738 lines
31 KiB
JavaScript
738 lines
31 KiB
JavaScript
// Test basic db operations in multitenancy using a securityToken.
|
|
|
|
(function() {
|
|
"use strict";
|
|
|
|
load('jstests/aggregation/extras/utils.js'); // For arrayEq()
|
|
load("jstests/libs/feature_flag_util.js"); // for isEnabled
|
|
|
|
function checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollectionName, nsField) {
|
|
if (featureFlagRequireTenantId) {
|
|
// This case represents the upgraded state where we will not include the tenantId as the
|
|
// db prefix.
|
|
const nss = kDbName + (kCollectionName == "" ? "" : "." + kCollectionName);
|
|
assert.eq(nsField, nss);
|
|
} else {
|
|
// This case represents the downgraded state where we will continue to prefix namespaces.
|
|
const prefixedNss =
|
|
kTenant + "_" + kDbName + (kCollectionName == "" ? "" : "." + kCollectionName);
|
|
assert.eq(nsField, prefixedNss);
|
|
}
|
|
}
|
|
|
|
const rst = new ReplSetTest({
|
|
nodes: 3,
|
|
nodeOptions: {
|
|
auth: '',
|
|
setParameter: {
|
|
multitenancySupport: true,
|
|
featureFlagSecurityToken: true,
|
|
}
|
|
}
|
|
});
|
|
rst.startSet({keyFile: 'jstests/libs/key1'});
|
|
rst.initiate();
|
|
|
|
const primary = rst.getPrimary();
|
|
const adminDb = primary.getDB('admin');
|
|
|
|
// Prepare a user for testing pass tenant via $tenant.
|
|
// Must be authenticated as a user with ActionType::useTenant in order to use $tenant.
|
|
assert.commandWorked(adminDb.runCommand({createUser: 'admin', pwd: 'pwd', roles: ['root']}));
|
|
assert(adminDb.auth('admin', 'pwd'));
|
|
|
|
const featureFlagRequireTenantId = FeatureFlagUtil.isEnabled(
|
|
adminDb,
|
|
"RequireTenantID",
|
|
);
|
|
|
|
const kTenant = ObjectId();
|
|
const kOtherTenant = ObjectId();
|
|
const kDbName = 'myDb';
|
|
const kCollName = 'myColl';
|
|
const tokenConn = new Mongo(primary.host);
|
|
const securityToken = _createSecurityToken({user: "userTenant1", db: '$external', tenant: kTenant});
|
|
const tokenDB = tokenConn.getDB(kDbName);
|
|
|
|
// In this jstest, the collection (defined by kCollName) and the document "{_id: 0, a: 1, b: 1}"
|
|
// for the tenant (defined by kTenant) will be reused by all command tests. So, any test which
|
|
// changes the collection name or document should reset it.
|
|
|
|
// Test commands using a security token for one tenant.
|
|
{
|
|
// Create a user for kTenant and then set the security token on the connection.
|
|
assert.commandWorked(primary.getDB('$external').runCommand({
|
|
createUser: "userTenant1",
|
|
'$tenant': kTenant,
|
|
roles:
|
|
[{role: 'dbAdminAnyDatabase', db: 'admin'}, {role: 'readWriteAnyDatabase', db: 'admin'}]
|
|
}));
|
|
|
|
tokenConn._setSecurityToken(securityToken);
|
|
|
|
// Logout the root user to avoid multiple authentication.
|
|
tokenConn.getDB("admin").logout();
|
|
|
|
// Create a collection for the tenant kTenant and then insert into it.
|
|
assert.commandWorked(tokenDB.createCollection(kCollName));
|
|
assert.commandWorked(
|
|
tokenDB.runCommand({insert: kCollName, documents: [{_id: 0, a: 1, b: 1}]}));
|
|
|
|
// Find the document and call getMore on the cursor
|
|
{
|
|
// Add additional document in order to have two batches for getMore
|
|
assert.commandWorked(
|
|
tokenDB.runCommand({insert: kCollName, documents: [{_id: 100, x: 1}]}));
|
|
|
|
const findRes = assert.commandWorked(
|
|
tokenDB.runCommand({find: kCollName, filter: {a: 1}, batchSize: 1}));
|
|
assert(arrayEq([{_id: 0, a: 1, b: 1}], findRes.cursor.firstBatch), tojson(findRes));
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollName, findRes.cursor.ns);
|
|
|
|
const getMoreRes = assert.commandWorked(
|
|
tokenDB.runCommand({getMore: findRes.cursor.id, collection: kCollName}));
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollName, getMoreRes.cursor.ns);
|
|
}
|
|
|
|
// Test the aggregate command.
|
|
{
|
|
const aggRes = assert.commandWorked(
|
|
tokenDB.runCommand({aggregate: kCollName, pipeline: [{$match: {a: 1}}], cursor: {}}));
|
|
assert(arrayEq([{_id: 0, a: 1, b: 1}], aggRes.cursor.firstBatch), tojson(aggRes));
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollName, aggRes.cursor.ns);
|
|
}
|
|
|
|
// Find and modify the document.
|
|
{
|
|
const fad1 = assert.commandWorked(
|
|
tokenDB.runCommand({findAndModify: kCollName, query: {a: 1}, update: {$inc: {a: 10}}}));
|
|
assert.eq({_id: 0, a: 1, b: 1}, fad1.value);
|
|
const fad2 = assert.commandWorked(tokenDB.runCommand(
|
|
{findAndModify: kCollName, query: {a: 11}, update: {$set: {a: 1, b: 1}}}));
|
|
assert.eq({_id: 0, a: 11, b: 1}, fad2.value);
|
|
}
|
|
|
|
// Create a view on the collection, and check that listCollections sees the original
|
|
// collection, the view, and the system.views collection. Then, call $listCatalog on
|
|
// the collection and views and validate the results.
|
|
{
|
|
const viewName = "view1";
|
|
const targetViews = 'system.views';
|
|
|
|
assert.commandWorked(
|
|
tokenDB.runCommand({"create": viewName, "viewOn": kCollName, pipeline: []}));
|
|
|
|
const colls =
|
|
assert.commandWorked(tokenDB.runCommand({listCollections: 1, nameOnly: true}));
|
|
assert.eq(3, colls.cursor.firstBatch.length, tojson(colls.cursor.firstBatch));
|
|
const expectedColls = [
|
|
{"name": kCollName, "type": "collection"},
|
|
{"name": targetViews, "type": "collection"},
|
|
{"name": viewName, "type": "view"}
|
|
];
|
|
assert(arrayEq(expectedColls, colls.cursor.firstBatch), tojson(colls.cursor.firstBatch));
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, "$cmd.listCollections", colls.cursor.ns);
|
|
|
|
const prefixedDbName = kTenant + '_' + tokenDB.getName();
|
|
const targetDb = featureFlagRequireTenantId ? tokenDB.getName() : prefixedDbName;
|
|
|
|
const tokenAdminDB = tokenConn.getDB('admin');
|
|
|
|
// Get catalog without specifying target collection (collectionless).
|
|
let result =
|
|
tokenAdminDB.runCommand({aggregate: 1, pipeline: [{$listCatalog: {}}], cursor: {}});
|
|
let resultArray = result.cursor.firstBatch;
|
|
|
|
// Check that the resulting array of catalog entries contains our target databases and
|
|
// namespaces.
|
|
assert(resultArray.some((entry) => (entry.db === targetDb) && (entry.name === kCollName)));
|
|
|
|
// Also check that the resulting array contains views specific to our target database.
|
|
assert(
|
|
resultArray.some((entry) => (entry.db === targetDb) && (entry.name === targetViews)));
|
|
assert(resultArray.some((entry) => (entry.db === targetDb) && (entry.name === viewName)));
|
|
|
|
// Get catalog when specifying our target collection, which should only return one
|
|
// result.
|
|
result =
|
|
tokenDB.runCommand({aggregate: kCollName, pipeline: [{$listCatalog: {}}], cursor: {}});
|
|
resultArray = result.cursor.firstBatch;
|
|
|
|
// Check that the resulting array of catalog entries contains our target databases and
|
|
// namespaces.
|
|
assert(resultArray.length == 1);
|
|
assert(resultArray.some((entry) => (entry.db === targetDb) && (entry.name === kCollName)));
|
|
}
|
|
|
|
// Test explain command with find
|
|
{
|
|
const cmdRes = tokenDB.runCommand({explain: {find: kCollName, filter: {a: 1}}});
|
|
assert.eq(1, cmdRes.executionStats.nReturned, tojson(cmdRes));
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollName, cmdRes.queryPlanner.namespace);
|
|
}
|
|
|
|
// Test count and distinct command.
|
|
{
|
|
assert.commandWorked(tokenDB.runCommand(
|
|
{insert: kCollName, documents: [{_id: 1, c: 1, d: 1}, {_id: 2, c: 1, d: 2}]}));
|
|
|
|
const resCount =
|
|
assert.commandWorked(tokenDB.runCommand({count: kCollName, query: {c: 1}}));
|
|
assert.eq(2, resCount.n);
|
|
|
|
const resDitinct =
|
|
assert.commandWorked(tokenDB.runCommand({distinct: kCollName, key: 'd', query: {}}));
|
|
assert.eq([1, 2], resDitinct.values.sort());
|
|
}
|
|
|
|
// Rename the collection.
|
|
{
|
|
const fromName = kDbName + '.' + kCollName;
|
|
const toName = fromName + "_renamed";
|
|
const tokenAdminDB = tokenConn.getDB('admin');
|
|
assert.commandWorked(
|
|
tokenAdminDB.runCommand({renameCollection: fromName, to: toName, dropTarget: true}));
|
|
|
|
// Verify the the renamed collection by findAndModify existing documents.
|
|
const fad1 = assert.commandWorked(tokenDB.runCommand(
|
|
{findAndModify: kCollName + "_renamed", query: {a: 1}, update: {$set: {a: 11, b: 1}}}));
|
|
assert.eq({_id: 0, a: 1, b: 1}, fad1.value);
|
|
|
|
// Reset the collection name and document data.
|
|
assert.commandWorked(
|
|
tokenAdminDB.runCommand({renameCollection: toName, to: fromName, dropTarget: true}));
|
|
assert.commandWorked(tokenDB.runCommand(
|
|
{findAndModify: kCollName, query: {a: 11}, update: {$set: {a: 1, b: 1}}}));
|
|
}
|
|
|
|
// ListDatabases only returns databases associated with kTenant.
|
|
{
|
|
// Create databases for kTenant. A new database is implicitly created when a collection
|
|
// is created.
|
|
const kOtherDbName = 'otherDb';
|
|
assert.commandWorked(tokenConn.getDB(kOtherDbName).createCollection("collName"));
|
|
const tokenAdminDB = tokenConn.getDB('admin');
|
|
const dbs =
|
|
assert.commandWorked(tokenAdminDB.runCommand({listDatabases: 1, nameOnly: true}));
|
|
assert.eq(3, dbs.databases.length);
|
|
const expectedDbs = featureFlagRequireTenantId
|
|
? ["admin", kDbName, kOtherDbName]
|
|
: [kTenant + "_admin", kTenant + "_" + kDbName, kTenant + "_" + kOtherDbName];
|
|
assert(arrayEq(expectedDbs, dbs.databases.map(db => db.name)));
|
|
}
|
|
|
|
{
|
|
// Test the collStats command.
|
|
let res = assert.commandWorked(tokenDB.runCommand({collStats: kCollName}));
|
|
checkNsSerializedCorrectly(featureFlagRequireTenantId, kTenant, kDbName, kCollName, res.ns);
|
|
|
|
// perform the same test on a timeseries collection
|
|
const timeFieldName = "time";
|
|
const tsColl = "timeseriesColl";
|
|
assert.commandWorked(
|
|
tokenDB.createCollection(tsColl, {timeseries: {timeField: timeFieldName}}));
|
|
res = assert.commandWorked(tokenDB.runCommand({collStats: tsColl}));
|
|
checkNsSerializedCorrectly(featureFlagRequireTenantId, kTenant, kDbName, tsColl, res.ns);
|
|
checkNsSerializedCorrectly(featureFlagRequireTenantId,
|
|
kTenant,
|
|
kDbName,
|
|
'system.buckets.' + tsColl,
|
|
res.timeseries.bucketsNs);
|
|
}
|
|
|
|
// Drop the collection, and then the database. Check that listCollections no longer returns
|
|
// the 3 collections.
|
|
{
|
|
// Drop the collection, and check that the "ns" returned is serialized correctly.
|
|
const dropRes = assert.commandWorked(tokenDB.runCommand({drop: kCollName}));
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollName, dropRes.ns);
|
|
|
|
const collsAfterDropColl = assert.commandWorked(
|
|
tokenDB.runCommand({listCollections: 1, nameOnly: true, filter: {name: kCollName}}));
|
|
assert.eq(0,
|
|
collsAfterDropColl.cursor.firstBatch.length,
|
|
tojson(collsAfterDropColl.cursor.firstBatch));
|
|
|
|
assert.commandWorked(tokenDB.runCommand({dropDatabase: 1}));
|
|
const collsAfterDropDb =
|
|
assert.commandWorked(tokenDB.runCommand({listCollections: 1, nameOnly: true}));
|
|
assert.eq(0,
|
|
collsAfterDropDb.cursor.firstBatch.length,
|
|
tojson(collsAfterDropDb.cursor.firstBatch));
|
|
|
|
// Reset the collection and document.
|
|
assert.commandWorked(
|
|
tokenDB.runCommand({insert: kCollName, documents: [{_id: 0, a: 1, b: 1}]}));
|
|
}
|
|
|
|
// Test that transactions can be run successfully.
|
|
{
|
|
const session = tokenDB.getMongo().startSession();
|
|
const sessionDb = session.getDatabase(kDbName);
|
|
session.startTransaction();
|
|
assert.commandWorked(sessionDb.runCommand(
|
|
{delete: kCollName, deletes: [{q: {_id: 0, a: 1, b: 1}, limit: 1}]}));
|
|
session.commitTransaction_forTesting();
|
|
|
|
const findRes = assert.commandWorked(tokenDB.runCommand({find: kCollName}));
|
|
assert.eq(0, findRes.cursor.firstBatch.length, tojson(findRes.cursor.firstBatch));
|
|
|
|
// Reset the collection and document.
|
|
assert.commandWorked(
|
|
tokenDB.runCommand({insert: kCollName, documents: [{_id: 0, a: 1, b: 1}]}));
|
|
}
|
|
|
|
// Test createIndexes, listIndexes and dropIndexes command.
|
|
{
|
|
var sortIndexesByName = function(indexes) {
|
|
return indexes.sort(function(a, b) {
|
|
return a.name > b.name;
|
|
});
|
|
};
|
|
|
|
var getIndexesKeyAndName = function(indexes) {
|
|
return sortIndexesByName(indexes).map(function(index) {
|
|
return {key: index.key, name: index.name};
|
|
});
|
|
};
|
|
|
|
let res = assert.commandWorked(tokenDB.runCommand({
|
|
createIndexes: kCollName,
|
|
indexes: [{key: {a: 1}, name: "indexA"}, {key: {b: 1}, name: "indexB"}]
|
|
}));
|
|
assert.eq(3, res.numIndexesAfter);
|
|
|
|
res = assert.commandWorked(tokenDB.runCommand({listIndexes: kCollName}));
|
|
assert.eq(3, res.cursor.firstBatch.length);
|
|
assert(arrayEq(
|
|
[
|
|
{key: {"_id": 1}, name: "_id_"},
|
|
{key: {a: 1}, name: "indexA"},
|
|
{key: {b: 1}, name: "indexB"}
|
|
],
|
|
getIndexesKeyAndName(res.cursor.firstBatch)));
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollName, res.cursor.ns);
|
|
|
|
// Drop those new created indexes.
|
|
res = assert.commandWorked(
|
|
tokenDB.runCommand({dropIndexes: kCollName, index: ["indexA", "indexB"]}));
|
|
|
|
res = assert.commandWorked(tokenDB.runCommand({listIndexes: kCollName}));
|
|
assert.eq(1, res.cursor.firstBatch.length);
|
|
assert(arrayEq([{key: {"_id": 1}, name: "_id_"}],
|
|
getIndexesKeyAndName(res.cursor.firstBatch)));
|
|
}
|
|
|
|
// Test aggregation stage commands
|
|
{
|
|
// Create a number of collections and entries used to test agg stages
|
|
const kCollA = "collA";
|
|
const kCollB = "collB";
|
|
const kCollC = "collC";
|
|
const kCollD = "collD";
|
|
assert.commandWorked(tokenDB.createCollection(kCollA));
|
|
assert.commandWorked(tokenDB.createCollection(kCollB));
|
|
|
|
const collADocs = [
|
|
{_id: 0, start: "a", end: "b"},
|
|
{_id: 1, start: "b", end: "c"},
|
|
{_id: 2, start: "c", end: "d"}
|
|
];
|
|
const collBDocs = [
|
|
{_id: 0, ref: "a", payload: "1"},
|
|
{_id: 1, ref: "c", payload: "2"},
|
|
{_id: 2, ref: "e", payload: "3"}
|
|
];
|
|
|
|
assert.commandWorked(tokenDB.runCommand({insert: kCollA, documents: collADocs}));
|
|
assert.commandWorked(tokenDB.runCommand({insert: kCollB, documents: collBDocs}));
|
|
|
|
// Set up assertion targets
|
|
const graphLookupTarget = [
|
|
{_id: 0, connections: []},
|
|
{_id: 1, connections: [{_id: 0, start: "a", end: "b"}]},
|
|
{_id: 2, connections: [{_id: 0, start: "a", end: "b"}, {_id: 1, start: "b", end: "c"}]}
|
|
];
|
|
const lookupTarget = [
|
|
{_id: 0, refs: [{_id: 0, ref: "a", payload: "1"}]},
|
|
{_id: 1, refs: []},
|
|
{_id: 2, refs: [{_id: 1, ref: "c", payload: "2"}]}
|
|
];
|
|
|
|
// $graphLookup agg stage
|
|
const graphLookupStage = {
|
|
$graphLookup: {
|
|
from: kCollA,
|
|
startWith: "$start",
|
|
connectFromField: "start",
|
|
connectToField: "end",
|
|
as: "connections"
|
|
}
|
|
};
|
|
{
|
|
const graphLookupRes = assert.commandWorked(tokenDB.runCommand({
|
|
aggregate: kCollA,
|
|
pipeline: [graphLookupStage, {$project: {_id: 1, connections: 1}}],
|
|
cursor: {}
|
|
}));
|
|
|
|
assert(arrayEq(graphLookupTarget, graphLookupRes.cursor.firstBatch));
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollA, graphLookupRes.cursor.ns);
|
|
}
|
|
|
|
// $out agg stage using string input for collection name
|
|
const outStageStr = {$out: kCollC};
|
|
{
|
|
const outStrRes = assert.commandWorked(tokenDB.runCommand(
|
|
{aggregate: kCollA, pipeline: [graphLookupStage, outStageStr], cursor: {}}));
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollA, outStrRes.cursor.ns);
|
|
|
|
// Because we're using the same graphLookup stage from the first test, we should see the
|
|
// exact same results but stored in kCollC
|
|
let projectRes = assert.commandWorked(tokenDB.runCommand(
|
|
{aggregate: kCollC, pipeline: [{$project: {_id: 1, connections: 1}}], cursor: {}}));
|
|
assert(arrayEq(graphLookupTarget, projectRes.cursor.firstBatch));
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollC, projectRes.cursor.ns);
|
|
assert.commandWorked(tokenDB.runCommand({drop: kCollC}));
|
|
}
|
|
|
|
// $out agg stage using object input for collection name
|
|
const outStageObj = {$out: {db: kDbName, coll: kCollD}};
|
|
{
|
|
const outObjRes = assert.commandWorked(tokenDB.runCommand(
|
|
{aggregate: kCollA, pipeline: [graphLookupStage, outStageObj], cursor: {}}));
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollA, outObjRes.cursor.ns);
|
|
|
|
// Because we're using the same graphLookup stage from the first test, we should see the
|
|
// exact same results but stored in kCollD
|
|
let projectRes = assert.commandWorked(tokenDB.runCommand(
|
|
{aggregate: kCollD, pipeline: [{$project: {_id: 1, connections: 1}}], cursor: {}}));
|
|
assert(arrayEq(graphLookupTarget, projectRes.cursor.firstBatch));
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollD, projectRes.cursor.ns);
|
|
assert.commandWorked(tokenDB.runCommand({drop: kCollD}));
|
|
}
|
|
|
|
// $lookup agg stage using nested pipeline input
|
|
const lookupPipelineStage = {
|
|
$lookup: {from: kCollB, let: {kCollA_start: "$start"},
|
|
pipeline: [{$match: {$expr: {$eq: ["$$kCollA_start","$ref"]}}}], as: "refs"}
|
|
};
|
|
{
|
|
const lookupPipelineRes = assert.commandWorked(tokenDB.runCommand({
|
|
aggregate: kCollA,
|
|
pipeline: [lookupPipelineStage, {$project: {_id: 1, refs: 1}}],
|
|
cursor: {}
|
|
}));
|
|
|
|
assert(arrayEq(lookupTarget, lookupPipelineRes.cursor.firstBatch));
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollA, lookupPipelineRes.cursor.ns);
|
|
}
|
|
|
|
// $merge agg stage
|
|
const mergeStage = {$merge: {into: kCollD}};
|
|
{
|
|
const mergeRes = assert.commandWorked(
|
|
tokenDB.runCommand({aggregate: kCollA, pipeline: [mergeStage], cursor: {}}));
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollA, mergeRes.cursor.ns);
|
|
|
|
// Merging kCollA into a new collection kCollD should give us matching contents
|
|
let findRes = assert.commandWorked(tokenDB.runCommand({find: kCollD}));
|
|
assert(arrayEq(collADocs, findRes.cursor.firstBatch));
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollD, findRes.cursor.ns);
|
|
assert.commandWorked(tokenDB.runCommand({drop: kCollD}));
|
|
}
|
|
|
|
// $unionWith agg stage
|
|
const unionWithStage = {$unionWith: kCollB};
|
|
{
|
|
const unionWithRes = assert.commandWorked(
|
|
tokenDB.runCommand({aggregate: kCollA, pipeline: [unionWithStage], cursor: {}}));
|
|
|
|
assert(arrayEq(collADocs.concat(collBDocs), unionWithRes.cursor.firstBatch));
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollA, unionWithRes.cursor.ns);
|
|
}
|
|
|
|
// $collStats agg stage
|
|
const collStatsStage = {$collStats: {latencyStats: {}}};
|
|
{
|
|
// create a new collection to isolate stats results from other tests
|
|
assert.commandWorked(tokenDB.runCommand({insert: kCollD, documents: collADocs}));
|
|
|
|
const collStatsRes = assert.commandWorked(
|
|
tokenDB.runCommand({aggregate: kCollD, pipeline: [collStatsStage], cursor: {}}));
|
|
assert.eq(1, collStatsRes.cursor.firstBatch.length);
|
|
|
|
checkNsSerializedCorrectly(featureFlagRequireTenantId,
|
|
kTenant,
|
|
kDbName,
|
|
kCollD,
|
|
collStatsRes.cursor.firstBatch[0].ns);
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollD, collStatsRes.cursor.ns);
|
|
|
|
let stats = collStatsRes.cursor.firstBatch[0];
|
|
assert('latencyStats' in collStatsRes.cursor.firstBatch[0]);
|
|
assert(stats.latencyStats.writes.ops == 1);
|
|
assert(stats.latencyStats.reads.ops == 1);
|
|
assert(stats.latencyStats.commands.ops == 0);
|
|
assert(stats.latencyStats.transactions.ops == 0);
|
|
|
|
// Also check the next() cursor results.
|
|
const collStatsResNext = tokenDB.collD.aggregate(collStatsStage).next();
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollD, collStatsResNext.ns);
|
|
|
|
assert('latencyStats' in collStatsResNext);
|
|
assert(collStatsResNext.latencyStats.writes.ops == 1);
|
|
assert(collStatsResNext.latencyStats.reads.ops == 2);
|
|
assert(collStatsResNext.latencyStats.commands.ops == 0);
|
|
assert(collStatsResNext.latencyStats.transactions.ops == 0);
|
|
|
|
assert.commandWorked(tokenDB.runCommand({drop: kCollD}));
|
|
}
|
|
|
|
// Clean up remaining test collections.
|
|
assert.commandWorked(tokenDB.runCommand({drop: kCollA}));
|
|
assert.commandWorked(tokenDB.runCommand({drop: kCollB}));
|
|
}
|
|
|
|
// Test the validate command.
|
|
{
|
|
const validateRes = assert.commandWorked(tokenDB.runCommand({validate: kCollName}));
|
|
assert(validateRes.valid);
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollName, validateRes.ns);
|
|
}
|
|
}
|
|
|
|
// Test commands using a security token for a different tenant and check that this tenant cannot
|
|
// access the other tenant's collection.
|
|
{
|
|
// Create a user for a different tenant, and set the security token on the connection.
|
|
// We reuse the same connection, but swap the token out.
|
|
assert.commandWorked(primary.getDB('$external').runCommand({
|
|
createUser: "userTenant2",
|
|
'$tenant': kOtherTenant,
|
|
roles:
|
|
[{role: 'dbAdminAnyDatabase', db: 'admin'}, {role: 'readWriteAnyDatabase', db: 'admin'}]
|
|
}));
|
|
const securityTokenOtherTenant =
|
|
_createSecurityToken({user: "userTenant2", db: '$external', tenant: kOtherTenant});
|
|
tokenConn._setSecurityToken(securityTokenOtherTenant);
|
|
|
|
const tokenDB2 = tokenConn.getDB(kDbName);
|
|
|
|
const findOtherUser =
|
|
assert.commandWorked(tokenDB2.runCommand({find: kCollName, filter: {a: 1}}));
|
|
assert.eq(findOtherUser.cursor.firstBatch.length, 0, tojson(findOtherUser));
|
|
|
|
const explainOtherUser =
|
|
assert.commandWorked(tokenDB2.runCommand({explain: {find: kCollName, filter: {a: 1}}}));
|
|
assert.eq(explainOtherUser.executionStats.nReturned, 0, tojson(explainOtherUser));
|
|
|
|
const fadOtherUser = assert.commandWorked(
|
|
tokenDB2.runCommand({findAndModify: kCollName, query: {b: 1}, update: {$inc: {b: 10}}}));
|
|
assert.eq(null, fadOtherUser.value);
|
|
|
|
const countOtherUser =
|
|
assert.commandWorked(tokenDB2.runCommand({count: kCollName, query: {c: 1}}));
|
|
assert.eq(0, countOtherUser.n);
|
|
|
|
const distinctOtherUer =
|
|
assert.commandWorked(tokenDB2.runCommand({distinct: kCollName, key: 'd', query: {}}));
|
|
assert.eq([], distinctOtherUer.values);
|
|
|
|
const fromName = kDbName + '.' + kCollName;
|
|
const toName = fromName + "_renamed";
|
|
assert.commandFailedWithCode(tokenConn.getDB("admin").runCommand(
|
|
{renameCollection: fromName, to: toName, dropTarget: true}),
|
|
ErrorCodes.NamespaceNotFound);
|
|
|
|
assert.commandFailedWithCode(tokenDB2.runCommand({listIndexes: kCollName}),
|
|
ErrorCodes.NamespaceNotFound);
|
|
assert.commandFailedWithCode(
|
|
tokenDB2.runCommand({dropIndexes: kCollName, index: ["indexA", "indexB"]}),
|
|
ErrorCodes.NamespaceNotFound);
|
|
|
|
assert.commandFailedWithCode(tokenDB2.runCommand({validate: kCollName}),
|
|
ErrorCodes.NamespaceNotFound);
|
|
|
|
// ListDatabases with securityToken of kOtherTenant cannot access databases created by
|
|
// kTenant.
|
|
const dbsWithDiffToken = assert.commandWorked(
|
|
tokenConn.getDB('admin').runCommand({listDatabases: 1, nameOnly: true}));
|
|
// Only the 'admin' db exists
|
|
assert.eq(1, dbsWithDiffToken.databases.length);
|
|
const expectedAdminDb = featureFlagRequireTenantId ? "admin" : kOtherTenant + "_admin";
|
|
assert(arrayEq([expectedAdminDb], dbsWithDiffToken.databases.map(db => db.name)));
|
|
|
|
// Attempt to drop the database, then check it was not dropped.
|
|
assert.commandWorked(tokenDB2.runCommand({dropDatabase: 1}));
|
|
|
|
// Run listCollections using the original user's security token to see the collection
|
|
// exists.
|
|
tokenConn._setSecurityToken(securityToken);
|
|
const collsAfterDropOtherTenant =
|
|
assert.commandWorked(tokenDB.runCommand({listCollections: 1, nameOnly: true}));
|
|
assert.eq(1,
|
|
collsAfterDropOtherTenant.cursor.firstBatch.length,
|
|
tojson(collsAfterDropOtherTenant.cursor.firstBatch));
|
|
}
|
|
|
|
// Test aggregation stage commands
|
|
{
|
|
// Create a number of collections and entries used to test agg stages
|
|
const kCollA = "collA";
|
|
const kCollB = "collB";
|
|
const kCollC = "collC";
|
|
const kCollD = "collD";
|
|
assert.commandWorked(tokenDB.createCollection(kCollA));
|
|
assert.commandWorked(tokenDB.createCollection(kCollB));
|
|
|
|
const collADocs = [
|
|
{_id: 0, start: "a", end: "b"},
|
|
{_id: 1, start: "b", end: "c"},
|
|
{_id: 2, start: "c", end: "d"}
|
|
];
|
|
const collBDocs = [
|
|
{_id: 0, ref: "a", payload: "1"},
|
|
{_id: 1, ref: "c", payload: "2"},
|
|
{_id: 2, ref: "e", payload: "3"}
|
|
];
|
|
|
|
assert.commandWorked(tokenDB.runCommand({insert: kCollA, documents: collADocs}));
|
|
assert.commandWorked(tokenDB.runCommand({insert: kCollB, documents: collBDocs}));
|
|
|
|
// Set up agg stage input documents
|
|
const lookupPlannerStage = {
|
|
$lookup: {from: kCollB, localField: "start", foreignField: "ref", as: "refs"}
|
|
};
|
|
|
|
// Set up assertion targets
|
|
const lookupTarget = [
|
|
{_id: 0, refs: [{_id: 0, ref: "a", payload: "1"}]},
|
|
{_id: 1, refs: []},
|
|
{_id: 2, refs: [{_id: 1, ref: "c", payload: "2"}]}
|
|
];
|
|
|
|
// $lookup agg stage that exercises query planner.
|
|
{
|
|
const lookupPlannerRes = assert.commandWorked(tokenDB.runCommand({
|
|
aggregate: kCollA,
|
|
pipeline: [lookupPlannerStage, {$project: {_id: 1, refs: 1}}],
|
|
cursor: {}
|
|
}));
|
|
assert(arrayEq(lookupTarget, lookupPlannerRes.cursor.firstBatch));
|
|
checkNsSerializedCorrectly(
|
|
featureFlagRequireTenantId, kTenant, kDbName, kCollA, lookupPlannerRes.cursor.ns);
|
|
}
|
|
}
|
|
|
|
// Test commands using a privleged user with ActionType::useTenant and check the user can still
|
|
// run commands on the doc when passing the correct tenant, but not when passing a different
|
|
// tenant.
|
|
{
|
|
const privelegedConn = new Mongo(primary.host);
|
|
assert(privelegedConn.getDB('admin').auth('admin', 'pwd'));
|
|
const privelegedDB = privelegedConn.getDB(kDbName);
|
|
|
|
// Find and modify the document using $tenant.
|
|
{
|
|
const fadCorrectDollarTenant = assert.commandWorked(privelegedDB.runCommand({
|
|
findAndModify: kCollName,
|
|
query: {b: 1},
|
|
update: {$inc: {b: 10}},
|
|
'$tenant': kTenant
|
|
}));
|
|
assert.eq({_id: 0, a: 1, b: 1}, fadCorrectDollarTenant.value);
|
|
|
|
const fadOtherDollarTenant = assert.commandWorked(privelegedDB.runCommand({
|
|
findAndModify: kCollName,
|
|
query: {b: 11},
|
|
update: {$inc: {b: 10}},
|
|
'$tenant': kOtherTenant
|
|
}));
|
|
assert.eq(null, fadOtherDollarTenant.value);
|
|
|
|
// Reset document data.
|
|
assert.commandWorked(privelegedDB.runCommand({
|
|
findAndModify: kCollName,
|
|
query: {b: 11},
|
|
update: {$set: {a: 1, b: 1}},
|
|
'$tenant': kTenant
|
|
}));
|
|
}
|
|
|
|
// Rename the collection using $tenant.
|
|
{
|
|
const fromName = kDbName + '.' + kCollName;
|
|
const toName = fromName + "_renamed";
|
|
const privelegedAdminDB = privelegedConn.getDB('admin');
|
|
assert.commandWorked(privelegedAdminDB.runCommand(
|
|
{renameCollection: fromName, to: toName, dropTarget: true, '$tenant': kTenant}));
|
|
|
|
// Verify the the renamed collection by findAndModify existing documents.
|
|
const fad1 = assert.commandWorked(privelegedDB.runCommand({
|
|
findAndModify: kCollName + "_renamed",
|
|
query: {a: 1},
|
|
update: {$set: {a: 11, b: 1}},
|
|
'$tenant': kTenant
|
|
}));
|
|
assert.eq({_id: 0, a: 1, b: 1}, fad1.value);
|
|
|
|
// Reset the collection name and document data.
|
|
assert.commandWorked(privelegedAdminDB.runCommand(
|
|
{renameCollection: toName, to: fromName, dropTarget: true, '$tenant': kTenant}));
|
|
assert.commandWorked(privelegedDB.runCommand({
|
|
findAndModify: kCollName,
|
|
query: {a: 11},
|
|
update: {$set: {a: 1, b: 1}},
|
|
'$tenant': kTenant
|
|
}));
|
|
}
|
|
}
|
|
|
|
// Test collMod
|
|
{
|
|
// Create the index used for collMod
|
|
let res = assert.commandWorked(tokenDB.runCommand({
|
|
createIndexes: kCollName,
|
|
indexes: [{key: {c: 1}, name: "indexC", expireAfterSeconds: 50}]
|
|
}));
|
|
assert.eq(2, res.numIndexesAfter);
|
|
jsTestLog(`Created index`);
|
|
|
|
// Modify the index with the tenantId
|
|
res = assert.commandWorked(tokenDB.runCommand(
|
|
{"collMod": kCollName, "index": {"keyPattern": {c: 1}, expireAfterSeconds: 100}}));
|
|
assert.eq(50, res.expireAfterSeconds_old);
|
|
assert.eq(100, res.expireAfterSeconds_new);
|
|
|
|
// Drop the index created
|
|
assert.commandWorked(tokenDB.runCommand({dropIndexes: kCollName, index: ["indexC"]}));
|
|
}
|
|
|
|
// Test dbCheck command.
|
|
// This should fail since dbCheck is not supporting using a security token.
|
|
{ assert.commandFailedWithCode(tokenDB.runCommand({dbCheck: kCollName}), ErrorCodes.Unauthorized); }
|
|
|
|
rst.stopSet();
|
|
})();
|