fix(NODE-6743)!: add back missing opt deps aws4

[mr-pinzhang]

Description

https://jira.mongodb.org/browse/NODE-6743

What is changing?

the original PR is #2606, but seems like opt dep aws4 is getting lost since v3. starting from v4, there is no stricted opt dep under package.json. this PR is to add it back.

this issue affects all mongodb versions after v4, which might need to be patched to: v6.13.0, v5.9.2, v4.17.2

Is there new documentation needed for these changes?

n/a

What is the motivation for this change?

make developers life easier, since people might don't know what's happening until they see the error message on production env when using mongo aws.

[Error] Optional module `aws4` not found. Please install it to enable AWS authentication

Release Highlight

Fill in title or leave empty for no highlight

Double check the following

• Ran npm run check:lint script
• Self-review completed using the steps outlined here
• PR title follows the correct format: type(NODE-xxxx)[!]: description
  • Example: feat(NODE-1234)!: rewriting everything in coffeescript
• Changes are covered by tests
• New TODOs have a related JIRA ticket

[mr-pinzhang]

not sure whether it's ok to remove this command.

[mr-pinzhang]

this one too, seems like no longer needed.

[mr-pinzhang]

after using the typings from @types/aws4, options.headers becomes optional. converting those values to hard-coded string type.

[nbbeeken]

Hi @mr-pinzhang, we would prefer to remove our dependence on this package as the logic contained within sign is rather small and should be something the driver owns as part of its authentication workflow given the inclusion in drivers specification. For the time being we do have documentation calling out the need for this package here: https://www.mongodb.com/docs/drivers/node/current/fundamentals/authentication/mechanisms/#mongodb-aws

We have https://jira.mongodb.org/browse/NODE-5393 to track the removal if you're interested in contributing; otherwise, we intend to work on it soon. Thanks for reaching out and taking the time to lend a hand here, we appreciate it!

[mr-pinzhang]

Hi @mr-pinzhang, we would prefer to remove our dependence on this package as the logic contained within sign is rather small and should be something the driver owns as part of its authentication workflow given the inclusion in drivers specification. For the time being we do have documentation calling out the need for this package here: https://www.mongodb.com/docs/drivers/node/current/fundamentals/authentication/mechanisms/#mongodb-aws

We have https://jira.mongodb.org/browse/NODE-5393 to track the removal if you're interested in contributing; otherwise, we intend to work on it soon. Thanks for reaching out and taking the time to lend a hand here, we appreciate it!

Thanks for the heads up! Yeah, I agree we are going to move aws credentials to the driver's side. But my concern is that when someone is installing npm MongoDB, missing dep aws4 might be neglected if the user doesn't read the doc carefully (it happens to me 🫢). So one question: do we have some expected timeline for NODE-5393? if it's going to take a long time, fixing up package.json optional deps feels like a good idea to me for now. Just my 2 cents.

Anyway, my concern might make no sense. Let me know if you guys need any help, thanks!

[nbbeeken]

Your concern totally makes sense and it is a point of friction for us to address. We intend to get to it in a few months, which sounds long but scaled against this being an untracked peer dependency since at least 3.6.0 feels pretty soon. Introducing the real peer dep tracking comes with a degree of complexity we will just end up removing soon.

It isn't a great experience and we're sorry you hit this snag, it'll be better soon :)