feat(pam): add MongoDB support by saifsmailbox98 · Pull Request #5817 · Infisical/infisical

saifsmailbox98 · 2026-03-25T21:36:09Z

Context

Adds MongoDB support to PAM

Related Infisical/cli#162

Screenshots

Steps to verify the change

Type

Checklist

Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
Tested locally
Updated docs (if needed)
Updated CLAUDE.md files (if needed)
Read the contributing guide

linear · 2026-03-25T21:36:12Z

PAM-146 Support MongoDB resources in PAM

maidul98 · 2026-03-25T21:36:50Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

greptile-apps · 2026-03-25T21:41:35Z

Greptile Summary

This PR adds MongoDB as a fully supported PAM resource type, wiring it into the existing SQL resource factory infrastructure (gateway proxy, SSL/TLS handling, account CRUD endpoints) and adding the corresponding frontend forms and UI integration. The change is well-structured and follows the patterns established by the existing SQL adapters (Postgres, MySQL, MSSQL).

Key changes:

New mongodb/ schema, types, and fns files under the PAM resource service
MongoDB connection handling added to sql-resource-factory.ts using the mongodb npm driver
Full CRUD routes registered for MongoDB resources and accounts
MongoDBResourceForm and MongoDBAccountForm React components
MongoDB promoted from "coming soon" to fully selectable in ResourceTypeSelect

Issues found:

authSource is hardcoded to the connected database name in the connection URI. Most MongoDB deployments (Atlas, self-hosted with centralised user management) store user credentials in the admin database and need authSource to point there. This will silently break authentication for those setups.
The connectivity ping command is issued against the admin database rather than the user-configured database. On the connectOnly=false path, a user with no admin DB access would see a misleading "unable to validate" error even though their credentials are correct.
No documentation page has been added under docs/documentation/platform/pam/getting-started/resources/ for MongoDB, even though every other PAM resource type (PostgreSQL, MySQL, MSSQL, Redis, SSH, etc.) has one.

Confidence Score: 3/5

Not ready to merge — the hardcoded authSource will cause authentication failures for the majority of MongoDB deployments before any user can successfully connect.

The overall integration is well-structured and follows established patterns. However, the hardcoded authSource equal to the target database is a functional blocker: MongoDB users whose accounts live in the admin database (Atlas, typical managed deployments) will always fail to authenticate. This is the primary user-facing action in the feature and it breaks on the most common deployment topology. A second concern — pinging admin instead of the user database — compounds the confusion when debugging. Both are fixable without structural refactoring, but they need to be addressed before the feature ships.

backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts and backend/src/ee/services/pam-resource/mongodb/mongodb-resource-schemas.ts (and the matching frontend form) need attention for the authSource gap.

Important Files Changed

Filename	Overview
backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts	Adds MongoDB connection handling into the SQL resource factory; `authSource` is hardcoded to the target database (breaks deployments where users live in `admin`), and the connectivity ping targets the `admin` DB which can produce confusing authorization errors.
backend/src/ee/services/pam-resource/mongodb/mongodb-resource-schemas.ts	Defines Zod schemas for MongoDB resources and accounts by reusing `BaseSqlResourceConnectionDetailsSchema`; structurally clean but inherits the missing `authSource` field gap.
backend/src/ee/services/pam-resource/pam-resource-factory.ts	Registers MongoDB in the PAM resource factory map pointing to `sqlResourceFactory`; straightforward one-line addition.
frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/MongoDBResourceForm.tsx	New MongoDB resource form with host/port/database configuration and tabbed SSL section; mirrors the pattern of other SQL resource forms and looks correct.
frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/MongoDBAccountForm.tsx	New MongoDB account form with username/password fields and the `UNCHANGED_PASSWORD_SENTINEL` pattern; consistent with other account forms.
frontend/src/pages/pam/PamResourcesPage/components/ResourceTypeSelect.tsx	Removes MongoDB from the "coming soon" placeholder list and from the disabled-resource filter, promoting it to a fully supported resource type.
backend/src/ee/routes/v1/pam-account-routers/index.ts	Registers MongoDB CRUD account endpoints by reusing `registerPamAccountEndpoints`; follows the existing pattern exactly.
backend/src/ee/routes/v1/pam-resource-routers/index.ts	Registers MongoDB resource endpoints; follows existing patterns with no issues.

_{Reviews (3): Last reviewed commit: "Fix URL injection in MongoDB connection ..." | Re-trigger Greptile}

Reuse BaseSqlResourceConnectionDetailsSchema for MongoDB connection details and add MongoDB as a case in makeSqlConnection, eliminating the dedicated mongodb-resource-factory.ts (250 lines).

saifsmailbox98 · 2026-03-26T09:32:54Z

@greptile could you review this again? pay attention to the latest updates (changes and replies to the previous comments)

saifsmailbox98 · 2026-03-26T09:44:39Z

@greptile could you review this again? pay attention to the latest updates (changes and replies to the previous comments)

… port.

…mongodb-resources-in-pam # Conflicts: # frontend/src/pages/pam/PamAccountsPage/components/PamAccountForm/PamAccountForm.tsx # frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/PamResourceForm.tsx # frontend/src/pages/pam/PamResourcesPage/components/ResourceTypeSelect.tsx

…e hack Users with MongoDB SRV hosts (mongodb+srv://) no longer need to enter 0 as the port. Leaving the port empty now signals an SRV connection. The backend resolves SRV only during resource/account validation; session credentials pass the original host to the CLI which handles SRV natively.

…xt in form

…mongodb-resources-in-pam # Conflicts: # backend/package-lock.json

gitguardian · 2026-04-03T18:28:49Z

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
29206045	Triggered	Generic Password	`2334268`	backend/src/ee/services/pki-scep/pki-scep-service.ts	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secret safely. Learn here the best practices.
Revoke and rotate this secret.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

gitguardian · 2026-04-03T18:28:49Z

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
29206045	Triggered	Generic Password	`2334268`	backend/src/ee/services/pki-scep/pki-scep-service.ts	View secret
28944329	Triggered	PostHog Project API Key	`4d5a8c0`	docs/docs.json	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secrets safely. Learn here the best practices.
Revoke and rotate these secrets.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

x032205 · 2026-04-04T00:02:40Z

Also, testing with Atlas did not work

MongoDB doesn't use knex and isn't a SQL database — give it its own factory following the Redis/SSH pattern. Also replaces auth error string matching with MongoServerError error code 18.

Support MongoDB URIs (mongodb+srv://, mongodb://) in the host field so users can specify authSource and other connection options directly. Remove the separate port field since it's now part of the host. - Remove port from MongoDB schema, types, and form - Accept full MongoDB URIs in host field with relay-routing extraction - Extract authSource from URI for validation connections (default: admin) - Merge host/port into single URI-capable field in frontend form

Replaces the freeform host field with a proper connectionString field validated by the mongodb-connection-string-url library. Rejects embedded credentials and database in the URI path. Adds allowlist regex to the database field. Updates frontend forms and display components accordingly.

Validate MongoDB connection strings client-side so errors display inline in the form instead of as a toast/modal notification.

…ssword - Replace new URL() with regex-based parsing in the frontend MongoDB form to support comma-separated replica set hosts - Require non-empty password in MongoDBAccountCredentialsSchema to match other resource schemas and prevent silent credential omission

x032205

PAM MongoDB

44ae323

saifsmailbox98 mentioned this pull request Mar 25, 2026

feat(pam): add MongoDB support Infisical/cli#159

Closed

6 tasks

greptile-apps Bot reviewed Mar 25, 2026

View reviewed changes

saifsmailbox98 added 3 commits March 26, 2026 13:35

Fix MongoDB PAM: add requireMfa field, revert Db→Sql rename

44ddcd2

Fold MongoDB PAM factory into shared SQL infrastructure

075350c

Reuse BaseSqlResourceConnectionDetailsSchema for MongoDB connection details and add MongoDB as a case in makeSqlConnection, eliminating the dedicated mongodb-resource-factory.ts (250 lines).

Fix URL injection in MongoDB connection URI by encoding database field

3671ea7

greptile-apps Bot reviewed Mar 26, 2026

View reviewed changes

Comment thread backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts Outdated

Comment thread backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts Outdated

saifsmailbox98 added 12 commits March 26, 2026 15:27

Ping target database instead of admin in MongoDB validation

4dee5e5

Revert unnecessary mongodb driver version bump

d66c11f

Order MongoDB after SQL databases instead of after Redis

02dec38

Resolve SRV records for MongoDB connections to obtain actual host and…

56dfb1d

… port.

Update MongoDB forms to v3 sheet layout pattern and fix lint

2dfedac

Hide port row on resource detail page for SRV hosts and use helper te…

254b6bd

…xt in form

Use admin as authSource for MongoDB connections to match CLI behavior

8d662a0

Revert mongodb driver version bump in lock file to match main

24fb570

Update MongoDB forms to v3 component pattern

5a09dbc

Reset package.json and package-lock.json to match origin/main

5aaae17

saifsmailbox98 mentioned this pull request Mar 27, 2026

feat(pam): add MongoDB support Infisical/cli#162

Merged

6 tasks

saifsmailbox98 requested a review from sheensantoscapadngan March 27, 2026 23:48

saifsmailbox98 added 2 commits March 30, 2026 15:46

Add docs

05cf160

Merge remote-tracking branch 'origin/main' into saif/pam-146-support-…

2334268

…mongodb-resources-in-pam # Conflicts: # backend/package-lock.json

x032205 requested changes Apr 3, 2026

View reviewed changes

Comment thread backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts Outdated

Comment thread backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts Outdated

saifsmailbox98 added 2 commits April 4, 2026 06:16

Move MongoDB out of SQL resource factory into standalone factory

e349a12

MongoDB doesn't use knex and isn't a SQL database — give it its own factory following the Redis/SSH pattern. Also replaces auth error string matching with MongoServerError error code 18.

saifsmailbox98 requested review from x032205 and removed request for sheensantoscapadngan April 6, 2026 22:32

x032205 requested changes Apr 7, 2026

View reviewed changes

saifsmailbox98 added 3 commits April 7, 2026 18:38

fix: shorten MongoDB connection string tooltip text

50fb7c9

fix: remove useless char

003da4e

saifsmailbox98 requested a review from x032205 April 7, 2026 14:56

saifsmailbox98 added 2 commits April 8, 2026 03:41

feat: add inline connection string validation to MongoDB resource form

c635b06

Validate MongoDB connection strings client-side so errors display inline in the form instead of as a toast/modal notification.

merge: resolve conflict with origin/main in pam-account-router imports

4d5a8c0

claude Bot reviewed Apr 7, 2026

View reviewed changes

Comment thread backend/src/ee/services/pam-account/pam-account-service.ts

Comment thread frontend/src/pages/pam/PamResourcesPage/components/PamResourceForm/MongoDBResourceForm.tsx Outdated

Comment thread backend/src/ee/services/pam-resource/mongodb/mongodb-resource-factory.ts

saifsmailbox98 added 2 commits April 8, 2026 03:53

feat: add MongoDB support to view credentials feature

524d6a5

x032205 approved these changes Apr 7, 2026

View reviewed changes

claude Bot reviewed Apr 7, 2026

View reviewed changes

x032205 requested changes Apr 7, 2026

View reviewed changes

saifsmailbox98 added 2 commits April 8, 2026 05:31

fix: add database name regex validation to MongoDB frontend form

3ee5f76

fix: update MongoDB docs to use connection string instead of host/port

3768141

x032205 approved these changes Apr 8, 2026

View reviewed changes

saifsmailbox98 merged commit e1b25f9 into main Apr 8, 2026
11 of 13 checks passed

Conversation

saifsmailbox98 commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Screenshots

Steps to verify the change

Type

Checklist

Uh oh!

linear Bot commented Mar 25, 2026

Uh oh!

maidul98 commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

greptile-apps Bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 3/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

saifsmailbox98 commented Mar 26, 2026

Uh oh!

saifsmailbox98 commented Mar 26, 2026

Uh oh!

Uh oh!

Uh oh!

gitguardian Bot commented Apr 3, 2026

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Uh oh!

gitguardian Bot commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Uh oh!

Uh oh!

Uh oh!

x032205 commented Apr 4, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

x032205 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

saifsmailbox98 commented Mar 25, 2026 •

edited

Loading

maidul98 commented Mar 25, 2026 •

edited

Loading

greptile-apps Bot commented Mar 25, 2026 •

edited

Loading

gitguardian Bot commented Apr 3, 2026 •

edited

Loading