Config local db authorization #3730
4 changed files+81−2
Modified.env.example+2−1View fileUnifiedSplit
@@ -1,5 +1,6 @@
11# Database Configuration
2MONGO_URL=mongodb+srv://username:password@cluster.mongodb.net/?retryWrites=true&w=majority
2# Include DB_NAME in the URL to avoid config/local probing (see MONGODB_CONFIG_LOCAL_AUTHORIZATION.md)
3MONGO_URL=mongodb+srv://username:password@cluster.mongodb.net/hibiscus_airport?retryWrites=true&w=majority
34DB_NAME=hibiscus_airport
45
56# Stripe Payment
ModifiedADMIN_LOGIN_FIX_GUIDE.md+5−0View fileUnifiedSplit
@@ -154,6 +154,11 @@ Once logged in, the bookings page should:
154154- Check that `allow_origins` includes the frontend domain
155155- May need to update to specific domain instead of `*` for production
156156
157### Issue: "list_collection_names failed for db config/local"
158- These errors come from tools (Compass, IDE extensions) probing MongoDB system databases
159- Your application is unaffected; see `MONGODB_CONFIG_LOCAL_AUTHORIZATION.md` for details
160- Include the database in `MONGO_URL` (e.g. `.../hibiscus_airport?retryWrites=...`) to reduce probing
161
157162## Security Recommendations
158163
1591641. **Change default admin password** - Use the change password feature after first login
AddedMONGODB_CONFIG_LOCAL_AUTHORIZATION.md+63−0View fileUnifiedSplit
@@ -0,0 +1,63 @@
1# MongoDB config/local Database Authorization
2
3## The Error
4
5When connecting to MongoDB (especially MongoDB Atlas), you may see:
6
7```
8list_collection_names failed for db config: not authorized on config to execute command { listCollections: 1, ... }
9list_collection_names failed for db local: not authorized on local to execute command { listCollections: 1, ... }
10```
11
12## Cause
13
14The `config` and `local` databases are **MongoDB system databases**:
15
16- **config** – Used by MongoDB for sharding metadata (sharded clusters)
17- **local** – Used for replica set metadata and oplog
18
19On **MongoDB Atlas**, regular database users do **not** have access to these databases. They are restricted to cluster administration. When a tool (MongoDB Compass, Cursor MongoDB extension, IDE integrations, etc.) tries to discover all databases and list their collections, it attempts `listCollections` on `config` and `local`, which fails with `Unauthorized`.
20
21## Impact
22
23- **Application code**: Your app uses `client[DB_NAME]` or `client.get_default_database()` and only accesses your application database (e.g. `hibiscustoairport`). It does **not** call `list_collection_names` on `config` or `local`, so these errors do **not** affect normal operation.
24- **GUI tools**: MongoDB Compass and similar tools may show these errors when discovering databases. Your application database and its collections remain accessible; the errors are for system databases you typically do not need.
25
26## Solutions
27
28### 1. Ignore the Errors (Recommended)
29
30If you are only using your application database, these errors are harmless. Your app and data are unaffected. You can safely ignore them when they appear in tool output or logs.
31
32### 2. Include Database in Connection String
33
34Use a connection string that specifies the database, so tools know which database to use by default and may avoid probing system databases:
35
36```
37mongodb+srv://user:pass@cluster.mongodb.net/your_db_name?retryWrites=true&w=majority
38```
39
40Replace `your_db_name` with your actual database (e.g. `hibiscustoairport`).
41
42### 3. Atlas User Permissions (If You Must Access config/local)
43
44If you truly need access to `config` or `local` (e.g. for cluster monitoring):
45
461. In Atlas: **Database Access** → **Edit** your user
472. Add roles such as `clusterMonitor` or `readAnyDatabase` (use only if required)
483. Note: Atlas may still restrict access to these system databases for security reasons
49
50### 4. Tool-Specific Configuration
51
52- **MongoDB Compass**: Connect using a connection string that includes the database name. Compass may still try to list all databases; the errors are informational.
53- **Cursor / VS Code MongoDB extension**: Use a connection string with the database specified. Some extensions allow configuring which databases to show; check their settings to limit discovery to your application database.
54
55## Summary
56
57| Source | Affected? | Action |
58|---------------------|-----------|---------------------------------|
59| Application runtime| No | None |
60| MongoDB Compass | Yes (UI) | Ignore or use DB in connection |
61| Cursor/IDE MongoDB | Yes (UI) | Ignore or use DB in connection |
62
63Your application database remains fully accessible; the authorization errors apply only to system databases (`config`, `local`) that your app does not use.
Modifiedbackend/database.py+11−1View fileUnifiedSplit
@@ -1,9 +1,19 @@
1"""
2MongoDB connection for synchronous (pymongo) usage.
3
4Note: If you see "list_collection_names failed for db config/local" errors,
5these come from tools (Compass, IDE extensions) probing system databases.
6The application only uses DB_NAME and is unaffected. See
7MONGODB_CONFIG_LOCAL_AUTHORIZATION.md for details.
8"""
19import os
210from pymongo import MongoClient
311
412MONGO_URL = os.getenv("MONGO_URL")
13DB_NAME = os.getenv("DB_NAME", "hibiscustoairport")
514if not MONGO_URL:
615 raise RuntimeError("MONGO_URL env var not set")
716
817client = MongoClient(MONGO_URL)
9db = client.get_default_database()
18# Use explicit DB_NAME to avoid any config/local probing; app never needs system dbs
19db = client[DB_NAME]
1020
c comment · e edit title · m merge · a approve · r request changes · ? shortcuts