/*

Declaratively defined tests for the authorization properties
of all database commands.

This file contains an array of test definitions, as well as
some shared test logic.

See jstests/auth/commands_builtinRoles.js and
jstests/auth/commands_userDefinedRoles.js for two separate implementations
of the test logic, respectively to test authorization with builtin roles
and authorization with user-defined roles.

Example test definition:

This tests that when run on the "roles_commands_1" database,
the given command will return an authorization error unless
the user has the role with key "readWrite" or the role with
key "readWriteAnyDatabase". The command will be run as a
user with each of the roles in the "roles" array below.

Similarly, this tests that when run on the "roles_commands_2"
database, only a user with role "readWriteAnyDatabase" should
be authorized.

    {
        testname: "aggregate_write",
        command: {aggregate: "foo", pipeline: [ {$out: "foo_out"} ] },
        testcases: [
            { runOnDb: "roles_commands_1", roles: {readWrite: 1, readWriteAnyDatabase: 1} },
            { runOnDb: "roles_commands_2", roles: {readWriteAnyDatabase: 1} }
        ]
    },

Additional options:

1) onSuccess

A test can provide an onSuccess callback, which is called when the command
is authorized and succeeds. The callback is passed a single parameter, which
is the document returned by the command.

2) expectFail

You can add "expectFail: true" to an individual element of the testcases
array. This means that if the command is authorized, then you still expect
it to fail with a non-auth related error. As always, for roles other than
those in the "roles" array, an auth error is expected.

3) expectAuthzFailure

Like "expectFailure", this option applies to an individual test case rather than
than the full test object.  When this option is true, it means the test case is
*not* testing that the given roles/privileges make the command authorized to run,
instead it makes it so it is testing that the given roles/privileges are *not* sufficient
to be authorized to run the command.

4) skipSharded

Add "skipSharded: true" if you want to run the test only on a standalone.

5) skipStandalone

Add "skipStandalone: true" if you want to run the test only in sharded
configuration.

6) setup

The setup function, if present, is called before testing whether a
particular role authorizes a command for a particular database.

7) teardown

The teardown function, if present, is called immediately after
testint whether a particular role authorizes a command for a
particular database.

*/

// constants
var firstDbName = "roles_commands_1";
var secondDbName = "roles_commands_2";
var adminDbName = "admin";
var authErrCode = 13;
var commandNotSupportedCode = 115;
var shard0name = "shard0000";

// useful shorthand when defining the tests below
var roles_write = {
    readWrite: 1,
    readWriteAnyDatabase: 1,
    dbOwner: 1,
    restore: 1,
    root: 1,
    __system: 1
};
var roles_read = {
    read: 1,
    readAnyDatabase: 1,
    readWrite: 1,
    readWriteAnyDatabase: 1,
    dbOwner: 1,
    backup: 1,
    root: 1,
    __system: 1
};
var roles_readAny = {
    readAnyDatabase: 1,
    readWriteAnyDatabase: 1,
    backup: 1,
    root: 1,
    __system: 1
};
var roles_dbAdmin = {
    dbAdmin: 1,
    dbAdminAnyDatabase: 1,
    dbOwner: 1,
    root: 1,
    __system: 1
};
var roles_dbAdminAny = {
    dbAdminAnyDatabase: 1,
    root: 1,
    __system: 1
};
var roles_writeDbAdmin = {
    readWrite: 1,
    readWriteAnyDatabase: 1,
    dbAdmin: 1,
    dbAdminAnyDatabase: 1,
    dbOwner: 1,
    root: 1,
    __system: 1
};
var roles_writeDbAdminAny = {
    readWriteAnyDatabase: 1,
    dbAdminAnyDatabase: 1,
    root: 1,
    __system: 1
};
var roles_readDbAdmin = {
    read: 1,
    readAnyDatabase: 1,
    readWrite: 1,
    readWriteAnyDatabase: 1,
    dbAdmin: 1,
    dbAdminAnyDatabase: 1,
    dbOwner: 1,
    root: 1,
    __system: 1
};
var roles_readDbAdminAny = {
    readAnyDatabase: 1,
    readWriteAnyDatabase: 1,
    dbAdminAnyDatabase: 1,
    root: 1,
    __system: 1
};
var roles_monitoring = {
    clusterMonitor: 1,
    clusterAdmin: 1,
    root: 1,
    __system: 1
};
var roles_hostManager = {
    hostManager: 1,
    clusterAdmin: 1,
    root: 1,
    __system: 1
};
var roles_clusterManager = {
    clusterManager: 1,
    clusterAdmin: 1,
    root: 1,
    __system: 1
};
var roles_all = {
    read: 1,
    readAnyDatabase: 1,
    readWrite: 1,
    readWriteAnyDatabase: 1,
    userAdmin: 1,
    userAdminAnyDatabase: 1,
    dbAdmin: 1,
    dbAdminAnyDatabase: 1,
    dbOwner: 1,
    clusterMonitor: 1,
    hostManager: 1,
    clusterManager: 1,
    clusterAdmin: 1,
    backup: 1,
    restore: 1,
    root: 1,
    __system: 1
};

var authCommandsLib = {



    /************* TEST CASES ****************/

    tests: [
        {
            testname: "addShard",
            command: {addShard: "x"},
            skipStandalone: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["addShard"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            // Test that clusterManager role has permission to run addTagRange
            testname: "addTagRange",
            command: {  // addTagRange is not a "real command"; it updates config.tags
                update: "tags",
                updates: [ {
                    q: {_id: { ns : "test.x" , min : 1 }},
                    u: {_id: { ns : "test.x" , min : 1 },
                    ns : "test.x"}
                } ] },
            skipStandalone: true,
            testcases: [
                {
                    runOnDb: "config",
                    roles: Object.extend({readWriteAnyDatabase: 1}, roles_clusterManager)
                }
            ]
        },
        {
            testname: "applyOps",
            command: {applyOps: "x"},
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: {__system: 1},
                    privileges: [
                        { resource: {anyResource: true}, actions: ["anyAction"] }
                    ],
                    expectFail: true
                },
                {
                    runOnDb: firstDbName,
                    roles: {__system: 1},
                    privileges: [
                        { resource: {anyResource: true}, actions: ["anyAction"] }
                    ],
                    expectFail: true
                }
            ]
        },
        {
            testname: "aggregate_readonly",
            command: {aggregate: "foo", pipeline: []},
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_read,
                    privileges: [
                        { resource: {db: firstDbName, collection: "foo"}, actions: ["find"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_readAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "foo"}, actions: ["find"] }
                    ]
                }
            ]
        },
        {
            testname: "aggregate_explain",
            command: {aggregate: "foo", explain: true, pipeline: [ {$match: {bar: 1}} ] },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_read,
                    privileges: [
                        { resource: {db: firstDbName, collection: "foo"}, actions: ["find"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_readAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "foo"}, actions: ["find"] }
                    ]
                }
            ]
        },
        {
            testname: "aggregate_write",
            command: {aggregate: "foo", pipeline: [ {$out: "foo_out"} ] },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: { readWrite: 1,
                             readWriteAnyDatabase: 1,
                             dbOwner: 1,
                             root: 1,
                             __system: 1},
                    privileges: [
                        { resource: {db: firstDbName, collection: "foo"}, actions: ["find"] },
                        { resource: {db: firstDbName, collection: "foo_out"}, actions: ["insert"] },
                        { resource: {db: firstDbName, collection: "foo_out"}, actions: ["remove"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: {readWriteAnyDatabase: 1, root: 1, __system: 1},
                    privileges: [
                        { resource: {db: secondDbName, collection: "foo"}, actions: ["find"] },
                        { resource: {db: secondDbName, collection: "foo_out"}, actions: ["insert"] },
                        { resource: {db: secondDbName, collection: "foo_out"}, actions: ["remove"] }
                    ]
                }
            ]
        },
        {
            testname: "aggregate_indexStats",
            command: {aggregate: "foo", pipeline: [{$indexStats: {}}]},
            setup: function (db) {
                db.createCollection("foo");
            },
            teardown: function (db) {
                db.foo.drop();
            },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: {
                        clusterMonitor: 1,
                        clusterAdmin: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        {resource: {anyResource: true}, actions: ["indexStats"]}
                    ]
                }
            ]
        },
        {
            testname: "appendOplogNote",
            command: {appendOplogNote: 1, data: {a: 1}},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles:  {
                        backup: 1,
                        clusterManager: 1,
                        clusterAdmin: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {cluster: true}, actions: ["appendOplogNote"] }
                    ],
                    expectFail: true, // because no replication enabled
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "authSchemaUpgrade",
            command: {authSchemaUpgrade: 1},
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: {
                        userAdminAnyDatabase: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {cluster: true}, actions: ["authSchemaUpgrade"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "buildInfo",
            command: {buildInfo: 1},
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_all,
                    privileges: [ ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_all,
                    privileges: [ ]
                }
            ]
        },
        {
            testname: "checkShardingIndex_firstDb",
            command: {checkShardingIndex: firstDbName + ".x", keyPattern: {_id: 1} },
            skipSharded: true,
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_read,
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["find"] }
                    ]
                }
            ]
        },
        {
            testname: "checkShardingIndex_secondDb",
            command: {checkShardingIndex: secondDbName + ".x", keyPattern: {_id: 1} },
            skipSharded: true,
            testcases: [
                {
                    runOnDb: secondDbName,
                    roles: roles_readAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["find"] }
                    ]
                }
            ]
        },
        {
            testname: "cleanupOrphaned",
            command: {cleanupOrphaned: firstDbName + ".x"},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["cleanupOrphaned"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "cloneCollection_1",
            command: {cloneCollection: firstDbName + ".x"},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_write,
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["insert", "createIndex"] }
                    ],
                    expectFail: true
                }
            ]
        },
        {
            testname: "cloneCollection_2",
            command: {cloneCollection: secondDbName + ".x"},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: secondDbName,
                    roles: {readWriteAnyDatabase: 1, restore: 1, root: 1, __system: 1},
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["insert", "createIndex"] }
                    ],
                    expectFail: true
                }
            ]
        },
        {
            testname: "cloneCollectionAsCapped",
            command: {cloneCollectionAsCapped: "x", toCollection: "y", size: 1000},
            skipSharded: true,
            setup: function (db) { db.x.save( {} ); },
            teardown: function (db) {
                db.x.drop();
                db.y.drop();
            },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: { readWrite: 1,
                             readWriteAnyDatabase: 1,
                             dbOwner: 1,
                             root: 1,
                             __system: 1
                           },
                    privileges: [
                        { resource: {db: firstDbName, collection: "y"}, actions: ["insert", "createIndex", "convertToCapped"] },
                        { resource: {db: firstDbName, collection: "x"}, actions: ["find"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: {readWriteAnyDatabase: 1, root: 1, __system: 1},
                    privileges: [
                        { resource: {db: secondDbName, collection: "y"}, actions: ["insert", "createIndex", "convertToCapped"] },
                        { resource: {db: secondDbName, collection: "x"}, actions: ["find"] }
                    ]
                }
            ]
        },
        {
            testname: "collMod",
            command: {collMod: "foo", usePowerOf2Sizes: true},
            setup: function (db) { db.foo.save( {} ); },
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: Object.extend({restore: 1}, roles_dbAdmin),
                    privileges: [
                        { resource: {db: firstDbName, collection: "foo"}, actions: ["collMod"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: Object.extend({restore:1}, roles_dbAdminAny),
                    privileges: [
                        { resource: {db: secondDbName, collection: "foo"}, actions: ["collMod"] }
                    ]
                }
            ]
        },
        {
            testname: "collStats",
            command: {collStats: "bar", scale: 1},
            setup: function (db) { db.bar.save( {} ); },
            teardown: function (db) { db.dropDatabase(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: {
                        read: 1,
                        readAnyDatabase: 1,
                        readWrite: 1,
                        readWriteAnyDatabase: 1,
                        dbAdmin: 1,
                        dbAdminAnyDatabase: 1,
                        dbOwner: 1,
                        clusterMonitor: 1,
                        clusterAdmin: 1,
                        backup: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {db: firstDbName, collection: "bar"}, actions: ["collStats"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: {
                        readAnyDatabase: 1,
                        readWriteAnyDatabase: 1,
                        dbAdminAnyDatabase: 1,
                        clusterMonitor: 1,
                        clusterAdmin: 1,
                        backup: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {db: secondDbName, collection: "bar"}, actions: ["collStats"] }
                    ]
                }
            ]
        },
        {
            testname: "compact",
            command: {compact: "foo"},
            skipSharded: true,
            setup: function (db) { db.foo.save( {} ); },
            teardown: function (db) { db.dropDatabase(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_dbAdmin,
                    privileges: [
                        { resource: {db: firstDbName, collection: "foo"}, actions: ["compact"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_dbAdminAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "foo"}, actions: ["compact"] }
                    ]
                }
            ]
        },
        {
            testname: "connectionStatus",
            command: {connectionStatus: 1},
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_all,
                    privileges: [ ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_all,
                    privileges: [ ]
                }
            ]
        },
        {
            testname: "connPoolStats",
            command: {connPoolStats: 1},
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_monitoring,
                    privileges: [
                        { resource: {cluster: true}, actions: ["connPoolStats"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_monitoring,
                    privileges: [
                        { resource: {cluster: true}, actions: ["connPoolStats"] }
                    ]
                }
            ]
        },
        {
            testname: "connPoolSync",
            command: {connPoolSync: 1},
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_hostManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["connPoolSync"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_hostManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["connPoolSync"] }
                    ]
                }
            ]
        },
        {
            testname: "convertToCapped",
            command: {convertToCapped: "toCapped", size: 1000},
            setup: function (db) { db.toCapped.save( {} ); },
            teardown: function (db) { db.toCapped.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_writeDbAdmin,
                    privileges: [
                        { resource: {db: firstDbName, collection: "toCapped"}, actions:["convertToCapped"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_writeDbAdminAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "toCapped"}, actions:["convertToCapped"] }
                    ]
                }
            ]
        },
        {
            testname: "copydb",
            command: {copydb: 1, fromdb: firstDbName, todb: secondDbName},
            skipSharded: true, // Does not work sharded due to SERVER-13080
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: {readWriteAnyDatabase: 1, root: 1, __system: 1},
                    privileges: [
                        { resource: {db: firstDbName, collection: ""}, actions:["find"] },
                        { resource: {db: firstDbName, collection: "system.js"}, actions:["find"] },
                        { resource: {db: secondDbName, collection: ""},
                          actions:["insert", "createIndex"] },
                        { resource: {db: secondDbName, collection: "system.js"}, actions:["insert"] },
                    ]
                },
            ]
        },
        {
            testname: "count",
            command: {count: "x"},
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_read,
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["find"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_readAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["find"] }
                    ]
                }
            ]
        },
        {
            testname: "create",
            command: {create: "x"},
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: Object.extend({restore:1}, roles_writeDbAdmin),
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["createCollection"] }
                    ]
                },
                {
                    runOnDb: firstDbName,
                    roles: Object.extend({restore:1}, roles_writeDbAdmin),
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["insert"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: Object.extend({restore:1}, roles_writeDbAdminAny),
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["createCollection"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: Object.extend({restore:1}, roles_writeDbAdminAny),
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["insert"] }
                    ]
                }
            ]
        },
        {
            testname: "create_capped",
            command: {create: "x", capped: true, size: 1000},
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_writeDbAdmin,
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["createCollection", "convertToCapped"] }
                    ]
                },
                {
                    runOnDb: firstDbName,
                    roles: roles_writeDbAdmin,
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["insert", "convertToCapped"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_writeDbAdminAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["createCollection", "convertToCapped"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_writeDbAdminAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["insert", "convertToCapped"] }
                    ]
                }
            ]
        },
        {
            testname: "createIndexes",
            command: {createIndexes: "x", indexes: [{ns: firstDbName + ".x", key: {a:1}, name: "a_1"}] },
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: Object.extend({readWrite: 1,
                                          readWriteAnyDatabase: 1,
                                          dbAdmin: 1,
                                          dbAdminAnyDatabase: 1,
                                          dbOwner: 1,
                                          restore: 1,
                                          root: 1,
                                          __system: 1}),
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["createIndex"] }
                    ]
                }
            ]
        },
        {
            testname: "currentOp",
            command: {currentOp: 1, $all: true},
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_monitoring,
                    privileges: [
                       { resource: {cluster: true}, actions: ["inprog"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
           ]
        },
        {
            testname: "currentOpCtx",
            command: {currentOpCtx: 1},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_monitoring,
                    privileges: [
                        { resource: {cluster: true}, actions: ["inprog"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_monitoring,
                    privileges: [
                        { resource: {cluster: true}, actions: ["inprog"] }
                    ]
                }
            ]
        },
        {
            testname: "dataSize_1",
            command: {dataSize: firstDbName + ".x"},
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_read,
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["find"] }
                    ]
                }
            ]
        },
        {
            testname: "dataSize_2",
            command: {dataSize: secondDbName + ".x"},
            testcases: [
                {
                    runOnDb: secondDbName,
                    roles: roles_readAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["find"] }
                    ]
                }
            ]
        },
        {
            testname: "dbHash",
            command: {dbHash: 1},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: { read: 1,
                             readAnyDatabase: 1,
                             readWrite: 1,
                             readWriteAnyDatabase: 1,
                             dbOwner: 1,
                             root: 1,
                             __system: 1
                           },
                    privileges: [
                        { resource: {db: firstDbName, collection: ""}, actions: ["dbHash"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: { readAnyDatabase: 1,
                             readWriteAnyDatabase: 1,
                             root: 1,
                             __system: 1
                           },
                    privileges: [
                        { resource: {db: secondDbName, collection: ""}, actions: ["dbHash"] }
                    ]
                }
            ]
        },
        {
            testname: "dbStats",
            command: {dbStats: 1, scale: 1024},
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: {
                        read: 1,
                        readAnyDatabase: 1,
                        readWrite: 1,
                        readWriteAnyDatabase: 1,
                        dbAdmin: 1,
                        dbAdminAnyDatabase: 1,
                        dbOwner: 1,
                        clusterMonitor: 1,
                        clusterAdmin: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {db: firstDbName, collection: ""}, actions: ["dbStats"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: {
                        readAnyDatabase: 1,
                        readWriteAnyDatabase: 1,
                        dbAdminAnyDatabase: 1,
                        clusterMonitor: 1,
                        clusterAdmin: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {db: secondDbName, collection: ""}, actions: ["dbStats"] }
                    ]
                }
            ]
        },
        {
            testname: "diagLogging",
            command: {diagLogging: 1},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_hostManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["diagLogging"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "distinct",
            command: {distinct: "coll", key: "a", query: {}},
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_read,
                    privileges: [
                        { resource: {db: firstDbName, collection: "coll"}, actions: ["find"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_readAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "coll"}, actions: ["find"] }
                    ]
                }
            ]
        },
        {
            testname: "drop",
            command: {drop: "x"},
            setup: function (db) { db.x.save({}); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: Object.extend({restore: 1}, roles_writeDbAdmin),
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["dropCollection"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: Object.extend({restore: 1}, roles_writeDbAdminAny),
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["dropCollection"] }
                    ]
                }
            ]
        },
        {
            testname: "dropDatabase",
            command: {dropDatabase: 1},
            setup: function (db) { db.x.save({}); },
            teardown: function (db) { db.x.save({}); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: {
                        dbAdmin: 1,
                        dbAdminAnyDatabase: 1,
                        dbOwner: 1,
                        clusterAdmin: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {db: firstDbName, collection: ""}, actions: ["dropDatabase"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: {
                        dbAdminAnyDatabase: 1,
                        clusterAdmin: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {db: secondDbName, collection: ""}, actions: ["dropDatabase"] }
                    ]
                }
            ]
        },
        {
            testname: "dropIndexes",
            command: {dropIndexes: "x", index: "*"},
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_writeDbAdmin,
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["dropIndex"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_writeDbAdminAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["dropIndex"] }
                    ]
                }
            ]
        },
        {
            testname: "enableSharding",
            command: {enableSharding: "x"},
            skipStandalone: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {db: "x", collection: ""}, actions: ["enableSharding"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "eval",
            command: {$eval: function () { print("noop"); } },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: {__system: 1},
                    privileges: [
                        { resource: {anyResource: true}, actions: ["anyAction"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: {__system: 1},
                    privileges: [
                        { resource: {anyResource: true}, actions: ["anyAction"] }
                    ]
                }
            ]
        },
        {
            testname: "features",
            command: {features: 1},
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_all,
                    privilegesRequired: [ ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_all,
                    privilegesRequired: [ ]
                }
            ]
        },
        {
            testname: "filemd5",
            command: {filemd5: 1, root: "fs"},
            setup: function (db) {
                db.fs.chunks.drop();
                db.fs.chunks.insert({files_id: 1, n: 0, data: new BinData(0, "test")});
                db.fs.chunks.ensureIndex({files_id: 1, n: 1});
            },
            teardown: function (db) {
                db.fs.chunks.drop();
            },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_read,
                    privileges: [
                        { resource: {db: firstDbName, collection: ""}, actions: ["find"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_readAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: ""}, actions: ["find"] }
                    ]
                }
            ]
        },
        {
            testname: "find",
            command: {find: "foo"},
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_read,
                    privileges: [
                        { resource: {db: firstDbName, collection: "foo"}, actions: ["find"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_readAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "foo"}, actions: ["find"] }
                    ]
                }
            ]
        },
        {
            testname: "findWithTerm",
            command: {find: "foo", limit: -1, term: NumberLong(1)},
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: {__system: 1},
                    privileges: [
                        { resource: {db: firstDbName, collection: "foo"}, actions: ["find"] },
                        { resource: {cluster: true}, actions: ["internal"] }
                    ],
                    expectFail: true // because of invalid limit
                },
            ]
        },
        {
            testname: "findAndModify",
            command: {findAndModify: "x", query: {_id: "abc"}, update: {$inc: {n: 1}}},
            setup: function (db) {
                db.x.drop();
                db.x.save( {_id: "abc", n: 0} );
            },
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: { readWrite: 1,
                             readWriteAnyDatabase: 1,
                             dbOwner: 1,
                             root: 1,
                             __system: 1
                           },
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["find", "update"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: {readWriteAnyDatabase: 1, root: 1, __system: 1},
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["find", "update"] }
                    ]
                }
            ]
        },
        {
            testname: "flushRouterConfig",
            command: {flushRouterConfig: 1},
            skipStandalone: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: Object.extend({clusterManager: 1}, roles_hostManager),
                    privileges: [
                        { resource: {cluster: true}, actions: ["flushRouterConfig"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "fsync",
            command: {fsync: 1},
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_hostManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["fsync"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "fsyncUnlock",
            command: {fsyncUnlock: 1},
            skipSharded: true, // TODO: remove when fsyncUnlock is implemented in mongos
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_hostManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["unlock"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "geoNear",
            command: {geoNear: "x", near: [50, 50], num: 1},
            setup: function (db) {
                db.x.drop();
                db.x.save({loc: [50, 50]});
                db.x.ensureIndex({loc: "2d"});
            },
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_read,
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["find"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_readAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["find"] }
                    ]
                }
            ]
        },
        {
            testname: "geoSearch",
            command: {geoSearch: "x", near: [50, 50], maxDistance: 6, limit: 1, search: {} },
            skipSharded: true,
            setup: function (db) {
                db.x.drop();
                db.x.save({loc: {long: 50, lat: 50}});
                db.x.ensureIndex({loc: "geoHaystack", type: 1}, {bucketSize: 1});
            },
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_read,
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["find"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_readAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["find"] }
                    ]
                }
            ]
        },
        {
            testname: "getCmdLineOpts",
            command: {getCmdLineOpts: 1},
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_monitoring,
                    privileges: [
                        { resource: {cluster: true}, actions: ["getCmdLineOpts"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "getLastError",
            command: {getLastError: 1},
            testcases: [
                { runOnDb: firstDbName, roles: roles_all, privileges: [ ] },
                { runOnDb: secondDbName, roles: roles_all, privileges: [ ] }
            ]
        },
        {
            testname: "getLog",
            command: {getLog: "*"},
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_monitoring,
                    privileges: [
                        { resource: {cluster: true}, actions: ["getLog"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "getMore",
            command: {getMore: NumberLong("1"), collection: "foo"},
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_read,
                    privileges: [
                        { resource: {db: firstDbName, collection: "foo"}, actions: ["find"] }
                    ],
                    expectFail: true
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_readAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "foo"}, actions: ["find"] }
                    ],
                    expectFail: true
                }
            ]
        },
        {
            testname: "getMoreWithTerm",
            command: {getMore: NumberLong("1"), collection: "foo", term: NumberLong(1)},
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: {__system: 1},
                    privileges: [
                        { resource: {db: firstDbName, collection: "foo"}, actions: ["find"] },
                        { resource: {cluster: true}, actions: ["internal"] }
                    ],
                    expectFail: true
                }
            ]
        },
        {
            testname: "getnonce",
            command: {getnonce: 1},
            testcases: [
                { runOnDb: firstDbName, roles: roles_all, privileges: [ ] },
                { runOnDb: secondDbName, roles: roles_all, privileges: [ ] }
            ]
        },
        {
            testname: "getParameter",
            command: {getParameter: 1, quiet: 1},
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: { backup: 1,
                             restore: 1,
                             clusterMonitor: 1,
                             clusterAdmin: 1,
                             root: 1,
                             __system: 1
                           },
                    privileges: [
                        { resource: {cluster: true}, actions: ["getParameter"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "getPrevError",
            command: {getPrevError: 1},
            skipSharded: true,
            testcases: [
                { runOnDb: firstDbName, roles: roles_all, privileges: [ ] },
                { runOnDb: secondDbName, roles: roles_all, privileges: [ ] }
            ]
        },
        {
            testname: "getShardMap",
            command: {getShardMap: "x"},
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_monitoring,
                    privileges: [
                        { resource: {cluster: true}, actions: ["getShardMap"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "getShardVersion",
            command: {getShardVersion: "test.foo"},
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_monitoring,
                    privileges: [
                        { resource: {db: "test", collection: 'foo'}, actions: ["getShardVersion"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "group",
            command: {
                group: {
                    ns: "x",
                    key: {groupby: 1},
                    initial: {total: 0},
                    $reduce: function (curr, result) {
                        result.total += curr.n;
                    }
                }
            },
            setup: function (db) {
                db.x.insert({groupby: 1, n: 5});
                db.x.insert({groupby: 1, n: 6});
            },
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_read,
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["find"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_readAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["find"] }
                    ]
                }
            ]
        },
        {
            testname: "hostInfo",
            command: {hostInfo: 1},
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_monitoring,
                    privileges: [
                        { resource: {cluster: true}, actions: ["hostInfo"] }
                    ]
                },
                {
                    runOnDb: firstDbName,
                    roles: roles_monitoring,
                    privileges: [
                        { resource: {cluster: true}, actions: ["hostInfo"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_monitoring,
                    privileges: [
                        { resource: {cluster: true}, actions: ["hostInfo"] }
                    ]
                }
            ]
        },
        {
            testname: "isMaster",
            command: {isMaster: 1},
            testcases: [
                { runOnDb: adminDbName, roles: roles_all, privileges: [ ] },
                { runOnDb: firstDbName, roles: roles_all, privileges: [ ] },
                { runOnDb: secondDbName, roles: roles_all, privileges: [ ] }
            ]
        },
        {
            testname: "killCursors",
            command: {killCursors: "foo", cursors: [NumberLong("123")]},
            skipSharded: true, // TODO enable when killCursors command is implemented on mongos
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: {
                        read: 1,
                        readAnyDatabase: 1,
                        readWrite: 1,
                        readWriteAnyDatabase: 1,
                        dbOwner: 1,
                        hostManager: 1,
                        clusterAdmin: 1,
                        backup: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {db: firstDbName, collection: "foo"}, actions: ["killCursors"] }
                    ],
                    expectFail: true
                },
                {
                    runOnDb: secondDbName,
                    roles: {
                        readAnyDatabase: 1,
                        readWriteAnyDatabase: 1,
                        hostManager: 1,
                        clusterAdmin: 1,
                        backup: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {db: secondDbName, collection: "foo"}, actions: ["killCursors"] }
                    ],
                    expectFail: true
                }
            ]
        },
        {
            testname: "killOp", // standalone version
            command: {killOp: 1, op: 123},
            skipSharded: true,
            testcases : [
                {
                    runOnDb: adminDbName,
                    roles: roles_hostManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["killop"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "killOp", // sharded version
            command: {killOp: 1, op: "shard1:123"},
            skipStandalone: true,
            testcases : [
                {
                    runOnDb: adminDbName,
                    roles: roles_hostManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["killop"] }
                    ],
                    expectFail: true // we won't be able to find the shardId
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "listCommands",
            command: {listCommands: 1},
            testcases: [
                { runOnDb: adminDbName, roles: roles_all, privileges: [ ] },
                { runOnDb: firstDbName, roles: roles_all, privileges: [ ] },
                { runOnDb: secondDbName, roles: roles_all, privileges: [ ] }
            ]
        },
        {
            testname: "listDatabases",
            command: {listDatabases: 1},
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: {
                        readAnyDatabase: 1,
                        readWriteAnyDatabase: 1,
                        dbAdminAnyDatabase: 1,
                        userAdminAnyDatabase: 1,
                        clusterMonitor: 1,
                        clusterAdmin: 1,
                        backup: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {cluster: true}, actions: ["listDatabases"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "listCollections",
            command: {listCollections: 1},
            setup: function (db) {
                db.x.insert({_id: 5});
                db.y.insert({_id: 6});
            },
            teardown: function (db) {
                db.x.drop();
                db.y.drop();
            },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: {
                        read: 1,
                        readAnyDatabase: 1,
                        readWrite: 1,
                        readWriteAnyDatabase: 1,
                        clusterAdmin: 1,
                        clusterMonitor: 1,
                        clusterManager: 1,
                        dbAdmin: 1,
                        dbAdminAnyDatabase: 1,
                        dbOwner: 1,
                        backup: 1,
                        restore: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        {
                            resource: {db: firstDbName, collection: ""},
                            actions: ["listCollections"]
                        }
                    ]
                },
                // Test legacy (pre 3.0) way of authorizing listCollections.
                {
                    runOnDb: firstDbName,
                    privileges: [
                        {
                            resource: {db: firstDbName, collection: "system.namespaces"},
                            actions: ["find"]
                        }
                    ]
                }
            ]
        },
        {
            testname: "listIndexes",
            command: {listIndexes: "x"},
            setup: function (db) {
                db.x.insert({_id: 5});
                db.x.insert({_id: 6});
            },
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: {
                        read: 1,
                        readAnyDatabase: 1,
                        readWrite: 1,
                        readWriteAnyDatabase: 1,
                        dbAdmin: 1,
                        dbAdminAnyDatabase: 1,
                        dbOwner: 1,
                        backup: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        {
                            resource: {db: firstDbName, collection: ""},
                            actions: ["listIndexes"]
                        }
                    ]
                },
                // Test legacy (pre 3.0) way of authorizing listIndexes.
                {
                    runOnDb: firstDbName,
                    privileges: [
                        {
                            resource: {db: firstDbName, collection: "system.indexes"},
                            actions: ["find"]
                        }
                    ]
                }
            ]
        },
        {
            testname: "listShards",
            command: {listShards: 1},
            skipStandalone: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: Object.extend({clusterManager: 1}, roles_monitoring),
                    privileges: [
                        { resource: {cluster: true}, actions: ["listShards"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "logRotate",
            command: {logRotate: 1},
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_hostManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["logRotate"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "mapReduce_readonly",
            command: {
                mapreduce: "x",
                map: function () { emit(this.groupby, this.n); },
                reduce: function (id,emits) { return Array.sum(emits); },
                out: {inline: 1}
            },
            setup: function (db) {
                db.x.insert({groupby: 1, n: 5});
                db.x.insert({groupby: 1, n: 6});
            },
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_read,
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["find"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_readAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["find"] }
                    ]
                }
            ]
        },
        {
            testname: "mapReduce_write",
            command: {
                mapreduce: "x",
                map: function () { emit(this.groupby, this.n); },
                reduce: function (id,emits) { return Array.sum(emits); },
                out: "mr_out"
            },
            setup: function (db) {
                db.x.insert({groupby: 1, n: 5});
                db.x.insert({groupby: 1, n: 6});
            },
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: { readWrite: 1,
                             readWriteAnyDatabase: 1,
                             dbOwner: 1,
                             root: 1,
                             __system: 1
                           },
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["find"] },
                        { resource: {db: firstDbName, collection: "mr_out"}, actions: ["insert", "remove"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: {readWriteAnyDatabase: 1, root: 1, __system: 1},
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["find"] },
                        { resource: {db: secondDbName, collection: "mr_out"}, actions: ["insert", "remove"] }
                    ]
                }
            ]
        },
        {
            testname: "s_mergeChunks",
            command: {mergeChunks: "test.x", bounds: [{i : 0}, {i : 5}]},
            skipStandalone: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {db: "test", collection: "x"}, actions: ["splitChunk"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "d_mergeChunks",
            command: {mergeChunks: "test.x", bounds: [{i : 0}, {i : 5}]},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: { __system: 1 },
                    privileges: [
                        { resource: {cluster: true}, actions: ["internal"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "s_moveChunk",
            command: {moveChunk: "test.x"},
            skipStandalone: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {db: "test", collection: "x"}, actions: ["moveChunk"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "d_moveChunk",
            command: {moveChunk: "test.x"},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: { __system: 1 },
                    privileges: [
                        { resource: {cluster: true}, actions: ["internal"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "movePrimary",
            command: {movePrimary: "x"},
            skipStandalone: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {db: "x", collection: ""}, actions: ["moveChunk"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "netstat",
            command: {netstat: "x"},
            skipStandalone: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_monitoring,
                    privileges: [
                        { resource: {cluster: true}, actions: ["netstat"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "planCacheIndexFilter",
            command: {planCacheClearFilters: "x"},
            skipSharded: true,
            setup: function (db) { db.x.save( {} ); },
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_dbAdmin,
                    privileges: [
                        {
                            resource: {db: firstDbName, collection: "x"},
                            actions: ["planCacheIndexFilter"]
                        }
                    ],
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_dbAdminAny,
                    privileges: [
                        {
                            resource: {db: secondDbName, collection: "x"},
                            actions: ["planCacheIndexFilter"]
                        }
                    ],
                },
            ]
        },
        {
            testname: "planCacheRead",
            command: {planCacheListQueryShapes: "x"},
            skipSharded: true,
            setup: function (db) { db.x.save( {} ); },
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_readDbAdmin,
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["planCacheRead"] }
                    ],
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_readDbAdminAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["planCacheRead"] }
                    ],
                },
            ]
        },
        {
            testname: "planCacheWrite",
            command: {planCacheClear: "x"},
            skipSharded: true,
            setup: function (db) { db.x.save( {} ); },
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_dbAdmin,
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["planCacheWrite"] }
                    ],
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_dbAdminAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["planCacheWrite"] }
                    ],
                },
            ]
        },
        {
            testname: "ping",
            command: {ping: 1},
            testcases: [
                { runOnDb: adminDbName, roles: roles_all, privileges: [ ] },
                { runOnDb: firstDbName, roles: roles_all, privileges: [ ] },
                { runOnDb: secondDbName, roles: roles_all, privileges: [ ] }
            ]
        },
        {
            testname: "profile",
            command: {profile: 0},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_dbAdmin,
                    privileges: [
                        { resource: {db: firstDbName, collection: ""}, actions: ["enableProfiler"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_dbAdminAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: ""}, actions: ["enableProfiler"] }
                    ]
                }
            ]
        },
        {
            testname: "profileGetLevel",
            command: {profile: -1},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: {
                        dbAdmin: 1,
                        dbAdminAnyDatabase: 1,
                        dbOwner: 1,
                        clusterMonitor: 1,
                        clusterAdmin: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {db: firstDbName, collection: "system.profile"},
                          actions: ["find"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: {
                        dbAdminAnyDatabase: 1,
                        clusterMonitor: 1,
                        clusterAdmin: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {db: secondDbName, collection: "system.profile"},
                          actions: ["find"] }
                    ]
                }
            ]
        },
        {
            testname: "renameCollection_sameDb",
            command: {renameCollection: firstDbName + ".x",
                      to: firstDbName + ".y",
                      dropTarget: true},
            setup: function (db) { db.getSisterDB(firstDbName).x.save( {} ); },
            teardown: function (db) {
                db.getSisterDB(firstDbName).x.drop();
                db.getSisterDB(firstDbName).y.drop();
            },
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_writeDbAdmin,
                    privileges: [
                        { resource: {db: firstDbName, collection: ""},
                          actions: ["renameCollectionSameDB"] },
                        { resource: {db: firstDbName, collection: "y"},
                          actions: ["dropCollection"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            // Make sure that you cannot use renameCollectionSameDB to rename from a collection you
            // don't have read access on to one that you do.
            testname: "renameCollection_sameDb_failure",
            command: {renameCollection: firstDbName + ".x", to: firstDbName + ".y"},
            setup: function (db) { db.getSisterDB(firstDbName).x.save( {} ); },
            teardown: function (db) {
                db.getSisterDB(firstDbName).x.drop();
                db.getSisterDB(firstDbName).y.drop();
            },
            testcases: [
                {
                    runOnDb: adminDbName,
                    privileges: [
                        { resource: {db: firstDbName, collection: ""},
                          actions: ["renameCollectionSameDB"] },
                        { resource: {db: firstDbName, collection: "y"}, actions: ["find"] }
                    ],
                    expectAuthzFailure: true
                },
            ]
        },
        {
            testname: "renameCollection_twoDbs",
            command: {renameCollection: firstDbName + ".x", to: secondDbName + ".y"},
            setup: function (db) {
                db.getSisterDB(firstDbName).x.save( {} );
                db.getSisterDB(adminDbName).runCommand({movePrimary: firstDbName, to: shard0name});
                db.getSisterDB(adminDbName).runCommand({movePrimary: secondDbName, to: shard0name});
            },
            teardown: function (db) {
                db.getSisterDB(firstDbName).x.drop();
                db.getSisterDB(secondDbName).y.drop();
            },
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: {readWriteAnyDatabase: 1, root: 1, __system: 1},
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["find", "dropCollection"] },
                        { resource: {db: secondDbName, collection: "y"}, actions: ["insert", "createIndex"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "reIndex",
            command: {reIndex: "x"},
            setup: function (db) { db.x.save( {} ); },
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_dbAdmin,
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["reIndex"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_dbAdminAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["reIndex"] }
                    ]
                }
            ]
        },
        {
            testname: "removeShard",
            command: {removeShard: "x"},
            skipStandalone: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["removeShard"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "repairDatabase",
            command: {repairDatabase: 1},
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: {
                        dbAdminAnyDatabase: 1,
                        hostManager: 1,
                        clusterAdmin: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {db: adminDbName, collection: ""}, actions: ["repairDatabase"] }
                    ]
                },
                {
                    runOnDb: firstDbName,
                    roles: {
                        dbAdmin: 1,
                        dbAdminAnyDatabase: 1,
                        hostManager: 1,
                        clusterAdmin: 1,
                        dbOwner: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {db: firstDbName, collection: ""}, actions: ["repairDatabase"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: {
                        dbAdminAnyDatabase: 1,
                        hostManager: 1,
                        clusterAdmin: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {db: secondDbName, collection: ""}, actions: ["repairDatabase"] }
                    ]
                }
            ]
        },
        {
            testname: "replSetElect",
            command: {replSetElect: 1},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: {__system: 1},
                    privileges: [
                        { resource: {cluster: true}, actions: ["internal"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "replSetFreeze",
            command: {replSetFreeze: "x"},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["replSetStateChange"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "replSetFresh",
            command: {replSetFresh: "x"},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: {__system: 1},
                    privileges: [
                        { resource: {cluster: true}, actions: ["internal"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "replSetGetRBID",
            command: {replSetGetRBID: 1},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: {__system: 1},
                    privileges: [
                        { resource: {cluster: true}, actions: ["internal"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "replSetGetStatus",
            command: {replSetGetStatus: 1},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: {
                        clusterMonitor: 1,
                        clusterManager: 1,
                        clusterAdmin: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {cluster: true}, actions: ["replSetGetStatus"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "replSetGetConfig",
            command: {replSetGetConfig: 1},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: {
                        clusterMonitor: 1,
                        clusterManager: 1,
                        clusterAdmin: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {cluster: true}, actions: ["replSetGetConfig"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "replSetHeartbeat",
            command: {replSetHeartbeat: 1},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: {__system: 1},
                    privileges: [
                        { resource: {cluster: true}, actions: ["internal"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "replSetInitiate",
            command: {replSetInitiate: "x"},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["replSetConfigure"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "replSetMaintenance",
            command: {replSetMaintenance: "x"},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["replSetStateChange"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "replSetReconfig",
            command: {replSetReconfig: "x"},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["replSetConfigure"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "replSetStepDown",
            command: {replSetStepDown: "x"},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["replSetStateChange"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "replSetSyncFrom",
            command: {replSetSyncFrom: "x"},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["replSetStateChange"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "resetError",
            command: {resetError: 1},
            testcases: [
                { runOnDb: adminDbName, roles: roles_all, privileges: [ ] },
                { runOnDb: firstDbName, roles: roles_all, privileges: [ ] },
                { runOnDb: secondDbName, roles: roles_all, privileges: [ ] }
            ]
        },
        {
            testname: "resync",
            command: {resync: 1},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: {
                        hostManager: 1,
                        clusterManager: 1,
                        clusterAdmin: 1,
                        root: 1,
                        __system: 1
                    },
                    privileges: [
                        { resource: {cluster: true}, actions: ["resync"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "serverStatus",
            command: {serverStatus: 1},
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_monitoring,
                    privileges: [
                        { resource: {cluster: true}, actions: ["serverStatus"] }
                    ]
                },
                {
                    runOnDb: firstDbName,
                    roles: roles_monitoring,
                    privileges: [
                        { resource: {cluster: true}, actions: ["serverStatus"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_monitoring,
                    privileges: [
                        { resource: {cluster: true}, actions: ["serverStatus"] }
                    ]
                }
            ]
        },
        {
            testname: "setParameter",
            command: {setParameter: 1, quiet: 1},
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_hostManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["setParameter"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "setShardVersion",
            command: {setShardVersion: 1},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: {__system: 1},
                    privileges: [
                        { resource: {cluster: true}, actions: ["internal"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "shardCollection",
            command: {shardCollection: "test.x"},
            skipStandalone: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {db: "test", collection: "x"}, actions: ["enableSharding"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "shardingState",
            command: {shardingState: 1},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_monitoring,
                    privileges: [
                        { resource: {cluster: true}, actions: ["shardingState"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "shutdown",
            command: {shutdown: 1},
            testcases: [
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "split",
            command: {split: "test.x"},
            skipStandalone: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {db: "test", collection: "x"}, actions: ["splitChunk"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "splitChunk",
            command: {splitChunk: "test.x"},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: { __system: 1 },
                    privileges: [
                        { resource: {cluster: true}, actions: ["internal"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "splitVector",
            command: {splitVector: "test.x"},
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {db: "test", collection: "x"}, actions: ["splitVector"] }
                    ],
                    expectFail: true
                },
                {
                    runOnDb: firstDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {db: "test", collection: "x"}, actions: ["splitVector"] }
                    ],
                    expectFail: true
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_clusterManager,
                    privileges: [
                        { resource: {db: "test", collection: "x"}, actions: ["splitVector"] }
                    ],
                    expectFail: true
                }
            ]
        },
/*      temporarily removed see SERVER-13555
         {
            testname: "storageDetails",
            command: {storageDetails: "x", analyze: "diskStorage"},
            skipSharded: true,
            setup: function (db) { db.x.save( {} ); },
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_dbAdmin,
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["storageDetails"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_dbAdminAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["storageDetails"] }
                    ]
                }
            ]
        }, */
        {
            testname: "top",
            command: {top: 1},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_monitoring,
                    privileges: [
                        { resource: {cluster: true}, actions: ["top"] }
                    ]
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "touch",
            command: {touch: "x", data: true, index: false},
            skipSharded: true,
            setup: function (db) { db.x.save( {} ); },
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: roles_hostManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["touch"] }
                    ]
                },
                {
                    runOnDb: firstDbName,
                    roles: roles_hostManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["touch"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_hostManager,
                    privileges: [
                        { resource: {cluster: true}, actions: ["touch"] }
                    ]
                }
            ]
        },
        {
            testname: "unsetSharding",
            command: {unsetSharding: "x"},
            skipSharded: true,
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: {__system: 1},
                    privileges: [
                        { resource: {cluster: true}, actions: ["internal"] }
                    ],
                    expectFail: true
                },
                { runOnDb: firstDbName, roles: {} },
                { runOnDb: secondDbName, roles: {} }
            ]
        },
        {
            testname: "validate",
            command: {validate: "x"},
            setup: function (db) { db.x.save( {} ); },
            teardown: function (db) { db.x.drop(); },
            testcases: [
                {
                    runOnDb: firstDbName,
                    roles: roles_dbAdmin,
                    privileges: [
                        { resource: {db: firstDbName, collection: "x"}, actions: ["validate"] }
                    ]
                },
                {
                    runOnDb: secondDbName,
                    roles: roles_dbAdminAny,
                    privileges: [
                        { resource: {db: secondDbName, collection: "x"}, actions: ["validate"] }
                    ]
                }
            ]
        },
        {
            // Test that the root role has the privilege to validate any system.* collection
            testname: "validate_system",
            command: {validate: "system.users"},
            testcases: [
                {
                    runOnDb: adminDbName,
                    roles: {
                        root: 1,
                        __system: 1
                    }
                }
            ]
        },
        {
            testname: "whatsmyuri",
            command: {whatsmyuri: 1},
            testcases: [
                { runOnDb: adminDbName, roles: roles_all, privileges: [ ] },
                { runOnDb: firstDbName, roles: roles_all, privileges: [ ] },
                { runOnDb: secondDbName, roles: roles_all, privileges: [ ] }
            ]
        }
    ],


    /************* SHARED TEST LOGIC ****************/

    /**
     * Returns true if conn is a connection to mongos,
     * and false otherwise.
     */
    isMongos: function(conn) {
        var res = conn.getDB("admin").runCommand({isdbgrid: 1});
        return (res.ok == 1 && res.isdbgrid == 1);
    },

    /**
     * Runs a single test object from the tests array above.
     * The actual implementation must be provided in "impls".
     *
     * Parameters:
     *   conn -- a connection to either mongod or mongos
     *   t -- a single test object from the tests array above
     *
     * Returns:
     *  An array of strings. Each string in the array reports
     *  a particular test error.
     */
    runOneTest: function(conn, t, impls) {
        jsTest.log("Running test: " + t.testname);

        // some tests shouldn't run in a sharded environment
        if (t.skipSharded && this.isMongos(conn)) {
            return [];
        }
        // others shouldn't run in a standalone environment
        if (t.skipStandalone && !this.isMongos(conn)) {
            return [];
        }

        return impls.runOneTest(conn, t);
    },

    setup: function(conn, t, runOnDb) {
        var adminDb = conn.getDB(adminDbName);
        if (t.setup) {
            adminDb.auth("admin", "password");
            t.setup(runOnDb);
            runOnDb.getLastError();
            adminDb.logout();
        }
    },

    teardown: function(conn, t, runOnDb) {
        var adminDb = conn.getDB(adminDbName);
        if (t.teardown) {
            adminDb.auth("admin", "password");
            t.teardown(runOnDb);
            runOnDb.getLastError();
            adminDb.logout();
        }
    },

    /**
     * Top-level test runner
     */
    runTests: function(conn, impls) {

        // impls must provide implementations of a few functions
        assert("createUsers" in impls);
        assert("runOneTest" in impls);

        impls.createUsers(conn);

        var failures = [];

        for (var i = 0; i < this.tests.length; i++) {
            res = this.runOneTest(conn, this.tests[i], impls);
            failures = failures.concat(res);
        }

        failures.forEach(function(i) { jsTest.log(i) });
        assert.eq(0, failures.length);
    }

}