{"record":{"id":"df6776778553a925","repo":"1Panel-dev/1Panel","slug":"failed-to-drop-users-from-dbname","errorCode":null,"errorMessage":"failed to drop users from ${dbName}","messagePattern":"failed to drop users from (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"agent/app/service/database_mongodb.go","lineNumber":439,"sourceCode":"targetDb.createUser({\n  user: userName,\n  pwd: password,\n  roles: [{ role: permission, db: dbName }]\n});\n`, dbNameJSON, usernameJSON, passwordJSON, permissionJSON)), nil\n}\n\nfunc buildMongodbDeleteScript(dbName string) (string, error) {\n\tdbNameJSON, err := json.Marshal(dbName)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\treturn strings.TrimSpace(fmt.Sprintf(`\nconst dbName = %s;\nconst targetDb = db.getSiblingDB(dbName);\nconst dropUsersResult = targetDb.runCommand({ dropAllUsersFromDatabase: 1 });\nif (!dropUsersResult || dropUsersResult.ok !== 1) {\n  throw new Error(\"failed to drop users from \" + dbName);\n}\nconst dropDatabaseResult = targetDb.runCommand({ dropDatabase: 1 });\nif (!dropDatabaseResult || dropDatabaseResult.ok !== 1) {\n  throw new Error(\"failed to drop database \" + dbName);\n}\n`, dbNameJSON)), nil\n}\n\nfunc buildMongodbBindUserScript(dbName, username, password string) (string, error) {\n\tdbNameJSON, err := json.Marshal(dbName)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tusernameJSON, err := json.Marshal(username)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tpasswordJSON, err := json.Marshal(password)","sourceCodeStart":421,"sourceCodeEnd":457,"githubUrl":"https://github.com/1Panel-dev/1Panel/blob/5ac7c808815b0691009cd390414f03471312262f/agent/app/service/database_mongodb.go#L421-L457","documentation":"Thrown by a generated mongosh script (buildMongodbDeleteScript) executed via `docker exec <container> mongosh <admin-uri> --eval <script>` when `targetDb.runCommand({ dropAllUsersFromDatabase: 1 })` returns a result whose `ok` field is not 1. It is not a Go error: the agent builds the JS with the JSON-marshaled dbName and surfaces whatever the script throws. `ok !== 1` almost always means the connected user lacks the `dropUser`/`userAdmin` privilege on that database or the authenticationDatabase does not match where the users live.","triggerScenarios":"Calling the 1Panel database-delete flow for a MongoDB install where: (a) the app install's stored username/password is not root/admin (e.g. a limited user was set after install), (b) users were created on the `admin` db while the script runs against the target db (or vice versa), or (c) the mongosh URI built by buildMongodbRestoreURI authenticates against a db where dropAllUsersFromDatabase is forbidden.","commonSituations":"MongoDB container whose root password was rotated outside 1Panel so the stored credential authenticates as a non-privileged user; installs that use a custom user instead of root; MongoDB 5+ where users commonly live in `admin` and dropping them from the target db yields a permission error.","solutions":["Verify the stored credential is privileged: `docker exec <container> mongosh -u <user> -p <pass> --authenticationDatabase admin --eval 'db.runCommand({connectionStatus:1}).authInfo.authenticatedUserRoles'` and confirm a root/userAdminAnyDatabase role","If the credential is stale, update the app install's username/password in 1Panel to the real root account and retry the delete","Run the drop manually to see the raw server error: `db.getSiblingDB(\"<dbName>\").runCommand({dropAllUsersFromDatabase:1})` inside the container and read `codeName`/`errmsg`","If users live on `admin`, drop them with an explicit user deletion on admin before re-running the delete"],"exampleFix":"// before: rely on stored (possibly non-root) credential\nrunMongodbAdminScript(database, script)\n\n// after (operational fix): confirm privilege before delete flow\n// docker exec <c> mongosh -u root -p <pass> --authenticationDatabase admin --eval \\\n//   'db.getSiblingDB(\"mydb\").runCommand({dropAllUsersFromDatabase:1})'","handlingStrategy":"try-catch","validationCode":"// before invoking the delete flow, verify privilege on the db\n// docker-side: db.getSiblingDB(dbName).runCommand({dropAllUsersFromDatabase:1})\n// code-side: check roles first\nroles, _ := runMongodbAdminScriptWithStdout(database, \"printjson(db.runCommand({connectionStatus:1}).authInfo.authenticatedUserRoles)\")","typeGuard":null,"tryCatchPattern":"// wrap the service call; on failure surface container logs for the raw codeName\nif err := service.DeleteMongodbDatabase(...); err != nil {\n    if strings.Contains(err.Error(), \"failed to drop users\") {\n        // pull `docker logs <container>` tail and show codeName/errmsg to the user\n    }\n    return err\n}","preventionTips":["Keep the 1Panel app-install credential as the MongoDB root user","Rotate credentials through 1Panel, never directly in mongosh","Test delete on a scratch database right after install to validate the privilege path early"],"tags":["mongodb","mongosh","docker-exec","authorization"],"backgroundTag":null,"analyzedSha":"5ac7c808815b0691009cd390414f03471312262f","analyzedAt":"2026-08-15T14:02:06.953Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}