Update upstream source from tag 'upstream/6.0.0'master

Update to upstream version '6.0.0'
with Debian dir 5604a80ec1c96ca76f25f40d78e6ef855abec322

9 files changed, 13 insertions, 472 deletions

diff --git a/jstests/auth/authz_cache_on_system_modification.js b/jstests/auth/authz_cache_on_system_modification.js
index 65c49951853..23473cd0d01 100644
--- a/jstests/auth/authz_cache_on_system_modification.js
+++ b/jstests/auth/authz_cache_on_system_modification.js
@@ -7,6 +7,7 @@
 
 const conn = MongoRunner.runMongod({auth: ''});
 let db = conn.getDB('admin');
+const authzErrorCode = 13;
 
 // creates a root user
 assert.commandWorked(db.runCommand({createUser: 'root', pwd: 'pwd', roles: ['__system']}),
@@ -45,32 +46,23 @@ db.logout();
     assert(db.auth('custom', 'pwd'));
     assert.commandFailedWithCode(
         db.runCommand({insert: "admin.test", documents: [{woo: "mar"}]}),
-        ErrorCodes.Unauthorized,
+        authzErrorCode,
         "Privileges retained after modification to system.roles collections");
     db.logout();
 })();
 
-// tests that a user cannot rename the system.users collection.
+// tests that a user does not retain their privileges after the system.users colleciton is modified
 (function testModifySystemUsersCollection() {
-    jsTestLog("Testing that a user cannot rename the system.users collection");
+    jsTestLog("Testing authz cache invalidation on system.users collection modification");
     assert(db.auth('root', 'pwd'));
-
-    assert.commandFailedWithCode(
-        db.runCommand({renameCollection: 'admin.system.users', to: 'foo.system.users'}),
-        ErrorCodes.IllegalOperation,
-        "Renaming the system.users collection should not be allowed");
-    assert.commandFailedWithCode(
-        db.runCommand({renameCollection: 'foo.system.users', to: 'admin.system.users'}),
-        ErrorCodes.IllegalOperation,
-        "Renaming the system.users collection should not be allowed");
-    assert.commandFailedWithCode(
-        db.runCommand({renameCollection: 'admin.system.users', to: 'admin.system.foo'}),
-        ErrorCodes.IllegalOperation,
-        "Renaming the system.users collection should not be allowed");
+    assert.commandWorked(db.createCollection("scratch", {}),
+                         "Collection not created with root user");
+    assert.commandWorked(db.runCommand({renameCollection: 'admin.system.users', to: 'admin.foo'}),
+                         "System collection could not be renamed with root user");
     assert.commandFailedWithCode(
-        db.runCommand({renameCollection: 'admin.system.foo', to: 'admin.system.users'}),
-        ErrorCodes.IllegalOperation,
-        "Renaming the system.users collection should not be allowed");
+        db.runCommand({renameCollection: 'admin.scratch', to: 'admin.system.users'}),
+        authzErrorCode,
+        "User cache not invalidated after modification to system collection");
     db.logout();
 })();
 
diff --git a/jstests/auth/builtin_roles.js b/jstests/auth/builtin_roles.js
index 354bd69c67a..67590b1c606 100644
--- a/jstests/auth/builtin_roles.js
+++ b/jstests/auth/builtin_roles.js
@@ -64,7 +64,6 @@ function runTest(mongo) {
         'killCursors',
         'listCollections',
         'listIndexes',
-        'listSearchIndexes',
         'planCacheRead'
     ];
     const kAdminReadPrivs = [
diff --git a/jstests/auth/cluster_monitor_role_find_system_sessions.js b/jstests/auth/cluster_monitor_role_find_system_sessions.js
deleted file mode 100644
index 19087a81f83..00000000000
--- a/jstests/auth/cluster_monitor_role_find_system_sessions.js
+++ /dev/null
@@ -1,37 +0,0 @@
-// Verify that the clusterMonitor role can access config.system.sessions
-
-(function() {
-'use strict';
-
-function runTestAs(conn, role) {
-    const admin = conn.getDB('admin');
-    const config = conn.getDB('config');
-
-    assert(admin.auth('admin', 'admin'));
-    const user = role + 'User';
-    assert.commandWorked(admin.runCommand({createUser: user, pwd: 'pwd', roles: [role]}));
-    admin.logout();
-
-    assert(admin.auth(user, 'pwd'));
-    jsTest.log('Acting as user with the ' + role + ' role');
-    jsTest.log(assert.commandWorked(admin.runCommand({connectionStatus: 1, showPrivileges: 1})));
-
-    assert.commandWorked(config.runCommand({collStats: 'system.sessions'}));
-    assert.commandFailedWithCode(config.runCommand({collStats: 'system.version'}),
-                                 ErrorCodes.Unauthorized);
-    admin.logout();
-}
-
-function runTest(conn) {
-    const admin = conn.getDB('admin');
-    const config = conn.getDB('config');
-    assert.commandWorked(
-        admin.runCommand({createUser: 'admin', pwd: 'admin', roles: ['__system']}));
-
-    runTestAs(conn, 'clusterMonitor');
-}
-
-const standalone = MongoRunner.runMongod({auth: ''});
-runTest(standalone);
-MongoRunner.stopMongod(standalone);
-})();
diff --git a/jstests/auth/keyfile_auth_ensure_correct_username_change.js b/jstests/auth/keyfile_auth_ensure_correct_username_change.js
deleted file mode 100644
index a57333ad8d8..00000000000
--- a/jstests/auth/keyfile_auth_ensure_correct_username_change.js
+++ /dev/null
@@ -1,73 +0,0 @@
-(function() {
-'use strict';
-
-load("jstests/libs/log.js");  // For findMatchingLogLine.
-
-function assertLog(mongo, shouldExist) {
-    const profileLevelDB = mongo.getDB("keyfile_auth_ensure_correct_username_change");
-    const globalLog = assert.commandWorked(profileLevelDB.adminCommand({getLog: 'global'}));
-    const fieldMatcher = {msg: "Different user name was supplied to saslSupportedMechs"};
-
-    if (shouldExist) {
-        assert(
-            findMatchingLogLine(globalLog.log, fieldMatcher),
-            "Did not find log line concerning \"Different user name was supplied to saslSupportedMechs\" when we expected to.");
-    } else {
-        assert.eq(
-            null,
-            findMatchingLogLine(globalLog.log, fieldMatcher),
-            "Unexpectedly found log line concerning \"Different user name was supplied to saslSupportedMechs\".");
-    }
-}
-
-// Switching from __system to another user should result in a warning.
-function runSaslSupportedMechsDiffUserTest() {
-    const mongo = MongoRunner.runMongod({auth: "", keyFile: "jstests/libs/key1"});
-    const admin = mongo.getDB("admin");
-
-    admin.createUser({user: 'user', pwd: 'pass', roles: jsTest.adminUserRoles});
-
-    // The username should be set to __system@local here because of the saslSupportedMechs field..
-    assert.commandWorked(admin.runCommand({
-        hello: 1,
-        saslSupportedMechs: "local.__system",
-    }));
-
-    // During this authentication, the username should be set to user@admin.
-    assert(admin.auth({user: 'user', pwd: 'pass', mechanism: 'SCRAM-SHA-256'}));
-
-    // We expect to see a log detailing that the username changed during authentication.
-    assertLog(mongo, true /* shouldExist */);
-
-    MongoRunner.stopMongod(mongo);
-}
-
-// Authenticating directly as __system without saslSupportedMechs should not result in a log.
-function runSystemDirectAuthTest() {
-    const mongo = MongoRunner.runMongod({auth: "", keyFile: "jstests/libs/key1"});
-    const local = mongo.getDB("local");
-    assert(local.auth({user: '__system', pwd: 'foopdedoop'}));
-
-    // We don't expect to see a log detailing that the username changed during authentication.
-    assertLog(mongo, false /* shouldExist */);
-
-    MongoRunner.stopMongod(mongo);
-}
-
-// Authenticating directly as user@admin should not result in a username switch warning.
-function runRegularUserDirectAuthTest() {
-    const mongo = MongoRunner.runMongod({auth: "", keyFile: "jstests/libs/key1"});
-    const admin = mongo.getDB("admin");
-
-    admin.createUser({user: 'user', pwd: 'pass', roles: jsTest.adminUserRoles});
-    assert(admin.auth({user: 'user', pwd: 'pass'}));
-
-    // We don't expect to see a log detailing that the username changed during authentication.
-    assertLog(mongo, false /* shouldExist */);
-    MongoRunner.stopMongod(mongo);
-}
-
-runSaslSupportedMechsDiffUserTest();
-runSystemDirectAuthTest();
-runRegularUserDirectAuthTest();
-})();
diff --git a/jstests/auth/renameRestrictedCollections.js b/jstests/auth/renameRestrictedCollections.js
index d54a0aec3eb..4d487d38d08 100644
--- a/jstests/auth/renameRestrictedCollections.js
+++ b/jstests/auth/renameRestrictedCollections.js
@@ -109,10 +109,9 @@ adminDB.logout();
 
 // Test renaming system.users collection with __system
 assert(adminDB.auth('rootier', 'password'));
-jsTestLog("Test that with __system you CANNOT rename to/from system.users");
+jsTestLog("Test that with __system you CAN rename to/from system.users");
 res = adminDB.system.users.renameCollection("users", true);
-assert.eq(0, res.ok, tojson(res));
-assert.eq(ErrorCodes.IllegalOperation, res.code);
+assert.eq(1, res.ok, tojson(res));
 
 // At this point, all the user documents are gone, so further activity may be unauthorized,
 // depending on cluster configuration.  So, this is the end of the test.
diff --git a/jstests/auth/rename_encrypted_collection.js b/jstests/auth/rename_encrypted_collection.js
deleted file mode 100644
index 76b01f9e62d..00000000000
--- a/jstests/auth/rename_encrypted_collection.js
+++ /dev/null
@@ -1,129 +0,0 @@
-/**
- * Verify renaming to/from a collection with encrypted fields is disallowed depending on the users
- * privileges
- *
- * @tags: [
- * requires_fcv_61,
- * ]
- */
-load("jstests/fle2/libs/encrypted_client_util.js");
-
-(function() {
-'use strict';
-
-function runTestWithAuth(conn, allowsRename, verifyFunction) {
-    const db = conn.getDB("test");
-    const srcDbName = 'rename_encrypted_collection_src_db';
-    const tgtDbName = 'rename_encrypted_collection_tgt_db';
-    const dbSrc = db.getSiblingDB(srcDbName);
-    const dbTgt = db.getSiblingDB(tgtDbName);
-
-    dbSrc.encrypted.drop();
-    dbTgt.encrypted.drop();
-
-    const sampleEncryptedFields = {
-        "fields": [
-            {
-                "path": "firstName",
-                "keyId": UUID("11d58b8a-0c6c-4d69-a0bd-70c6d9befae9"),
-                "bsonType": "string",
-                "queries": {"queryType": "equality"}
-            },
-        ]
-    };
-
-    const srcEncryptedErrmsg = "Cannot rename an encrypted collection";
-    const tgtEncryptedErrmsg = "Cannot rename to an existing encrypted collection";
-
-    const adminDB = conn.getDB("admin");
-
-    assert.commandWorked(
-        dbSrc.createCollection("encrypted", {encryptedFields: sampleEncryptedFields}));
-    assert.commandWorked(dbSrc.createCollection("unencrypted"));
-
-    assert.commandWorked(
-        dbTgt.createCollection("encrypted", {encryptedFields: sampleEncryptedFields}));
-
-    jsTestLog("Test renaming encrypted collection to another namespace is prohibited");
-    verifyFunction(
-        dbSrc.adminCommand({renameCollection: dbSrc + ".encrypted", to: dbSrc + ".renamed"}),
-        "Renaming an encrypted collection within same DB passed",
-        srcEncryptedErrmsg);
-
-    if (!allowsRename) {
-        verifyFunction(dbSrc.adminCommand(
-                           {renameCollection: dbSrc + ".encrypted", to: dbTgt + ".unencrypted"}),
-                       "Renaming an encrypted collection between DBs passed",
-                       srcEncryptedErrmsg);
-    }
-
-    jsTestLog("Test renaming unencrypted collection to an encrypted namespace is prohibited");
-    verifyFunction(
-        dbSrc.adminCommand(
-            {renameCollection: dbSrc + ".unencrypted", to: dbSrc + ".encrypted", dropTarget: true}),
-        "Renaming to an encrypted collection within same DB passed",
-        tgtEncryptedErrmsg);
-
-    if (!allowsRename) {
-        verifyFunction(dbSrc.adminCommand({
-            renameCollection: dbSrc + ".unencrypted",
-            to: dbTgt + ".encrypted",
-            dropTarget: true
-        }),
-                       "Renaming to an encrypted collection between DBs passed",
-                       tgtEncryptedErrmsg);
-    }
-}
-
-function runTest(conn) {
-    const adminDB = conn.getDB("admin");
-
-    // Create the admin user.
-    assert.commandWorked(adminDB.runCommand({createUser: "admin", pwd: "admin", roles: ["root"]}));
-    assert.eq(1, adminDB.auth("admin", "admin"));
-
-    // Create a low priv user
-    assert.commandWorked(adminDB.runCommand(
-        {createUser: "lowpriv", pwd: "lowpriv", roles: ["readWriteAnyDatabase"]}));
-
-    // Run tests with a user that has restore/backup role and verify they can rename
-    runTestWithAuth(conn, true, (cmdObj, assertMsg, errorMsg) => {
-        assert.commandWorked(cmdObj, assertMsg);
-    });
-    adminDB.logout();
-
-    assert.eq(1, adminDB.auth("lowpriv", "lowpriv"));
-
-    // Run tests with a user that does not have restore/backup and verify the rename fails
-    runTestWithAuth(conn, false, (cmd, assertMsg, errorMsg) => {
-        let res = assert.commandFailedWithCode(cmd, ErrorCodes.IllegalOperation, assertMsg);
-        assert.eq(res.errmsg, errorMsg);
-    });
-}
-
-jsTestLog("ReplicaSet: Testing fle2 collection rename");
-{
-    const rst = new ReplSetTest({nodes: 1});
-    rst.startSet({auth: "", keyFile: 'jstests/libs/key1'});
-
-    rst.initiate();
-    rst.awaitReplication();
-    runTest(rst.getPrimary(), rst.getPrimary());
-    rst.stopSet();
-}
-
-jsTestLog("Sharding: Testing fle2 collection rename");
-{
-    const st = new ShardingTest({
-        shards: 1,
-        mongos: 1,
-        config: 1,
-        keyFile: "jstests/libs/key1",
-        other: {shardOptions: {auth: ""}}
-    });
-
-    runTest(st.s);
-
-    st.stop();
-}
-}());
diff --git a/jstests/auth/rename_system_buckets_collection.js b/jstests/auth/rename_system_buckets_collection.js
deleted file mode 100644
index 2a6fa9cfe3e..00000000000
--- a/jstests/auth/rename_system_buckets_collection.js
+++ /dev/null
@@ -1,128 +0,0 @@
-// Tests renaming the system.buckets collection.
-(function() {
-"use strict";
-
-// Set up the test database.
-const dbName = "test";
-const collName = "mongosync.tmp.UUID123";
-const bucketsCollName = `system.buckets.${collName}`;
-const targetBucketsCollName = "system.buckets.manual";
-
-function renameBucketsCollection(adminDB, username, shouldSucceed) {
-    // Create collection under admin user
-    assert.eq(1, adminDB.auth("admin", "admin"));
-
-    const testDB = adminDB.getSiblingDB(dbName);
-
-    testDB[bucketsCollName].drop();
-    testDB[targetBucketsCollName].drop();
-
-    assert.commandWorked(
-        testDB.createCollection(bucketsCollName, {timeseries: {timeField: "time"}}));
-    adminDB.logout();
-
-    // Try rename with test users
-    jsTestLog("Testing system.buckets renaming with username: " + username);
-    assert(adminDB.auth(username, 'password'));
-
-    // No privilege grants the ability to rename a system.buckets collection to a non-bucket
-    // namespace.
-    assert.commandFailed(testDB.adminCommand({
-        renameCollection: `${testDB}.${bucketsCollName}`,
-        to: `${testDB}.${collName}`,
-        dropTarget: false
-    }));
-
-    const res = testDB.adminCommand({
-        renameCollection: `${testDB}.${bucketsCollName}`,
-        to: `${testDB}.${targetBucketsCollName}`,
-        dropTarget: true
-    });
-
-    assert.eq((shouldSucceed) ? 1 : 0,
-              res.ok,
-              "Rename collection failed or succeeded unexpectedly:" + tojson(res));
-
-    adminDB.logout();
-}
-
-function runTest(conn) {
-    const adminDB = conn.getDB("admin");
-
-    // Create the admin user.
-    adminDB.createUser({user: 'admin', pwd: 'admin', roles: ['root']});
-    assert.eq(1, adminDB.auth("admin", "admin"));
-
-    // Create roles with ability to rename system.buckets collections.
-    adminDB.createRole({
-        role: "renameBucketsOnly",
-        privileges: [{
-            resource: {db: '', system_buckets: ''},
-            actions: [
-                "createIndex",
-                "dropCollection",
-                "find",
-                "insert",
-            ]
-        }],
-        roles: []
-    });
-
-    // Create test users.
-    adminDB.createUser(
-        {user: 'userAdmin', pwd: 'password', roles: ['userAdminAnyDatabase', 'renameBucketsOnly']});
-
-    // Create read and write users.
-    adminDB.createUser({
-        user: 'readWriteAdmin',
-        pwd: 'password',
-        roles: ['readWriteAnyDatabase', 'renameBucketsOnly']
-    });
-
-    // Create strong users.
-    adminDB.createUser({user: 'restore', pwd: 'password', roles: ['restore', 'renameBucketsOnly']});
-    adminDB.createUser({user: 'root', pwd: 'password', roles: ['root', 'renameBucketsOnly']});
-    adminDB.createUser(
-        {user: 'rootier', pwd: 'password', roles: ['__system', 'renameBucketsOnly']});
-    adminDB.createUser(
-        {user: 'reader', pwd: 'password', roles: ['readAnyDatabase', 'renameBucketsOnly']});
-
-    adminDB.logout();
-
-    // Expect renaming system.buckets collection to succeed.
-    renameBucketsCollection(adminDB, 'restore', true);
-    renameBucketsCollection(adminDB, 'root', true);
-    renameBucketsCollection(adminDB, 'rootier', true);
-
-    // Second test case should fail for user with inadequate role.
-    renameBucketsCollection(adminDB, 'reader', false);
-    renameBucketsCollection(adminDB, 'readWriteAdmin', false);
-    renameBucketsCollection(adminDB, 'userAdmin', false);
-}
-
-jsTestLog("ReplicaSet: Testing rename timeseries collection");
-{
-    const rst = new ReplSetTest({nodes: 1, auth: "", keyFile: 'jstests/libs/key1'});
-    rst.startSet();
-
-    rst.initiate();
-    rst.awaitReplication();
-    runTest(rst.getPrimary());
-    rst.stopSet();
-}
-
-jsTestLog("Sharding: Testing rename timeseries collection");
-{
-    const st = new ShardingTest({
-        shards: 1,
-        mongos: 1,
-        config: 1,
-        keyFile: "jstests/libs/key1",
-        other: {shardOptions: {auth: ""}}
-    });
-
-    runTest(st.s);
-
-    st.stop();
-}
-})();
diff --git a/jstests/auth/restore_role_create_collection_via_apply_ops.js b/jstests/auth/restore_role_create_collection_via_apply_ops.js
deleted file mode 100644
index be30be7db47..00000000000
--- a/jstests/auth/restore_role_create_collection_via_apply_ops.js
+++ /dev/null
@@ -1,61 +0,0 @@
-// Verify that mongorestore can create a collection via applyOps
-
-(function() {
-'use strict';
-
-function makeCreateOp(collName, uuid = undefined) {
-    const op = {
-        op: 'c',
-        ns: 'test.$cmd',
-        o: {
-            create: collName,
-            idIndex: {
-                key: {_id: 1},
-                v: 2,
-                name: "_id_",
-                ns: "test." + collName,
-            },
-        },
-    };
-    if (uuid) {
-        op.ui = uuid;
-    }
-    return op;
-}
-
-function assertHasCollection(db, collName, expectUUID = undefined) {
-    const colls = db.getCollectionInfos({name: collName});
-    assert.eq(colls.length, 1, colls);
-    if (expectUUID !== undefined) {
-        assert.eq(colls[0].info.uuid, expectUUID, colls);
-    }
-}
-
-function runTest(conn) {
-    const admin = conn.getDB('admin');
-    const test = conn.getDB('test');
-    assert.commandWorked(admin.runCommand({createUser: 'admin', pwd: 'admin', roles: ['root']}));
-    assert(admin.auth('admin', 'admin'));
-
-    assert.commandWorked(
-        admin.runCommand({createUser: 'restore1', pwd: 'pwd', roles: ['restore']}));
-    admin.logout();
-
-    assert(admin.auth('restore1', 'pwd'));
-
-    // Simple create collection op.
-    assert.commandWorked(admin.runCommand({applyOps: [makeCreateOp('test1')]}));
-    assertHasCollection(test, 'test1');
-
-    // Create collection with UUID.
-    const kSpecificUUID = UUID();
-    assert.commandWorked(admin.runCommand({applyOps: [makeCreateOp('test2', kSpecificUUID)]}));
-    assertHasCollection(test, 'test2', kSpecificUUID);
-
-    admin.logout();
-}
-
-const standalone = MongoRunner.runMongod({auth: ''});
-runTest(standalone);
-MongoRunner.stopMongod(standalone);
-})();
\ No newline at end of file
diff --git a/jstests/auth/system_buckets_invalid_nss.js b/jstests/auth/system_buckets_invalid_nss.js
deleted file mode 100644
index dd182c48584..00000000000
--- a/jstests/auth/system_buckets_invalid_nss.js
+++ /dev/null
@@ -1,21 +0,0 @@
-// Validate that *.system.buckets.system.buckets.* is an invalid namespace
-
-(function() {
-"use strict";
-
-function runTest(conn) {
-    const admin = conn.getDB('admin');
-    assert.commandWorked(admin.runCommand({createUser: 'admin', pwd: 'admin', roles: ['root']}));
-
-    assert.commandFailedWithCode(admin.system.buckets.system.buckets.foo.insert({x: 1}),
-                                 [ErrorCodes.Unauthorized]);
-
-    assert(admin.auth('admin', 'admin'));
-    assert.commandFailedWithCode(admin.system.buckets.system.buckets.foo.insert({x: 1}),
-                                 [ErrorCodes.InvalidNamespace]);
-}
-
-const mongod = MongoRunner.runMongod({auth: ''});
-runTest(mongod);
-MongoRunner.stopMongod(mongod);
-}());