Skip to content

fix(plugin-mongodb): Atlas connect crash, TLS -9838, Unauthorized on import#1251

Merged
datlechin merged 3 commits into
mainfrom
fix/mongodb-atlas-connect-issues
May 13, 2026
Merged

fix(plugin-mongodb): Atlas connect crash, TLS -9838, Unauthorized on import#1251
datlechin merged 3 commits into
mainfrom
fix/mongodb-atlas-connect-issues

Conversation

@datlechin
Copy link
Copy Markdown
Member

Summary

Fixes three independent MongoDB Atlas connect bugs surfaced after upgrading to macOS 26. Each was hit by a real user (#1249 crash report, follow-up TLS error, follow-up Unauthorized on URL import).

  • Crash (TablePro 0.40.3 crashes with MongoDB driver on macOS 26 (Apple Silicon) #1249)MongoDBConnection.serverVersion() did queue.sync on a queue it was already running on whenever the cache was cold and the call came from inside an on-queue block (e.g. listDatabasesSync). Triggered dispatch_sync called on queue already owned by current thread BREAKPOINT on every fresh connect. Fixed by detecting on-queue re-entry via a per-instance DispatchSpecificKey and calling fetchServerVersionSync() directly when already on the queue.
  • TLS handshake fails on macOS 26 with errSSLPeerInternalError (-9838) against Atlas. Root cause: libmongoc was built with Apple Secure Transport (MONGOC_ENABLE_SSL_SECURE_TRANSPORT=1), which now misnegotiates TLS 1.3 with Atlas on macOS 26. OpenSSL handshake works against the same endpoints (verified with openssl s_client). Rebuilt libmongoc 1.28.1 with OpenSSL 3.4.3 backend; the app already bundles OpenSSL dylibs for Redis/MSSQL/MySQL so the link surface is unchanged.
  • Import URL gives Unauthenticated when the URL has no database path. MongoDBPluginDriver.connect() called listDatabases on admin for any connection without an explicit DB; Atlas users restricted to a single database lack listDatabases privilege and the call threw, killing the connection. Two-part fix: pass authorizedDatabases: true (MongoDB 4.0+) so the server filters to databases the user can actually see, and don't kill the connection when listDatabases still fails (auth was verified by the ping during connect() itself).

Out-of-band release work already done

  • Libs/libmongoc{,_arm64,_x86_64,_universal}.a and Libs/libbson*.a rebuilt with OpenSSL backend.
  • tablepro-libs-v1.tar.gz re-uploaded to the libs-v1 GitHub release so CI and fresh clones pick up the new statics. Libs/checksums.sha256 in this PR matches the uploaded archive.
  • Plugins/MongoDBDriverPlugin/CLibMongoc/include/mongoc/mongoc-config.h regenerated to flip MONGOC_ENABLE_SSL_* defines.
  • MongoDBDriver target link flags updated: dropped -framework Security/CoreFoundation, added -lssl.3 -lcrypto.3, extended LIBRARY_SEARCH_PATHS / LD_RUNPATH_SEARCH_PATHS to include Libs/dylibs.

Follow-up (not in this PR)

MongoDB is a registry-only plugin. After merge, re-tag plugin-mongodb-v<next> so CI publishes a ZIP, then bump plugins.json in TableProApp/plugins (version, downloadURL, sha256 for both architectures).

Test plan

  • Reproduce TablePro 0.40.3 crashes with MongoDB driver on macOS 26 (Apple Silicon) #1249 crash on macOS 26 with stock MongoDBDriver 1.0.22; confirm rebuilt plugin no longer crashes on connect.
  • OpenSSL s_client handshake against ac-h69imyr-shard-00-00.7uzbwhl.mongodb.net:27017 succeeds (control for layer where -9838 originates).
  • nm Libs/libmongoc_arm64.a shows OpenSSL symbols (SSL_CTX_new) and zero Secure Transport references (SSLHandshake, SSLCreateContext).
  • otool -L MongoDBDriver shows @rpath/libssl.3.dylib and @rpath/libcrypto.3.dylib, no Security framework.
  • Test Atlas SRV connect with restricted-database user via Import URL flow with no /db path; previously returned Unauthorized, should now succeed.
  • Test Atlas SRV connect with admin user; listDatabases should still return the full list.
  • Test classic non-Atlas MongoDB connect (no SRV) to make sure the OpenSSL backend still talks to plain TLS / unencrypted MongoDB.

@datlechin datlechin changed the title fix(plugin-mongodb): Atlas connect — crash, TLS -9838, Unauthorized on import fix(plugin-mongodb): Atlas connect crash, TLS -9838, Unauthorized on import May 13, 2026
@datlechin datlechin merged commit 2e1e4ed into main May 13, 2026
1 of 2 checks passed
@datlechin datlechin deleted the fix/mongodb-atlas-connect-issues branch May 13, 2026 08:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant