fix(NODE-7548): SCRAM authentication fails on non-Node runtimes

[PavelSafronov]

Description

Summary of Changes

This fixes the deno-specific issue where SCRAM is broken. The bug happens because we are invoking toString implicitly, and this results in a behavior change. The fix is to convert the bytes to string explicitly.

Part of the reason that this was not caught in testing is because we were still targeting node when creating the bundle.

Switching bundler to web exposed a few issues:

• removed last few Buffer.readInt32LE calls
• skipped more tests in nodeless where sinon can cause test failures
• supply globals that are not available in web (TextDecoder, TextEncoder, atob, btoa)
• export the created sandbox so our tests can verify that we aren't exporting things like Buffer
• update tests that verify error types
• update the bundle barrow file with missing exports

Notes for Reviewers

What is the motivation for this change?

Customer-created ticket. Driver is broken infor deno.

Release Highlight

Release notes highlight

Double check the following

• Lint is passing (npm run check:lint)
• Self-review completed using the steps outlined here
• PR title follows the correct format: type(NODE-xxxx)[!]: description
  • Example: feat(NODE-1234)!: rewriting everything in coffeescript
• Changes are covered by tests
• New TODOs have a related JIRA ticket

[Copilot]

Pull request overview

This PR addresses SCRAM authentication and unit test failures when running the driver in “nodeless” (non-Node) runtimes by replacing Node-specific Buffer APIs with runtime-neutral utilities, adjusting the bundling configuration, and conditionally adapting/skipping tests that rely on Node-only behavior.

Changes:

• Update SCRAM message parsing/encoding to use ByteUtils UTF-8 helpers instead of Binary#toString('utf8').
• Adjust unit tests to run in nodeless environments (conditional assertions, avoiding Buffer APIs, skipping sinon-dependent tests).
• Change the driver bundling setup to platform: 'browser' and tighten the VM sandbox globals used by bundled tests.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
test/unit/utils.test.ts	Makes compareObjectId tests conditional for nodeless behavior differences.
test/unit/sessions.test.ts	Avoids instanceof Long checks in nodeless by using ensureTypeByName.
test/unit/nodeless.test.ts	Adds assertions about the VM sandbox not exposing Node globals.
test/unit/commands.test.ts	Replaces Buffer read methods with runtime-neutral helpers.
test/unit/cmap/wire_protocol/on_demand/document.test.ts	Adapts throw assertions for nodeless runtime differences (needs tightening to avoid false positives).
test/unit/cmap/connect.test.ts	Skips sinon-based socket tests when running nodeless.
test/unit/cmap/commands.test.ts	Removes Buffer-specific toString usage for document sequence name assertions.
test/unit/client-side-encryption/state_machine.test.ts	Skips sinon-based tests for nodeless runs.
test/tools/runner/vm_context_helper.ts	Updates VM sandbox globals and adds bundle debugging hooks; exports sandbox.
test/mongodb_bundled.ts	Exposes additional exports needed by bundled/nodeless tests (makeSocket, keep-alive constant).
src/cmap/auth/scram.ts	Switches SCRAM auth message decoding/parsing to ByteUtils.toUTF8.
src/bson.ts	Adds readUint8 helper alongside existing buffer read helpers (needs bounds validation).
etc/bundle-driver.mjs	Bundles with platform: 'browser'/chrome112 and bundles bson instead of externalizing it.

Comments suppressed due to low confidence (1)

src/cmap/auth/scram.ts:213

• parsePayload currently decodes payload.buffer using payload.buffer.length, which can include unwritten bytes (see Binary.position). It also assumes payload is always a Binary, but other code already handles response.payload being a Uint8Array—r.payload may be as well. Consider normalizing inside parsePayload (accept Binary | Uint8Array) and decode only the actual payload length.

function parsePayload(payload: Binary) {
  const payloadStr = ByteUtils.toUTF8(payload.buffer, 0, payload.buffer.length, true);
  const dict: Document = {};
  const parts = payloadStr.split(',');
  for (let i = 0; i < parts.length; i++) {
    const valueParts = (parts[i].match(/^([^=]*)=(.*)$/) ?? []).slice(1);
    dict[valueParts[0]] = valueParts[1];
  }

[tadjik1]

Suggested change

	const payloadStr = ByteUtils.toUTF8(payload.buffer, 0, payload.buffer.length, true);
	const payloadStr = ByteUtils.toUTF8(payload.buffer, 0, payload.position, true);

Similar to the one above

[tadjik1]

Do you think it deserves follow-up ticket? Feels like it should throw.

[PavelSafronov]

Absolutely, will add a follow-up ticket and will reference it here.

[tadjik1]

thanks @PavelSafronov! I left few small questions, please let me know what you think.
Can you also please take a look at lint errors?

And I guess you spotted another bug by switching the environment:

[2026/05/06 01:26:35.258]   34) Unified test format runner (valid-pass)
[2026/05/06 01:26:35.258]        poc-sessions
[2026/05/06 01:26:35.258]          Server supports implicit sessions:
[2026/05/06 01:26:35.258]      TypeError: [last.command.lsid.id](http://last.command.lsid.id/).buffer.equals is not a function
[2026/05/06 01:26:35.258]       at assertSameLsidOnLastTwoCommands (test/tools/unified-spec-runner/operations.ts:147:38)
[2026/05/06 01:26:35.258]       at executeOperationAndCheck (test/tools/unified-spec-runner/operations.ts:1037:20)
[2026/05/06 01:26:35.258]       at runUnifiedTest (test/tools/unified-spec-runner/runner.ts:239:39)
[2026/05/06 01:26:35.258]       at processTicksAndRejections (node:internal/process/task_queues:104:5)
[2026/05/06 01:26:35.258]       at async Context.<anonymous> (test/tools/unified-spec-runner/runner.ts:349:13)[2026/05/06 01:26:35.258]   34) Unified test format runner (valid-pass)
[2026/05/06 01:26:35.258]        poc-sessions
[2026/05/06 01:26:35.258]          Server supports implicit sessions:
[2026/05/06 01:26:35.258]      TypeError: [last.command.lsid.id](http://last.command.lsid.id/).buffer.equals is not a function
[2026/05/06 01:26:35.258]       at assertSameLsidOnLastTwoCommands (test/tools/unified-spec-runner/operations.ts:147:38)
[2026/05/06 01:26:35.258]       at executeOperationAndCheck (test/tools/unified-spec-runner/operations.ts:1037:20)
[2026/05/06 01:26:35.258]       at runUnifiedTest (test/tools/unified-spec-runner/runner.ts:239:39)
[2026/05/06 01:26:35.258]       at processTicksAndRejections (node:internal/process/task_queues:104:5)
[2026/05/06 01:26:35.258]       at async Context.<anonymous> (test/tools/unified-spec-runner/runner.ts:349:13)[2026/05/06 01:26:35.258]   34) Unified test format runner (valid-pass)
[2026/05/06 01:26:35.258]        poc-sessions
[2026/05/06 01:26:35.258]          Server supports implicit sessions:
[2026/05/06 01:26:35.258]      TypeError: [last.command.lsid.id](http://last.command.lsid.id/).buffer.equals is not a function
[2026/05/06 01:26:35.258]       at assertSameLsidOnLastTwoCommands (test/tools/unified-spec-runner/operations.ts:147:38)
[2026/05/06 01:26:35.258]       at executeOperationAndCheck (test/tools/unified-spec-runner/operations.ts:1037:20)
[2026/05/06 01:26:35.258]       at runUnifiedTest (test/tools/unified-spec-runner/runner.ts:239:39)
[2026/05/06 01:26:35.258]       at processTicksAndRejections (node:internal/process/task_queues:104:5)
[2026/05/06 01:26:35.258]       at async Context.<anonymous> (test/tools/unified-spec-runner/runner.ts:349:13)

TypeError: last.command.lsid.id.buffer.equals is not a function