SERVER-6246 SERVER-9515 Update usersInfo and rolesInfo commands to new API

stbrody · stbrody · commit ee7ea7ea7f8e · 2013-10-06T17:19:23.000-04:00
diff --git a/jstests/auth/basic_role_auth.js b/jstests/auth/basic_role_auth.js
@@ -186,7 +186,7 @@ var testOps = function(db, allowedActions) {
     }, db);
 
     checkErr(allowedActions.hasOwnProperty('user_r'), function() {
-        var result = db.runCommand({usersInfo: /.*/});
+        var result = db.runCommand({usersInfo: 1});
         if (!result.ok) {
             throw new Error(tojson(result));
         }
diff --git a/src/mongo/db/auth/authorization_manager.cpp b/src/mongo/db/auth/authorization_manager.cpp
@@ -225,8 +225,9 @@ namespace mongo {
     Status AuthorizationManager::queryAuthzDocument(
             const NamespaceString& collectionName,
             const BSONObj& query,
+            const BSONObj& projection,
             const boost::function<void(const BSONObj&)>& resultProcessor) {
-        return _externalState->query(collectionName, query, resultProcessor);
+        return _externalState->query(collectionName, query, projection, resultProcessor);
     }
 
     Status AuthorizationManager::updateAuthzDocuments(const NamespaceString& collectionName,
diff --git a/src/mongo/db/auth/authorization_manager.h b/src/mongo/db/auth/authorization_manager.h
@@ -217,6 +217,7 @@ namespace mongo {
          */
         Status queryAuthzDocument(const NamespaceString& collectionName,
                                   const BSONObj& query,
+                                  const BSONObj& projection,
                                   const boost::function<void(const BSONObj&)>& resultProcessor);
 
         // Checks to see if "doc" is a valid privilege document, assuming it is stored in the
diff --git a/src/mongo/db/auth/authz_manager_external_state.h b/src/mongo/db/auth/authz_manager_external_state.h
@@ -156,6 +156,7 @@ namespace mongo {
          */
         virtual Status query(const NamespaceString& collectionName,
                              const BSONObj& query,
+                             const BSONObj& projection,
                              const boost::function<void(const BSONObj&)>& resultProcessor) = 0;
 
         /**
diff --git a/src/mongo/db/auth/authz_manager_external_state_d.cpp b/src/mongo/db/auth/authz_manager_external_state_d.cpp
@@ -237,11 +237,12 @@ namespace {
     Status AuthzManagerExternalStateMongod::query(
             const NamespaceString& collectionName,
             const BSONObj& query,
+            const BSONObj& projection,
             const boost::function<void(const BSONObj&)>& resultProcessor) {
         try {
             DBDirectClient client;
             Client::GodScope gs;
-            client.query(resultProcessor, collectionName.ns(), query);
+            client.query(resultProcessor, collectionName.ns(), query, &projection);
             return Status::OK();
         } catch (const DBException& e) {
             return e.toStatus();
@@ -452,6 +453,7 @@ namespace {
         Status status = query(
                 AuthorizationManager::rolesCollectionNamespace,
                 BSONObj(),
+                BSONObj(),
                 boost::bind(addRoleFromDocumentOrWarn, &newRoleGraph, _1));
         if (!status.isOK())
             return status;
diff --git a/src/mongo/db/auth/authz_manager_external_state_d.h b/src/mongo/db/auth/authz_manager_external_state_d.h
@@ -65,6 +65,7 @@ namespace mongo {
                                BSONObj* result);
         virtual Status query(const NamespaceString& collectionName,
                              const BSONObj& query,
+                             const BSONObj& projection,
                              const boost::function<void(const BSONObj&)>& resultProcessor);
         virtual Status insert(const NamespaceString& collectionName,
                               const BSONObj& document,
diff --git a/src/mongo/db/auth/authz_manager_external_state_mock.cpp b/src/mongo/db/auth/authz_manager_external_state_mock.cpp
@@ -213,6 +213,7 @@ namespace {
     Status AuthzManagerExternalStateMock::query(
             const NamespaceString& collectionName,
             const BSONObj& query,
+            const BSONObj&,
             const boost::function<void(const BSONObj&)>& resultProcessor) {
         std::vector<BSONObjCollection::iterator> iterVector;
         Status status = _queryVector(collectionName, query, &iterVector);
diff --git a/src/mongo/db/auth/authz_manager_external_state_mock.h b/src/mongo/db/auth/authz_manager_external_state_mock.h
@@ -87,6 +87,7 @@ namespace mongo {
 
         virtual Status query(const NamespaceString& collectionName,
                              const BSONObj& query,
+                             const BSONObj& projection, // Currently unused in mock
                              const boost::function<void(const BSONObj&)>& resultProcessor);
 
         // This implementation does not understand uniqueness constraints.
diff --git a/src/mongo/db/auth/authz_manager_external_state_s.cpp b/src/mongo/db/auth/authz_manager_external_state_s.cpp
@@ -79,8 +79,14 @@ namespace {
                     AuthorizationManager::usersCollectionNamespace));
             BSONObj cmdResult;
             conn->get()->runCommand(
-                    userName.getDB().toString(),  // TODO: Change usersInfo so this command can always go to "admin".
-                    BSON("usersInfo" << userName.getUser() << "details" << true),
+                    "admin",
+                    BSON("usersInfo" <<
+                         BSON_ARRAY(BSON(AuthorizationManager::USER_NAME_FIELD_NAME <<
+                                         userName.getUser() <<
+                                         AuthorizationManager::USER_SOURCE_FIELD_NAME <<
+                                         userName.getDB())) <<
+                         "showPrivileges" << true <<
+                         "showCredentials" << true),
                     cmdResult);
             if (!cmdResult["ok"].trueValue()) {
                 int code = cmdResult["code"].numberInt();
@@ -102,8 +108,12 @@ namespace {
                     AuthorizationManager::rolesCollectionNamespace));
             BSONObj cmdResult;
             conn->get()->runCommand(
-                    roleName.getDB().toString(),  // TODO: Change rolesInfo so this command can always go to "admin".
-                    BSON("rolesInfo" << roleName.getRole()),
+                    "admin",
+                    BSON("rolesInfo" <<
+                         BSON_ARRAY(BSON(AuthorizationManager::ROLE_NAME_FIELD_NAME <<
+                                         roleName.getRole() <<
+                                         AuthorizationManager::ROLE_SOURCE_FIELD_NAME <<
+                                         roleName.getDB()))),
                     cmdResult);
             if (!cmdResult["ok"].trueValue()) {
                 int code = cmdResult["code"].numberInt();
@@ -138,10 +148,11 @@ namespace {
     Status AuthzManagerExternalStateMongos::query(
             const NamespaceString& collectionName,
             const BSONObj& query,
+            const BSONObj& projection,
             const boost::function<void(const BSONObj&)>& resultProcessor) {
         try {
             scoped_ptr<ScopedDbConnection> conn(getConnectionForAuthzCollection(collectionName));
-            conn->get()->query(resultProcessor, collectionName.ns(), query);
+            conn->get()->query(resultProcessor, collectionName.ns(), query, &projection);
             return Status::OK();
         } catch (const DBException& e) {
             return e.toStatus();
diff --git a/src/mongo/db/auth/authz_manager_external_state_s.h b/src/mongo/db/auth/authz_manager_external_state_s.h
@@ -66,6 +66,7 @@ namespace mongo {
                                BSONObj* result);
         virtual Status query(const NamespaceString& collectionName,
                              const BSONObj& query,
+                             const BSONObj& projection,
                              const boost::function<void(const BSONObj&)>& resultProcessor);
         virtual Status insert(const NamespaceString& collectionName,
                               const BSONObj& document,
diff --git a/src/mongo/db/auth/user_management_commands_parser.cpp b/src/mongo/db/auth/user_management_commands_parser.cpp
@@ -81,44 +81,82 @@ namespace auth {
         return Status::OK();
     }
 
-    Status parseRoleNamesFromBSONArray(const BSONArray& rolesArray,
-                                       const StringData& dbname,
-                                       const StringData& rolesFieldName,
-                                       std::vector<RoleName>* parsedRoleNames) {
-        for (BSONObjIterator it(rolesArray); it.more(); it.next()) {
-            BSONElement element = *it;
-            if (element.type() == String) {
-                parsedRoleNames->push_back(RoleName(element.String(), dbname));
+    // Extracts a UserName or RoleName object from a BSONElement.
+    template <typename Name>
+    Status _parseNameFromBSONElement(const BSONElement& element,
+                                     const StringData& dbname,
+                                     const StringData& nameFieldName,
+                                     const StringData& sourceFieldName,
+                                     Name* parsedName) {
+        if (element.type() == String) {
+            *parsedName = Name(element.String(), dbname);
+        }
+        else if (element.type() == Object) {
+            BSONObj obj = element.Obj();
+
+            std::string name;
+            std::string source;
+            Status status = bsonExtractStringField(obj, nameFieldName, &name);
+            if (!status.isOK()) {
+                return status;
             }
-            else if (element.type() == Object) {
-                BSONObj roleObj = element.Obj();
-
-                std::string roleNameString;
-                std::string roleSource;
-                Status status = bsonExtractStringField(roleObj,
-                                                       AuthorizationManager::ROLE_NAME_FIELD_NAME,
-                                                       &roleNameString);
-                if (!status.isOK()) {
-                    return status;
-                }
-                status = bsonExtractStringField(roleObj,
-                                                AuthorizationManager::ROLE_SOURCE_FIELD_NAME,
-                                                &roleSource);
-                if (!status.isOK()) {
-                    return status;
-                }
-
-                parsedRoleNames->push_back(RoleName(roleNameString, roleSource));
+            status = bsonExtractStringField(obj, sourceFieldName, &source);
+            if (!status.isOK()) {
+                return status;
             }
-            else {
-                return Status(ErrorCodes::BadValue,
-                              mongoutils::str::stream() << "Values in \"" << rolesFieldName <<
-                                      "\" array must be sub-documents or strings");
+
+            *parsedName = Name(name, source);
+        }
+        else {
+            return Status(ErrorCodes::BadValue,
+                          "User and role names must be either strings or objects");
+        }
+        return Status::OK();
+    }
+
+    // Extracts UserName or RoleName objects from a BSONArray of role/user names.
+    template <typename Name>
+    Status _parseNamesFromBSONArray(const BSONArray& array,
+                                    const StringData& dbname,
+                                    const StringData& nameFieldName,
+                                    const StringData& sourceFieldName,
+                                    std::vector<Name>* parsedNames) {
+        for (BSONObjIterator it(array); it.more(); it.next()) {
+            BSONElement element = *it;
+            Name name;
+            Status status = _parseNameFromBSONElement(element,
+                                                      dbname,
+                                                      nameFieldName,
+                                                      sourceFieldName,
+                                                      &name);
+            if (!status.isOK()) {
+                return status;
             }
+            parsedNames->push_back(name);
         }
         return Status::OK();
     }
 
+    Status _parseUserNamesFromBSONArray(const BSONArray& usersArray,
+                                        const StringData& dbname,
+                                       std::vector<UserName>* parsedUserNames) {
+        return _parseNamesFromBSONArray(usersArray,
+                                        dbname,
+                                        AuthorizationManager::USER_NAME_FIELD_NAME,
+                                        AuthorizationManager::USER_SOURCE_FIELD_NAME,
+                                        parsedUserNames);
+    }
+
+    Status parseRoleNamesFromBSONArray(const BSONArray& rolesArray,
+                                       const StringData& dbname,
+                                       std::vector<RoleName>* parsedRoleNames) {
+        return _parseNamesFromBSONArray(rolesArray,
+                                        dbname,
+                                        AuthorizationManager::ROLE_NAME_FIELD_NAME,
+                                        AuthorizationManager::ROLE_SOURCE_FIELD_NAME,
+                                        parsedRoleNames);
+    }
+
     Status _extractRoleDataFromBSONArray(const BSONElement& rolesElement,
                                          const std::string& dbname,
                                          std::vector<User::RoleData> *parsedRoleData) {
@@ -208,7 +246,6 @@ namespace auth {
 
         status = parseRoleNamesFromBSONArray(BSONArray(rolesElement.Obj()),
                                              dbname,
-                                             rolesFieldName,
                                              parsedRoleNames);
         if (!status.isOK()) {
             return status;
@@ -342,44 +379,89 @@ namespace auth {
         return Status::OK();
     }
 
-    Status parseAndValidateInfoCommands(const BSONObj& cmdObj,
-                                        const StringData& cmdName,
-                                        const std::string& dbname,
-                                        bool* parsedAnyDB,
-                                        BSONElement* parsedNameFilter) {
+    Status parseUsersInfoCommand(const BSONObj& cmdObj,
+                                 const StringData& dbname,
+                                 UsersInfoArgs* parsedArgs) {
         unordered_set<std::string> validFieldNames;
-        validFieldNames.insert(cmdName.toString());
-        validFieldNames.insert("anyDB");
-        validFieldNames.insert("writeConcern");
-        validFieldNames.insert("details");
+        validFieldNames.insert("usersInfo");
+        validFieldNames.insert("showPrivileges");
+        validFieldNames.insert("showCredentials");
 
-        Status status = _checkNoExtraFields(cmdObj, cmdName, validFieldNames);
+        Status status = _checkNoExtraFields(cmdObj, "usersInfo", validFieldNames);
         if (!status.isOK()) {
             return status;
         }
 
-        if (cmdObj[cmdName].type() != String && cmdObj[cmdName].type() != RegEx) {
-            return Status(ErrorCodes::BadValue,
-                          mongoutils::str::stream() << "Argument to \"" << cmdName <<
-                                  "\"command must be either a string or a regex");
+        if (cmdObj["usersInfo"].numberInt() == 1) {
+            parsedArgs->allForDB = true;
+        } else if (cmdObj["usersInfo"].type() == Array) {
+            status = _parseUserNamesFromBSONArray(BSONArray(cmdObj["usersInfo"].Obj()),
+                                                  dbname,
+                                                  &parsedArgs->userNames);
+            if (!status.isOK()) {
+                return status;
+            }
+        } else {
+            UserName name;
+            status = _parseNameFromBSONElement(cmdObj["usersInfo"],
+                                               dbname,
+                                               AuthorizationManager::USER_NAME_FIELD_NAME,
+                                               AuthorizationManager::USER_SOURCE_FIELD_NAME,
+                                               &name);
+            if (!status.isOK()) {
+                return status;
+            }
+            parsedArgs->userNames.push_back(name);
         }
-        *parsedNameFilter = cmdObj[cmdName];
 
+        status = bsonExtractBooleanFieldWithDefault(cmdObj,
+                                                    "showPrivileges",
+                                                    false,
+                                                    &parsedArgs->showPrivileges);
+        if (!status.isOK()) {
+            return status;
+        }
+        status = bsonExtractBooleanFieldWithDefault(cmdObj,
+                                                    "showCredentials",
+                                                    false,
+                                                    &parsedArgs->showCredentials);
+        if (!status.isOK()) {
+            return status;
+        }
 
-        bool anyDB = false;
-        if (cmdObj.hasField("anyDB")) {
-            if (dbname == "admin") {
-                Status status = bsonExtractBooleanField(cmdObj, "anyDB", &anyDB);
-                if (!status.isOK()) {
-                    return status;
-                }
-            } else {
-                return Status(ErrorCodes::BadValue,
-                              mongoutils::str::stream() << "\"anyDB\" argument to \"" << cmdName <<
-                                      "\"command is only valid when run on the \"admin\" database");
+        return Status::OK();
+    }
+
+    Status parseRolesInfoCommand(const BSONObj& cmdObj,
+                                 const StringData& dbname,
+                                 std::vector<RoleName>* parsedRoleNames) {
+        unordered_set<std::string> validFieldNames;
+        validFieldNames.insert("rolesInfo");
+
+        Status status = _checkNoExtraFields(cmdObj, "rolesInfo", validFieldNames);
+        if (!status.isOK()) {
+            return status;
+        }
+
+        if (cmdObj["rolesInfo"].type() == Array) {
+            status = parseRoleNamesFromBSONArray(BSONArray(cmdObj["rolesInfo"].Obj()),
+                                                 dbname,
+                                                 parsedRoleNames);
+            if (!status.isOK()) {
+                return status;
+            }
+        } else {
+            RoleName name;
+            status = _parseNameFromBSONElement(cmdObj["rolesInfo"],
+                                               dbname,
+                                               AuthorizationManager::ROLE_NAME_FIELD_NAME,
+                                               AuthorizationManager::ROLE_SOURCE_FIELD_NAME,
+                                               &name);
+            if (!status.isOK()) {
+                return status;
             }
+            parsedRoleNames->push_back(name);
         }
-        *parsedAnyDB = anyDB;
 
         return Status::OK();
     }
@@ -467,7 +549,6 @@ namespace auth {
             }
             status = parseRoleNamesFromBSONArray(BSONArray(rolesElement.Obj()),
                                                  dbname,
-                                                 "roles",
                                                  &parsedArgs->roles);
             if (!status.isOK()) {
                 return status;
diff --git a/src/mongo/db/auth/user_management_commands_parser.h b/src/mongo/db/auth/user_management_commands_parser.h
diff --git a/src/mongo/db/commands/user_management_commands.cpp b/src/mongo/db/commands/user_management_commands.cpp
diff --git a/src/mongo/shell/db.js b/src/mongo/shell/db.js

Original file line number	Diff line number	Diff line change
`@@ -186,7 +186,7 @@ var testOps = function(db, allowedActions) {`
`186`	`186`	`}, db);`
`187`	`187`
`188`	`188`	`checkErr(allowedActions.hasOwnProperty('user_r'), function() {`
`189`		`- var result = db.runCommand({usersInfo: /.*/});`
	`189`	`+ var result = db.runCommand({usersInfo: 1});`
`190`	`190`	`if (!result.ok) {`
`191`	`191`	`throw new Error(tojson(result));`
`192`	`192`	`}`