From 4ed75e3e0e203b62cd57f0b42ece9a64e851ea44 Mon Sep 17 00:00:00 2001
From: Victor Santos <victor@infisical.com>
Date: Thu, 20 Nov 2025 20:00:54 -0300
Subject: [PATCH] fix: correct host normalization logic in MongoDB connection
 functions

---
 .../mongodb-credentials-rotation-fns.ts                   | 8 ++++----
 .../app-connection/mongodb/mongodb-connection-fns.ts      | 6 +++---
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/backend/src/ee/services/secret-rotation-v2/mongodb-credentials/mongodb-credentials-rotation-fns.ts b/backend/src/ee/services/secret-rotation-v2/mongodb-credentials/mongodb-credentials-rotation-fns.ts
index ef5b67216..688f90473 100644
--- a/backend/src/ee/services/secret-rotation-v2/mongodb-credentials/mongodb-credentials-rotation-fns.ts
+++ b/backend/src/ee/services/secret-rotation-v2/mongodb-credentials/mongodb-credentials-rotation-fns.ts
@@ -55,9 +55,9 @@ export const mongodbCredentialsRotationFactory: TRotationFactory<
 
     const isSrvFromHost = srvRegex.test(normalizedHost);
     if (isSrvFromHost) {
-      normalizedHost = normalizedHost.replace(srvRegex, "");
+      normalizedHost = srvRegex.replace(normalizedHost, "");
     } else if (protocolRegex.test(normalizedHost)) {
-      normalizedHost = normalizedHost.replace(protocolRegex, "");
+      normalizedHost = protocolRegex.replace(normalizedHost, "");
     }
 
     const [hostIp] = await verifyHostInputValidity(normalizedHost);
@@ -77,12 +77,12 @@ export const mongodbCredentialsRotationFactory: TRotationFactory<
         username: authCredentials.username,
         password: authCredentials.password
       },
-      authSource: connection.credentials.database,
+      authSource: isSrv ? undefined : connection.credentials.database,
       directConnection: !isSrv
     };
 
     // SSL is enabled if explicitly enabled OR if using SRV (which requires TLS) and requireTlsForSrv is true
-    if (connection.credentials.sslEnabled || (isSrv && options?.requireTlsForSrv)) {
+    if (connection.credentials.sslEnabled) {
       clientOptions.tls = true;
       clientOptions.tlsInsecure = !connection.credentials.sslRejectUnauthorized;
       if (connection.credentials.sslCertificate) {
diff --git a/backend/src/services/app-connection/mongodb/mongodb-connection-fns.ts b/backend/src/services/app-connection/mongodb/mongodb-connection-fns.ts
index 84dfbcb66..9cad40175 100644
--- a/backend/src/services/app-connection/mongodb/mongodb-connection-fns.ts
+++ b/backend/src/services/app-connection/mongodb/mongodb-connection-fns.ts
@@ -24,9 +24,9 @@ export const validateMongoDBConnectionCredentials = async (config: TMongoDBConne
   let normalizedHost = config.credentials.host.trim();
   const isSrvFromHost = srvRegex.test(normalizedHost);
   if (isSrvFromHost) {
-    normalizedHost = normalizedHost.replace(srvRegex, "");
+    normalizedHost = srvRegex.replace(normalizedHost, "");
   } else if (protocolRegex.test(normalizedHost)) {
-    normalizedHost = normalizedHost.replace(protocolRegex, "");
+    normalizedHost = protocolRegex.replace(normalizedHost, "");
   }
 
   const [hostIp] = await verifyHostInputValidity(normalizedHost);
@@ -48,7 +48,7 @@ export const validateMongoDBConnectionCredentials = async (config: TMongoDBConne
         username: config.credentials.username,
         password: config.credentials.password
       },
-      authSource: config.credentials.database,
+      authSource: isSrv ? undefined : config.credentials.database,
       directConnection: !isSrv
     };