{"record":{"id":"9d214654acbfb9c7","repo":"1Panel-dev/1Panel","slug":"failed-to-load-mongodb-user-privileges","errorCode":null,"errorMessage":"failed to load mongodb user privileges","messagePattern":"failed to load mongodb user privileges","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"agent/app/service/database_mongodb.go","lineNumber":745,"sourceCode":"func loadLocalMongodbPrivilege(connectionName, dbName, username string) (string, error) {\n\tdatabaseJSON, err := json.Marshal(dbName)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tusernameJSON, err := json.Marshal(username)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tscript := strings.TrimSpace(fmt.Sprintf(`\nconst dbName = %s;\nconst userName = %s;\nconst result = db.getSiblingDB(dbName).runCommand({\n  usersInfo: userName,\n  showCredentials: false,\n  showCustomData: false\n});\nif (!result || result.ok !== 1) {\n  throw new Error(\"failed to load mongodb user privileges\");\n}\nconst roles = Array.isArray(result.users) && result.users.length > 0 ? result.users[0].roles || [] : [];\nconst permissions = roles.filter(role => role.db === dbName).map(role => role.role);\nprint(\"__1panel_json_begin__\");\nprint(JSON.stringify(permissions));\nprint(\"__1panel_json_end__\");\n`, databaseJSON, usernameJSON))\n\tstdout, err := runMongodbAdminScriptWithStdout(connectionName, script)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tvar permissions []string\n\tjsonResult, err := extractMongodbJSONOutput(stdout)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tif err := json.Unmarshal(jsonResult, &permissions); err != nil {\n\t\treturn \"\", err","sourceCodeStart":727,"sourceCodeEnd":763,"githubUrl":"https://github.com/1Panel-dev/1Panel/blob/5ac7c808815b0691009cd390414f03471312262f/agent/app/service/database_mongodb.go#L727-L763","documentation":"loadMongodbPrivilege's script (database_mongodb.go:745) queries usersInfo for a user on a remote/local connection and requires ok === 1. Identical failure class to error 2, but reached through the privilege-view path: the connection's user cannot run usersInfo on that db, or the remote connection info itself is unusable.","triggerScenarios":"Loading a user's permission list in the 1Panel UI when the connection credential lacks viewUser; remote connection (loadRemoteMongodbConnection) configured with a limited user; dbName on the record differs from the db that owns the user so the command is rejected.","commonSituations":"Remote MongoDB with a least-privilege monitoring user; credential drift after rotation; user created on `admin` while the record points at a workload db.","solutions":["Run usersInfo manually with the same credential and read codeName/errmsg","Upgrade the connection user's roles (userAdmin/viewUser on the db) or re-point the connection to root","Verify the user's home db via usersInfo on admin and align the record's dbName"],"exampleFix":"null","handlingStrategy":"validation","validationCode":"// before loading privileges, confirm the connection can run usersInfo\n// one-line probe through the same connection, expect ok:1","typeGuard":null,"tryCatchPattern":"perms, err := loadMongodbPrivilege(...)\nif err != nil && strings.Contains(err.Error(), \"failed to load mongodb user privileges\") {\n    // fall back to showing the user's record without live permissions; prompt credential fix\n}","preventionTips":["Use a credential with viewUser on both admin and workload dbs for remote connections","Re-validate remote connection info after any IdP/proxy change"],"tags":["mongodb","usersinfo","authorization","remote-connection"],"backgroundTag":null,"analyzedSha":"5ac7c808815b0691009cd390414f03471312262f","analyzedAt":"2026-08-15T14:02:06.953Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}