[liran]

Weir accepted MongoDB credentials only with SCRAM-SHA-256 over tls=true. Many in-cluster MongoDB deployments authenticate with SCRAM but have no TLS. MongoDB Community Operator replica sets without a security.tls section are one example: every cluster in the deployment that Weir is meant to serve is set up this way. Weir could not connect to any of them, although other clients do today.

Authentication now requires an explicit tls option rather than tls=true. The rules:

• tls=false with SCRAM-SHA-256, authSource and separate credentials is accepted.
• tls=true behaves as before.
• Leaving tls out still fails, so plaintext is never a silent default.
• tls without credentials still fails.
• A CA file still requires tls=true.
• URI userinfo, other mechanisms and other options stay rejected.

With tls=false the SCRAM handshake and every command travel in plaintext, with nothing binding them together. Anyone who can see the traffic can read and change commands, guess the password offline from a captured handshake, or relay the handshake and use the authenticated connection with Weir's privileges. docs/configuration.md, the reference configuration and the code comment say this. They also say to prefer tls=true, to use tls=false only when the network path to every replica-set member (including discovered members) is trusted, and to use a long random password. A NetworkPolicy limits which Pods can connect but does not hide traffic from node or host-network access. Search authentication still requires HTTPS.

Tests:

• uri_test.go:
  • It accepts tls=false and TLS=false.
  • It rejects tls=FALSE, tls=0, conflicting tls=true&tls=false in either order, ssl=false, tls=false with tlsInsecure, tls=false with a CA file, and tls=false without credentials.
  • TestMongoDriverPlaintextAuthenticationOptions checks that tls=false keeps SCRAM authentication and sets no TLS config.
• TestMongoSCRAMWithoutTLSOpen (integration) runs against a SCRAM mongod that accepts both TLS and plaintext (--tlsMode preferTLS, via the new testmongo.OpenSecureAllowingPlaintext):
  • Weir opens with tls=false, writes and reads back.
  • The server's serverStatus counters show new connections but no new TLS handshakes. The baseline waits for the fixture's own monitoring connections to settle.
  • A wrong password fails with AuthenticationFailed (code 18).
  • Changing connectionOptions to enable TLS whenever tls is set makes both the unit test and this test fail.
• The other SCRAM/TLS integration tests still pass.

go vet ./..., go test ./... and go test -tags=integration -run TestMongoSCRAM ./internal/backend/mongodb (MongoDB 8.0.32) pass locally.