fix: decode error

Author: lalitadithya

store-client/pkg/datastore/providers/mongodb/watcher/watch_store.go

@@ -755,7 +755,15 @@ func constructMongoClientOptions(
 		// mirrored the ancestor type and produced bson.M. Change stream events and
 		// query results are read as bson.M and their nested fields are type-asserted
 		// as such throughout this package, so keep the v1 shape.
-		SetBSONOptions(&options.BSONOptions{DefaultDocumentM: true}).
+		//
+		// ObjectIDAsHexString likewise restores v1 behaviour: v2 refuses to decode
+		// an ObjectID into a Go string ("decoding an object ID into a string is not
+		// supported by default"), which breaks structs that bind `bson:"_id"` to a
+		// string field.
+		SetBSONOptions(&options.BSONOptions{
+			DefaultDocumentM:    true,
+			ObjectIDAsHexString: true,
+		}).
 		SetMonitor(otelmongo.NewMonitor(
 			otelmongo.WithTracerProvider(tracing.GetChildOnlyTracerProvider()),
 		))

store-client/pkg/datastore/providers/mongodb/watcher/watch_store_test.go

@@ -15,6 +15,7 @@
 package watcher
 
 import (
+	"bytes"
 	"context"
 	"crypto/rand"
 	"crypto/rsa"
@@ -369,6 +370,55 @@ func TestConstructMongoClientOptions_NoTLS(t *testing.T) {
 	}
 }
 
+// TestConstructMongoClientOptions_BSONOptions_PreserveV1DecodeShape guards the two
+// driver v1 -> v2 decode behaviour changes this package depends on:
+//
+//   - DefaultDocumentM: v2 decodes nested documents into bson.D; callers here
+//     type-assert bson.M.
+//   - ObjectIDAsHexString: v2 refuses to decode an ObjectID into a Go string, which
+//     breaks structs binding `bson:"_id"` to a string field (e.g. the latest-event
+//     lookup in fault-quarantine's CancelLatestQuarantiningEvents). Losing this
+//     silently turns manual-uncordon cancellation into a no-op.
+func TestConstructMongoClientOptions_BSONOptions_PreserveV1DecodeShape(t *testing.T) {
+	mongoConfig := MongoDBConfig{
+		URI:                      "mongodb://localhost:27017",
+		Database:                 "test",
+		Collection:               "test",
+		TotalPingTimeoutSeconds:  5,
+		TotalPingIntervalSeconds: 1,
+	}
+
+	opts, err := constructMongoClientOptions(mongoConfig)
+	require.NoError(t, err)
+	require.NotNil(t, opts.BSONOptions, "BSON options must be set")
+	require.True(t, opts.BSONOptions.DefaultDocumentM, "DefaultDocumentM must stay enabled")
+	require.True(t, opts.BSONOptions.ObjectIDAsHexString, "ObjectIDAsHexString must stay enabled")
+}
+
+// TestObjectIDDecodesIntoStringField documents the underlying driver behaviour the
+// option above compensates for: without it, decoding _id into a string fails.
+func TestObjectIDDecodesIntoStringField(t *testing.T) {
+	oid := bson.NewObjectID()
+
+	raw, err := bson.Marshal(bson.M{"_id": oid})
+	require.NoError(t, err)
+
+	var target struct {
+		ID string `bson:"_id"`
+	}
+
+	// Default v2 decoder: this is the failure seen in CI.
+	err = bson.Unmarshal(raw, &target)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "decoding an object ID into a string is not supported by default")
+
+	// With ObjectIDAsHexString the same document decodes to the hex string.
+	dec := bson.NewDecoder(bson.NewDocumentReader(bytes.NewReader(raw)))
+	dec.ObjectIDAsHexString()
+	require.NoError(t, dec.Decode(&target))
+	require.Equal(t, oid.Hex(), target.ID)
+}
+
 func TestConstructMongoClientOptions_DynamicClientCertificateUsesX509Auth(t *testing.T) {
 	caCertPEM, caKeyPEM, err := generateCA()
 	if err != nil {