// Run using a leased application identity, never the bootstrap administrator.
if (db.hello().setName !== "rs0" || !db.hello().isWritablePrimary) {
  throw new Error("replica set is not primary");
}
const own = db.getSiblingDB(database);
const name = "local_check_" + new ObjectId().toHexString();
const session = db.getMongo().startSession();
try {
  own.createCollection(name);
  const collection = session.getDatabase(database).getCollection(name);
  session.startTransaction();
  collection.insertMany([{_id: "first"}, {_id: "second"}]);
  session.commitTransaction();
  if (own.getCollection(name).countDocuments({}) !== 2) throw new Error("commit failed");
  session.startTransaction();
  collection.deleteOne({_id: "first"});
  collection.insertOne({_id: "aborted"});
  session.abortTransaction();
  if (own.getCollection(name).countDocuments({}) !== 2 ||
      !own.getCollection(name).findOne({_id: "first"}) ||
      own.getCollection(name).findOne({_id: "aborted"})) throw new Error("rollback failed");
  let denied = false;
  try {
    const result = db.getSiblingDB(forbidden).runCommand({find: name, filter: {}});
    denied = result.code === 13;
  } catch (error) { denied = error.code === 13; }
  if (!denied) throw new Error("cross-database access allowed");
  print("scope-ok");
} finally {
  session.endSession();
  own.getCollection(name).drop();
}