Local database authorization #3731
3 changed files+53−1
Modified.env.example+3−1View fileUnifiedSplit
@@ -1,5 +1,7 @@
11# Database Configuration
2MONGO_URL=mongodb+srv://username:password@cluster.mongodb.net/?retryWrites=true&w=majority
2# Include DB_NAME in URL to avoid config/local auth issues: .../hibiscus_airport?retryWrites=...
3# For Compass/mongosh "not authorized on config/local": grant read on config and local in Atlas → Database Access
4MONGO_URL=mongodb+srv://username:password@cluster.mongodb.net/hibiscus_airport?retryWrites=true&w=majority
35DB_NAME=hibiscus_airport
46
57# Stripe Payment
ModifiedADMIN_LOGIN_FIX_GUIDE.md+5−0View fileUnifiedSplit
@@ -133,6 +133,11 @@ Once logged in, the bookings page should:
133133
134134## Troubleshooting
135135
136### Issue: "not authorized on config" / "not authorized on local"
137- Grant `read` on `config` and `local` databases in Atlas → Database Access → Edit user
138- Or add built-in role `clusterMonitor`
139- See `docs/MONGO_CONFIG_LOCAL_AUTH.md` for details
140
136141### Issue: Login returns 401
137142- Check that `MONGO_URL` and `DB_NAME` are set in Render
138143- Verify the database is accessible from Render
Addeddocs/MONGO_CONFIG_LOCAL_AUTH.md+45−0View fileUnifiedSplit
@@ -0,0 +1,45 @@
1# MongoDB config/local Database Authorization
2
3## Error
4
5```
6list_collection_names failed for db config: not authorized on config to execute command { listCollections: 1, ... }
7list_collection_names failed for db local: not authorized on local to execute command { listCollections: 1, ... }
8```
9
10This occurs when MongoDB Compass, mongosh, or other tools try to list collections on the internal `config` and `local` databases. These databases store cluster metadata and require explicit read permissions.
11
12## Fix: Grant Roles in MongoDB Atlas
13
14### Option A: Add Custom Database Roles (Recommended)
15
161. Go to **MongoDB Atlas** → **Database Access** → select your database user → **Edit**.
172. Under **Database User Privileges**, click **Add Custom Role**.
183. Add two privileges:
19 - **Database:** `config` → **Role:** `read`
20 - **Database:** `local` → **Role:** `read`
214. Save changes.
22
23### Option B: Use clusterMonitor Role
24
251. Go to **MongoDB Atlas** → **Database Access** → select your database user → **Edit**.
262. Under **Built-in Role**, add **clusterMonitor** (includes read on `config` and `local`).
273. Save changes.
28
29### Option C: Connection String for App-Only Access
30
31If you only need the app to work (no Compass/CLI browsing of config/local), ensure your connection string specifies the default database so the app never touches config/local:
32
33```
34MONGO_URL=mongodb+srv://user:pass@cluster.mongodb.net/hibiscus_airport?retryWrites=true&w=majority
35```
36
37The app uses `DB_NAME` and only accesses your application database. The config/local errors typically come from **Compass** or **mongosh** when they enumerate all databases.
38
39## Summary
40
41| Tool | Needs config/local? | Fix |
42|-------------|---------------------|------------------------------------------|
43| App (PyMongo) | No | Uses `DB_NAME` only; no change needed |
44| Compass | Yes (lists all DBs) | Grant `read` on `config` and `local` |
45| mongosh | Yes (show dbs) | Grant `read` on `config` and `local` |
046
c comment · e edit title · m merge · a approve · r request changes · ? shortcuts