From 87096c6d02b4e8eb08fd171e1a39a1fe0540a9e7 Mon Sep 17 00:00:00 2001
From: Aleksander Binion <alek.binion@mongodb.com>
Date: Sat, 10 Sep 2022 22:41:24 -0400
Subject: [PATCH 1/3] passing tests

---
 src/connection_string.ts                    |  8 ++++----
 test/unit/assorted/uri_options.spec.test.ts | 10 ----------
 2 files changed, 4 insertions(+), 14 deletions(-)

diff --git a/src/connection_string.ts b/src/connection_string.ts
index 3b0bb2dd7a2..11d4d7abcd2 100644
--- a/src/connection_string.ts
+++ b/src/connection_string.ts
@@ -169,10 +169,10 @@ export function resolveSRVRecord(options: MongoOptions, callback: Callback<HostA
  * @param options - The options used for options parsing
  * @throws MongoParseError if TLS options are invalid
  */
-export function checkTLSOptions(options: AnyOptions): void {
-  if (!options) return;
+export function checkTLSOptions(allOptions: CaseInsensitiveMap): void {
+  if (!allOptions) return;
   const check = (a: string, b: string) => {
-    if (Reflect.has(options, a) && Reflect.has(options, b)) {
+    if (allOptions.has(a) && allOptions.has(b)) {
       throw new MongoParseError(`The '${a}' option cannot be used with '${b}'`);
     }
   };
@@ -436,7 +436,7 @@ export function parseOptions(
     mongoOptions.dbName = 'test';
   }
 
-  checkTLSOptions(mongoOptions);
+  checkTLSOptions(allOptions);
 
   if (options.promiseLibrary) PromiseProvider.set(options.promiseLibrary);
 
diff --git a/test/unit/assorted/uri_options.spec.test.ts b/test/unit/assorted/uri_options.spec.test.ts
index a5e6a195948..8420ff38709 100644
--- a/test/unit/assorted/uri_options.spec.test.ts
+++ b/test/unit/assorted/uri_options.spec.test.ts
@@ -10,16 +10,6 @@ describe('URI option spec tests', function () {
     // Skipped because this does not apply to Node
     'Valid options specific to single-threaded drivers are parsed correctly',
 
-    // TODO(NODE-3921): fix tls option validation
-    'tlsInsecure and tlsAllowInvalidCertificates both present (and true) raises an error',
-    'tlsInsecure and tlsAllowInvalidCertificates both present (and false) raises an error',
-    'tlsAllowInvalidCertificates and tlsInsecure both present (and true) raises an error',
-    'tlsAllowInvalidCertificates and tlsInsecure both present (and false) raises an error',
-    'tlsAllowInvalidHostnames and tlsInsecure both present (and true) raises an error',
-    'tlsAllowInvalidHostnames and tlsInsecure both present (and false) raises an error',
-    'tlsInsecure and tlsAllowInvalidHostnames both present (and true) raises an error',
-    'tlsInsecure and tlsAllowInvalidHostnames both present (and false) raises an error',
-
     // TODO(NODE-3922): have not implemented option support
     'tlsDisableCertificateRevocationCheck can be set to true',
     'tlsDisableCertificateRevocationCheck can be set to false',

From 8b0ba59b4142237adaf19fa5bbe8c6195d2e34a0 Mon Sep 17 00:00:00 2001
From: Aleksander Binion <alek.binion@mongodb.com>
Date: Sun, 11 Sep 2022 13:46:53 -0400
Subject: [PATCH 2/3] remove export, update doc comment, change error type,
 move check

---
 src/connection_string.ts | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/src/connection_string.ts b/src/connection_string.ts
index 11d4d7abcd2..ba2d7a5505f 100644
--- a/src/connection_string.ts
+++ b/src/connection_string.ts
@@ -29,7 +29,6 @@ import { ReadConcern, ReadConcernLevel } from './read_concern';
 import { ReadPreference, ReadPreferenceMode } from './read_preference';
 import type { TagSet } from './sdam/server_description';
 import {
-  AnyOptions,
   Callback,
   DEFAULT_PK_FACTORY,
   emitWarning,
@@ -166,14 +165,14 @@ export function resolveSRVRecord(options: MongoOptions, callback: Callback<HostA
 /**
  * Checks if TLS options are valid
  *
- * @param options - The options used for options parsing
- * @throws MongoParseError if TLS options are invalid
+ * @param allOptions - all options provided by user
+ * @throws MongoAPIError if TLS options are invalid
  */
-export function checkTLSOptions(allOptions: CaseInsensitiveMap): void {
+function checkTLSOptions(allOptions: CaseInsensitiveMap): void {
   if (!allOptions) return;
   const check = (a: string, b: string) => {
     if (allOptions.has(a) && allOptions.has(b)) {
-      throw new MongoParseError(`The '${a}' option cannot be used with '${b}'`);
+      throw new MongoAPIError(`The '${a}' option cannot be used with the '${b}' option`);
     }
   };
   check('tlsInsecure', 'tlsAllowInvalidCertificates');
@@ -369,6 +368,8 @@ export function parseOptions(
     }
   }
 
+  checkTLSOptions(allOptions);
+
   const unsupportedOptions = setDifference(
     allKeys,
     Array.from(Object.keys(OPTIONS)).map(s => s.toLowerCase())
@@ -436,8 +437,6 @@ export function parseOptions(
     mongoOptions.dbName = 'test';
   }
 
-  checkTLSOptions(allOptions);
-
   if (options.promiseLibrary) PromiseProvider.set(options.promiseLibrary);
 
   const lbError = validateLoadBalancedOptions(hosts, mongoOptions, isSRV);

From 5bcf4a76047714ef4da567ef1a738be1f4ec0c4b Mon Sep 17 00:00:00 2001
From: Aleksander Binion <alek.binion@mongodb.com>
Date: Sun, 11 Sep 2022 15:08:45 -0400
Subject: [PATCH 3/3] tweak doc comment

---
 src/connection_string.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/connection_string.ts b/src/connection_string.ts
index ba2d7a5505f..edfaf4f9733 100644
--- a/src/connection_string.ts
+++ b/src/connection_string.ts
@@ -165,7 +165,7 @@ export function resolveSRVRecord(options: MongoOptions, callback: Callback<HostA
 /**
  * Checks if TLS options are valid
  *
- * @param allOptions - all options provided by user
+ * @param allOptions - All options provided by user or included in default options map
  * @throws MongoAPIError if TLS options are invalid
  */
 function checkTLSOptions(allOptions: CaseInsensitiveMap): void {