dudaschar
dudaschar requested review from esvm and a balanced review from Copilot November 5, 2026 10:11

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues are reported for the change to preserve caller-owned connection options.

No open issues 🎉

What changed in this PR

Fixes a regression introduced in #628 where connectMongoClient mutated caller-owned options, allowing OIDC callbacks to persist across connections when options were reused.

Changes:

  • Merges connection options into a fresh object instead of modifying the caller’s object.
  • Adds a regression test confirming that OIDC callbacks reach the client while the original options remain unchanged.
File Description
packages/​devtools-connect/​src/​connect.ts Uses an empty object as the merge target to preserve caller-owned options.
packages/​devtools-connect/​src/​connect.spec.ts Tests that merging OIDC callbacks leaves the supplied options unchanged.

Review effort: Balanced

@dudaschar
dudaschar enabled auto-merge (squash) November 5, 2026 11:36
@dudaschar
dudaschar merged commit 25f3dfe into main Nov 5, 2026
33 of 34 checks passed
@dudaschar
dudaschar deleted the COMPASS-9694-client-mutation branch November 5, 2026 11:40
@coveralls

Copy link
Copy Markdown

Coverage Status

Coverage is 80.513% — COMPASS-9694-client-mutation into main. No base build found for main.

1 similar comment
@coveralls

Copy link
Copy Markdown

Coverage Status

Coverage is 80.513% — COMPASS-9694-client-mutation into main. No base build found for main.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants