33 lines
1.3 KiB
JavaScript
33 lines
1.3 KiB
JavaScript
// Run using a leased application identity, never the bootstrap administrator.
|
|
if (db.hello().setName !== "rs0" || !db.hello().isWritablePrimary) {
|
|
throw new Error("replica set is not primary");
|
|
}
|
|
const own = db.getSiblingDB(database);
|
|
const name = "local_check_" + new ObjectId().toHexString();
|
|
const session = db.getMongo().startSession();
|
|
try {
|
|
own.createCollection(name);
|
|
const collection = session.getDatabase(database).getCollection(name);
|
|
session.startTransaction();
|
|
collection.insertMany([{_id: "first"}, {_id: "second"}]);
|
|
session.commitTransaction();
|
|
if (own.getCollection(name).countDocuments({}) !== 2) throw new Error("commit failed");
|
|
session.startTransaction();
|
|
collection.deleteOne({_id: "first"});
|
|
collection.insertOne({_id: "aborted"});
|
|
session.abortTransaction();
|
|
if (own.getCollection(name).countDocuments({}) !== 2 ||
|
|
!own.getCollection(name).findOne({_id: "first"}) ||
|
|
own.getCollection(name).findOne({_id: "aborted"})) throw new Error("rollback failed");
|
|
let denied = false;
|
|
try {
|
|
const result = db.getSiblingDB(forbidden).runCommand({find: name, filter: {}});
|
|
denied = result.code === 13;
|
|
} catch (error) { denied = error.code === 13; }
|
|
if (!denied) throw new Error("cross-database access allowed");
|
|
print("scope-ok");
|
|
} finally {
|
|
session.endSession();
|
|
own.getCollection(name).drop();
|
|
}
|