{"record":{"id":"c608f5bd7c017db0","repo":"t8y2/dbx","slug":"mongodb-createuser-user-document-contains-reserved","errorCode":null,"errorMessage":"MongoDB createUser user document contains reserved command fields","messagePattern":"MongoDB createUser user document contains reserved command fields","errorType":"validation","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"agents/drivers/mongodb/src/main/java/com/dbx/agent/mongodb/MongoAgent.java","lineNumber":1048,"sourceCode":"        );\n        return Collections.singletonMap(\"name\", name);\n    }\n\n    private static Object createUser(JsonObject params) {\n        MongoClient client = requireClient();\n        String database = params.get(\"database\").getAsString();\n        client.getDatabase(database).runCommand(buildCreateUserCommand(params));\n        return Collections.singletonMap(\"affected_rows\", 1);\n    }\n\n    static Document buildCreateUserCommand(JsonObject params) {\n        Document user = requiredDocument(params, \"user_json\", \"User document\");\n        Object username = user.remove(\"user\");\n        if (!(username instanceof String) || ((String) username).isBlank()) {\n            throw new IllegalArgumentException(\"MongoDB createUser requires a non-empty user name\");\n        }\n        if (user.containsKey(\"createUser\") || user.containsKey(\"writeConcern\")) {\n            throw new IllegalArgumentException(\"MongoDB createUser user document contains reserved command fields\");\n        }\n\n        Document command = new Document(\"createUser\", username);\n        command.putAll(user);\n        Document writeConcern = documentOrNull(params, \"write_concern_json\");\n        if (writeConcern != null) {\n            command.put(\"writeConcern\", writeConcern);\n        }\n        return command;\n    }\n\n    private static Document requiredDocument(JsonObject params, String key, String label) {\n        Document document = documentOrNull(params, key);\n        if (document == null) {\n            throw new IllegalArgumentException(label + \" are required\");\n        }\n        return document;\n    }","sourceCodeStart":1030,"sourceCodeEnd":1066,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/mongodb/src/main/java/com/dbx/agent/mongodb/MongoAgent.java#L1030-L1066","documentation":"The agent assembles the createUser command itself, so the user_json document must not contain the command fields \"createUser\" or \"writeConcern\" — including them would either duplicate the command name or conflict with the write concern the agent attaches. buildCreateUserCommand rejects such documents with IllegalArgumentException.","triggerScenarios":"Passing a full server-style command document as user_json, e.g. {\"createUser\": \"bob\", \"pwd\": \"...\", \"roles\": [...]}, or including a \"writeConcern\" key inside user_json.","commonSituations":"Copying a mongosh/db.createUser command document verbatim into user_json; migrating scripts that previously sent raw runCommand payloads; supplying writeConcern in the wrong place (it belongs in the top-level write_concern_json parameter).","solutions":["Remove the \"createUser\" field from user_json — the agent adds it from the \"user\" value.","Remove \"writeConcern\" from user_json and pass it via the write_concern_json parameter instead.","Keep user_json to user attributes only: pwd, roles, customData, mechanisms, etc."],"exampleFix":"// before\n{\"user_json\": {\"createUser\": \"bob\", \"pwd\": \"x\", \"writeConcern\": {\"w\": 1}}}\n// after\n{\"user_json\": {\"user\": \"bob\", \"pwd\": \"x\"}, \"write_concern_json\": {\"w\": 1}}","handlingStrategy":"validation","validationCode":"const reserved = [\"createUser\", \"writeConcern\"];\nfor (const k of reserved) {\n  if (params.user_json && k in params.user_json) {\n    throw new Error(\"Remove reserved field '\" + k + \"' from user_json\");\n  }\n}","typeGuard":"function hasNoReservedFields(userJson) {\n  return userJson == null || (!(\"createUser\" in userJson) && !(\"writeConcern\" in userJson));\n}","tryCatchPattern":"try {\n  await agent.createUser({ database, user_json: doc });\n} catch (e) {\n  if (String(e.message).includes(\"reserved command fields\")) {\n    const { createUser, writeConcern, ...clean } = doc;\n    await agent.createUser({ database, user_json: clean, write_concern_json: writeConcern });\n  } else throw e;\n}","preventionTips":["Treat user_json as user attributes only (pwd, roles, customData) — never a raw command document.","Move writeConcern to the write_concern_json parameter.","Strip command-shaped keys when migrating old runCommand-based scripts."],"tags":["mongodb","createuser","validation","reserved-fields"],"backgroundTag":"invalid-parameter-conflict","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}