fix(data-service): use databases where user has built in roles in listDatabases COMPASS-5691
#2959
Conversation
| // NB: Order is important, we want listed collections to take precedence | ||
| // if they were fetched successfully | ||
| [...databasesFromPrivileges, ...listedDatabases], | ||
| [...databasesFromRoles, ...databasesFromPrivileges, ...listedDatabases], |
There was a problem hiding this comment.
I'm trying to make sense of the comment that was here before. Where's listed collections coming from?
There was a problem hiding this comment.
I'm assuming this is a merge of databases taken from the privileges and the result of adminDb.command({listDatabases: ...}) + adminDb.command({listCollections: dbName}), probably the db objects returned by the commands are more accurate than the privileges one.
Databases taken from privileges are useful cause admins may assign privileges to non existing dbs or collections that would not show up otherwise.
|
The ubuntu failure is a flake (something about the timing of that leafygreen component I don't understand well enough to reliably work around) and the others are failing due to 5.3. Should be fixed by #2962 |
|
I updated the branch so long to pull in the e2e fix for 5.3 |
Anemy
deleted the
COMPASS-5691-use-built-in-roles-for-displaying-databases
branch
3 participants
COMPASS-5691 https://github.com/mongodb-js/compass/issues/2953
Description
Atlas shared tier clusters (serverless, M0, M2) with MongoDB server version 5+ do not currently return privileges with the
connectionStatuscommand response (fix might be in soon/already w/ CLOUDP-115805). It also fails tolistDatabases. As a result, currently a user with permissions to only one database would not be able to see their database.While there may be a release of Atlas soon making this issue go away, the changes in this PR introduce a workaround so users with exclusive database permissions can use their databases. These changes expand our extra
listDatabasesaffordances by referencing the authenticatedUserRoles in theconnectionStatusresponse. We then add all of the databases where a user has any of theread,readWrite,dbAdmin,dbOwnerbuilt-in roles.Motivation and Context
Open Questions
Is there another way to get this information? Is there anything we can do for cases where users are using custom roles with custom privileges for their access management?
Types of changes