Replace Python development tooling with Make and containerized shell

dev/mongo-check.js

@@ -0,0 +1,32 @@
+// Run using a leased application identity, never the bootstrap administrator.
+if (db.hello().setName !== "rs0" || !db.hello().isWritablePrimary) {
+  throw new Error("replica set is not primary");
+}
+const own = db.getSiblingDB(database);
+const name = "local_check_" + new ObjectId().toHexString();
+const session = db.getMongo().startSession();
+try {
+  own.createCollection(name);
+  const collection = session.getDatabase(database).getCollection(name);
+  session.startTransaction();
+  collection.insertMany([{_id: "first"}, {_id: "second"}]);
+  session.commitTransaction();
+  if (own.getCollection(name).countDocuments({}) !== 2) throw new Error("commit failed");
+  session.startTransaction();
+  collection.deleteOne({_id: "first"});
+  collection.insertOne({_id: "aborted"});
+  session.abortTransaction();
+  if (own.getCollection(name).countDocuments({}) !== 2 ||
+      !own.getCollection(name).findOne({_id: "first"}) ||
+      own.getCollection(name).findOne({_id: "aborted"})) throw new Error("rollback failed");
+  let denied = false;
+  try {
+    const result = db.getSiblingDB(forbidden).runCommand({find: name, filter: {}});
+    denied = result.code === 13;
+  } catch (error) { denied = error.code === 13; }
+  if (!denied) throw new Error("cross-database access allowed");
+  print("scope-ok");
+} finally {
+  session.endSession();
+  own.getCollection(name).drop();
+}