jstests/auth/clac_system_colls.js
// Verify that system collections are treated correctly
Verify that system collections are treated correctly
Verify that system collections are treated correctly
function runTest(admindb) {
    var authzErrorCode = 13;
    admindb.createUser({user: "admin", pwd: "pwd", roles: ["userAdminAnyDatabase"]});
    assert.eq(1, admindb.auth("admin", "pwd"));
    var sysCollections = ["system.indexes", "system.js", "system.namespaces",
                       "system.profile", "system.roles", "system.users"];
    var sysPrivs = new Array();
    for (var i in sysCollections) {
        sysPrivs.push({resource: {db:admindb.getName(), collection:sysCollections[i]},
                      actions:['find']});
    }
    var findPriv = {resource: {db:admindb.getName(), collection:""},
                    actions:['find']};
    admindb.createRole({role:"FindInDB",
                        roles:[],
                        privileges:[findPriv]});
    admindb.createRole({role:"FindOnSysRes",
                        roles:[],
                        privileges:sysPrivs});
    admindb.createUser({user:"sysUser", pwd:"pwd", roles:["FindOnSysRes"]});
    admindb.createUser({user:"user", pwd:"pwd", roles:["FindInDB"]});
    assert.eq(1,admindb.auth("user", "pwd"));
    assert.doesNotThrow(function() {admindb.foo.findOne();});
    for (var i in sysCollections) {
        assert.commandFailed(admindb.runCommand({count:sysCollections[i]}));
    }
    assert.eq(1,admindb.auth("sysUser", "pwd"));
    assert.throws(function() {admindb.foo.findOne();});
    for (var i in sysCollections) {
        assert.commandWorked(admindb.runCommand({count:sysCollections[i]}));
    }
    admindb.logout();
}
function runTest ( admindb ) { var authzErrorCode = 13 ; admindb . createUser ( { user : "admin" , pwd : "pwd" , roles : [ "userAdminAnyDatabase" ] } ) ; assert . eq ( 1 , admindb . auth ( "admin" , "pwd" ) ) ; var sysCollections = [ "system.indexes" , "system.js" , "system.namespaces" , "system.profile" , "system.roles" , "system.users" ] ; var sysPrivs = new Array ( ) ; for ( var i in sysCollections ) { sysPrivs . push ( { resource : { db : admindb . getName ( ) , collection : sysCollections [ i ] } , actions : [ 'find' ] } ) ; } var findPriv = { resource : { db : admindb . getName ( ) , collection : "" } , actions : [ 'find' ] } ; admindb . createRole ( { role : "FindInDB" , roles : [ ] , privileges : [ findPriv ] } ) ; admindb . createRole ( { role : "FindOnSysRes" , roles : [ ] , privileges : sysPrivs } ) ; admindb . createUser ( { user : "sysUser" , pwd : "pwd" , roles : [ "FindOnSysRes" ] } ) ; admindb . createUser ( { user : "user" , pwd : "pwd" , roles : [ "FindInDB" ] } ) ; assert . eq ( 1 , admindb . auth ( "user" , "pwd" ) ) ; assert . doesNotThrow ( function ( ) { admindb . foo . findOne ( ) ; } ) ; for ( var i in sysCollections ) { assert . commandFailed ( admindb . runCommand ( { count : sysCollections [ i ] } ) ) ; } assert . eq ( 1 , admindb . auth ( "sysUser" , "pwd" ) ) ; assert . throws ( function ( ) { admindb . foo . findOne ( ) ; } ) ; for ( var i in sysCollections ) { assert . commandWorked ( admindb . runCommand ( { count : sysCollections [ i ] } ) ) ; } admindb . logout ( ) ; }
Verify that system collections are treated correctly
Verify that system collections are treated correctly
// Verify the find on all collections exludes system collections // Verify that find on system collections gives find permissions