diff options
Diffstat (limited to 'src/mongo/db/auth')
| -rw-r--r-- | src/mongo/db/auth/SConscript | 2 | ||||
| -rw-r--r-- | src/mongo/db/auth/action_type.idl | 2 | ||||
| -rw-r--r-- | src/mongo/db/auth/authorization_manager_impl.cpp | 9 | ||||
| -rw-r--r-- | src/mongo/db/auth/authorization_session_test_fixture.cpp | 10 | ||||
| -rw-r--r-- | src/mongo/db/auth/builtin_roles.cpp | 4 |
5 files changed, 17 insertions, 10 deletions
diff --git a/src/mongo/db/auth/SConscript b/src/mongo/db/auth/SConscript index 88981e3f85a..b8639a62846 100644 --- a/src/mongo/db/auth/SConscript +++ b/src/mongo/db/auth/SConscript @@ -189,9 +189,9 @@ env.Library( '$BUILD_DIR/mongo/base/secure_allocator', '$BUILD_DIR/mongo/bson/util/bson_extract', '$BUILD_DIR/mongo/db/common', - '$BUILD_DIR/mongo/db/curop', '$BUILD_DIR/mongo/db/global_settings', '$BUILD_DIR/mongo/db/namespace_string', + '$BUILD_DIR/mongo/db/query/query_stats/query_stats', '$BUILD_DIR/mongo/idl/feature_flag', '$BUILD_DIR/mongo/util/concurrency/thread_pool', '$BUILD_DIR/mongo/util/icu', diff --git a/src/mongo/db/auth/action_type.idl b/src/mongo/db/auth/action_type.idl index 005ccbf5808..2c09bfca837 100644 --- a/src/mongo/db/auth/action_type.idl +++ b/src/mongo/db/auth/action_type.idl @@ -140,6 +140,8 @@ enums: planCacheIndexFilter : "planCacheIndexFilter" # view/update index filters planCacheRead : "planCacheRead" # view contents of plan cache planCacheWrite : "planCacheWrite" # clear cache, drop cache entry, pin/unpin/shun plans + queryStatsRead: "queryStatsRead" # view untransformed contents of queryStats store + queryStatsReadTransformed: "queryStatsReadTransformed" # view transformed contents of queryStats store refineCollectionShardKey : "refineCollectionShardKey" reIndex : "reIndex" remove : "remove" diff --git a/src/mongo/db/auth/authorization_manager_impl.cpp b/src/mongo/db/auth/authorization_manager_impl.cpp index 93450c8b1f5..f350dcdc140 100644 --- a/src/mongo/db/auth/authorization_manager_impl.cpp +++ b/src/mongo/db/auth/authorization_manager_impl.cpp @@ -389,6 +389,7 @@ AuthorizationManagerImpl::AuthorizationManagerImpl( AuthorizationManagerImpl::~AuthorizationManagerImpl() = default; std::unique_ptr<AuthorizationSession> AuthorizationManagerImpl::makeAuthorizationSession() { + invariant(_externalState != nullptr); return std::make_unique<AuthorizationSessionImpl>( _externalState->makeAuthzSessionExternalState(this), AuthorizationSessionImpl::InstallMockForTestingOrAuthImpl{}); @@ -675,35 +676,35 @@ void AuthorizationManagerImpl::_pinnedUsersThreadRoutine() noexcept try { void AuthorizationManagerImpl::invalidateUserByName(OperationContext* opCtx, const UserName& userName) { LOGV2_DEBUG(20235, 2, "Invalidating user", "user"_attr = userName); - _updateCacheGeneration(); _authSchemaVersionCache.invalidateAll(); // Invalidate the named User, assuming no externally provided roles. When roles are defined // externally, there exists no user document which may become invalid. _userCache.invalidateKey(UserRequest(userName, boost::none)); + _updateCacheGeneration(); } void AuthorizationManagerImpl::invalidateUsersFromDB(OperationContext* opCtx, StringData dbname) { LOGV2_DEBUG(20236, 2, "Invalidating all users from database", "database"_attr = dbname); - _updateCacheGeneration(); _authSchemaVersionCache.invalidateAll(); _userCache.invalidateKeyIf( [&](const UserRequest& userRequest) { return userRequest.name.getDB() == dbname; }); + _updateCacheGeneration(); } void AuthorizationManagerImpl::invalidateUsersByTenant(OperationContext* opCtx, const TenantId& tenant) { LOGV2_DEBUG(6323600, 2, "Invalidating tenant users", "tenant"_attr = tenant); - _updateCacheGeneration(); _authSchemaVersionCache.invalidateAll(); _userCache.invalidateKeyIf( [&](const UserRequest& userRequest) { return userRequest.name.getTenant() == tenant; }); + _updateCacheGeneration(); } void AuthorizationManagerImpl::invalidateUserCache(OperationContext* opCtx) { LOGV2_DEBUG(20237, 2, "Invalidating user cache"); - _updateCacheGeneration(); _authSchemaVersionCache.invalidateAll(); _userCache.invalidateAll(); + _updateCacheGeneration(); } Status AuthorizationManagerImpl::refreshExternalUsers(OperationContext* opCtx) { diff --git a/src/mongo/db/auth/authorization_session_test_fixture.cpp b/src/mongo/db/auth/authorization_session_test_fixture.cpp index 330837ee719..db2500a6a2c 100644 --- a/src/mongo/db/auth/authorization_session_test_fixture.cpp +++ b/src/mongo/db/auth/authorization_session_test_fixture.cpp @@ -44,16 +44,18 @@ namespace mongo { void AuthorizationSessionTestFixture::setUp() { + // AuthorizationManager must be initialized prior to creating Client objects. + auto localManagerState = std::make_unique<FailureCapableAuthzManagerExternalStateMock>(); + managerState = localManagerState.get(); + auto uniqueAuthzManager = std::make_unique<AuthorizationManagerImpl>( + getServiceContext(), std::move(localManagerState)); + _session = transportLayer.createSession(); _client = getServiceContext()->makeClient("testClient", _session); RestrictionEnvironment::set(_session, std::make_unique<RestrictionEnvironment>(SockAddr(), SockAddr())); _opCtx = _client->makeOperationContext(); - auto localManagerState = std::make_unique<FailureCapableAuthzManagerExternalStateMock>(); - managerState = localManagerState.get(); managerState->setAuthzVersion(AuthorizationManager::schemaVersion26Final); - auto uniqueAuthzManager = std::make_unique<AuthorizationManagerImpl>( - getServiceContext(), std::move(localManagerState)); authzManager = uniqueAuthzManager.get(); AuthorizationManager::set(getServiceContext(), std::move(uniqueAuthzManager)); auto localSessionState = std::make_unique<AuthzSessionExternalStateMock>(authzManager); diff --git a/src/mongo/db/auth/builtin_roles.cpp b/src/mongo/db/auth/builtin_roles.cpp index 90b097800d0..9eddd117f80 100644 --- a/src/mongo/db/auth/builtin_roles.cpp +++ b/src/mongo/db/auth/builtin_roles.cpp @@ -205,7 +205,9 @@ MONGO_INITIALIZER(AuthorizationBuiltinRoles)(InitializerContext* context) { << ActionType::inprog << ActionType::shardingState << ActionType::allCollectionStats - << ActionType::shardedDataDistribution; + << ActionType::shardedDataDistribution + << ActionType::queryStatsRead + << ActionType::queryStatsReadTransformed; // clusterMonitor role actions that target a database (or collection) resource clusterMonitorRoleDatabaseActions |