synopse

c:\Temp\tempbuild\exe>mormot2tests

   mORMot2 Regression Tests
  --------------------------


1. Core units

 1.1. Core base:
  - Records: 2,110 assertions passed  449us

synopse

Great — then I’ll go end-to-end, at the level that should be actionable for a mORMot2 maintainer, not hand-wavy.

I’ll structure this into the four requested parts, but you’ll see they naturally fit together.

---

1. Minimal DuckDB C API binding for mORMot2

1.1 Scope discipline (critical)

synopse

C:\Users\administrator\x64>mormot2tests -t coreecc -t crypto.bench

   mORMot2 Regression Tests
  --------------------------


1. Core units

 1.4. Core crypto:
  - Benchmark: 152,535 assertions passed  2.15s

synopse

C:\test>mormot2tests -t coreecc -t crypto.bench

   mORMot2 Regression Tests
  --------------------------


1. Core units

 1.4. Core crypto:
  - Benchmark: 152,535 assertions passed  4.02s

synopse

As of late 2025, after an exhaustive search across GitHub, forums, documentation, and general web sources — no, there is still no other solution (open-source or proprietary) that comes anywhere close to what mORMot 2's THttpPeerCache does in the exact niche you're targeting:

• A transparent forward HTTP/HTTPS caching proxy
• With automatic UDP-multicast peer discovery (WS-Discovery style)
• Live streaming to concurrent requesters (one upstream connection → many local peers get the data in real time)
• Whole-object level but with the smart “one wins and feeds the others instantly” behavior you described
• Fully cross-platform native code (Windows + Linux + macOS out of the box, no WSL/Java/mono required)

Closest things that exist (and why they don’t match)

synopse

mORMot 2's MongoDB client (in mormot.db.nosql.mongodb.pas) currently supports only MONGODB-CR (deprecated) and SCRAM-SHA-1 for authentication in TMongoClient.Auth. It lacks native support for SCRAM-SHA-256, the default mechanism in MongoDB 4.0+ (and required for many modern deployments like Atlas clusters with stricter security).

Current Status

• The TMongoClient.Auth method checks an enumeration like TMongoAuthMechanism = (maCR, maSHA1) and implements the old MONGODB-CR nonce-based flow or the SCRAM-SHA-1 conversation.
• No maSHA256 option exists, and the SCRAM code uses SHA-1 digests (from SynCommons SHA-1 functions).
• mORMot 2's own internal authentication (e.g., for REST servers) supports full SCRAM (including SHA-256 variants and even PBKDF2/SHA3), but the MongoDB client layer has not been updated for SCRAM-SHA-256 yet.

What Needs to Be Done to Add SCRAM-SHA-256

To add it properly (cleanly, without breaking existing code):

synopse

c:\Temp\tempbuild\exe>mormot2tests

   mORMot2 Regression Tests
  --------------------------


1. Core units

 1.1. Core base:

synopse

Differences Between SCRAM-SHA-1 and SCRAM-SHA-256 in MongoDB

SCRAM (Salted Challenge Response Authentication Mechanism) is MongoDB's default authentication method, based on IETF RFC 5802 (for SHA-1) and RFC 7677 (for SHA-256). Both variants follow a similar challenge-response flow to avoid sending plaintext passwords over the wire, but they differ in security, hashing, and MongoDB-specific tweaks. SCRAM-SHA-256 became the default in MongoDB 4.0+ due to SHA-1's deprecation and known weaknesses (e.g., collision vulnerabilities).

Here's a comparison:

Aspect	SCRAM-SHA-1	SCRAM-SHA-256
Hashing Algorithm	SHA-1 (160-bit output)

synopse

No, you cannot connect to MongoDB using SCRAM-SHA-256 authentication for a user that was explicitly created with only the SCRAM-SHA-1 mechanism (i.e., specifying mechanisms: ["SCRAM-SHA-1"] in db.createUser()).

Here's why:

• When creating a user, the mechanisms field determines which SCRAM variants' credentials are stored for that user. SCRAM-SHA-1 and SCRAM-SHA-256 are distinct: the former uses SHA-1 hashing, while the latter uses SHA-256 and requires server-side password digestion (passwordDigestor: "server").
• If only SCRAM-SHA-1 is specified, the server stores only the corresponding salted password verifier for that mechanism. Attempting SCRAM-SHA-256 authentication will fail because the server lacks the SHA-256 credentials for the user.
• By default (without specifying mechanisms), MongoDB creates users with both SCRAM-SHA-1 and SCRAM-SHA-256 credentials, allowing clients to authenticate using either. You can also explicitly add both via mechanisms: ["SCRAM-SHA-1", "SCRAM-SHA-256"]

synopse

   mORMot2 Regression Tests
  --------------------------


1. Core units

 1.1. Core base:
  - Records: 893 assertions passed  641us
  - TSynList: 3,007 assertions passed  150us