From f686b54e2be23786d7a4fdfb2be1260bbe5dc9fb Mon Sep 17 00:00:00 2001
From: Guillaume Racicot <guillaume.racicot@mongodb.com>
Date: Thu, 21 May 2026 12:12:18 -0400
Subject: [PATCH] SERVER-127260: Use passkey idiom instead of friending std
 functions (#54122)

GitOrigin-RevId: b33853087812e94b5f31e328c148485d4fce4e23
---
 src/mongo/db/auth/user_request_x509.cpp |  4 ++--
 src/mongo/db/auth/user_request_x509.h   | 16 +++++++---------
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/src/mongo/db/auth/user_request_x509.cpp b/src/mongo/db/auth/user_request_x509.cpp
index 57534d59418..14066222591 100644
--- a/src/mongo/db/auth/user_request_x509.cpp
+++ b/src/mongo/db/auth/user_request_x509.cpp
@@ -43,8 +43,8 @@ StatusWith<std::unique_ptr<UserRequest>> UserRequestX509::makeUserRequestX509(
     std::shared_ptr<const SSLPeerInfo> peerInfo,
     bool forReacquire,
     bool insertAuthenticatedMechanism) {
-    auto request =
-        std::make_unique<UserRequestX509>(std::move(name), std::move(roles), std::move(peerInfo));
+    auto request = std::make_unique<UserRequestX509>(
+        Passkey{}, std::move(name), std::move(roles), std::move(peerInfo));
 
     if (!forReacquire) {
         return std::unique_ptr<UserRequest>(std::move(request));
diff --git a/src/mongo/db/auth/user_request_x509.h b/src/mongo/db/auth/user_request_x509.h
index 430cccbd0fb..d49787d0bb2 100644
--- a/src/mongo/db/auth/user_request_x509.h
+++ b/src/mongo/db/auth/user_request_x509.h
@@ -51,14 +51,12 @@ namespace mongo {
  * SSLPeerInfo struct if they exist.
  */
 class UserRequestX509 : public UserRequestGeneral {
-public:
-    // We define this function as a friend so that makeUserRequestX509
-    // can use it.
-    friend std::unique_ptr<UserRequestX509> std::make_unique<UserRequestX509>(
-        mongo::UserName&& name,
-        boost::optional<std::set<mongo::RoleName>>&& roles,
-        std::shared_ptr<const mongo::SSLPeerInfo>&& peerInfo);
+private:
+    struct Passkey {
+        Passkey() = default;
+    };
 
+public:
     /**
      * Makes a new UserRequestX509. Toggling for re-acquire to true enables
      * a re-fetch of the roles from the certificate.
@@ -90,8 +88,8 @@ public:
 
     UserRequestCacheKey generateUserRequestCacheKey() const final;
 
-protected:
-    UserRequestX509(UserName name,
+    UserRequestX509(Passkey,
+                    UserName name,
                     boost::optional<std::set<RoleName>> roles,
                     std::shared_ptr<const SSLPeerInfo> peerInfo)
         : UserRequestGeneral(std::move(name), std::move(roles)), _peerInfo(std::move(peerInfo)) {}