I used robo 3t to login to a database and was surprised that I was able to write on the collection despite having a read only role, by adding a document via the GUI or sending commands through Robo 3T.
What could be the problem? On mongosh (mongo shell) I wasnt able to.
tonidoclouddb> db.getRole("test", {showPrivileges:true})
{
role: 'test',
db: 'tonidoclouddb',
isBuiltin: false,
roles: [],
inheritedRoles: [],
privileges: [
{
resource: {
db: 'tonidoclouddb',
collection: 'users'
},
actions: [ 'find' ]
}
],
inheritedPrivileges: [
{
resource: {
db: 'tonidoclouddb',
collection: 'users'
},
actions: [ 'find' ]
}
]
}
{
_id: 'tonidoclouddb.mynewuser',
userId: UUID("46bdf5e7-fb0a-4616-a1ee-5fc46fd0f97f"),
user: 'mynewuser',
db: 'tonidoclouddb',
roles: [ { role: 'test', db: 'tonidoclouddb' } ],
mechanisms: [ 'SCRAM-SHA-1', 'SCRAM-SHA-256' ]
} ```
db.getRole()
tonidoclouddb> db.getRole("test", {showPrivileges:true}) { role: 'test', db: 'tonidoclouddb', isBuiltin: false, roles: [], inheritedRoles: [], privileges: [ { resource: { db: 'tonidoclouddb', collection: 'users' }, actions: [ 'find' ] } ], inheritedPrivileges: [ { resource: { db: 'tonidoclouddb', collection: 'users' }, actions: [ 'find' ] } ] }