prisma: Error in Connector on MongoDB executing listIndex: "system.views"

Next step is for someone from our side to confirm this, and if we can (which I expect) to implement the changes necessary to not look at the views (or whatever it needs to avoid this).

Yeah it’s an Atlas restriction beginning with 5.0.

I’m assuming it’s not intentional that it’s requiring a lookup to the system.views. Even creating a special “prism” user that only has access to the collections I want it to access, does not solve it.

Hopefully someone can respond re: when might be fixed. For now, I removed all views. Needless to say, that is not desirable in the medium term.

On Tue, Jan 10, 2023 at 10:05 AM Yannick Schuchmann < @.***> wrote:

@gfay63 https://github.com/gfay63 hmm I see. I’m on 5.08 but I created the role as root user, maybe that’s allowed still. But also I’m running a self-hosted replicaset instead of Atlas service.

I’m curious what’s the reason for the query to system.views by prisma tho. Can somebody elaborate on this maybe?

— Reply to this email directly, view it on GitHub https://github.com/prisma/prisma/issues/17006#issuecomment-1377495144, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABC4PO57L3ZT3U4WD6TWMM3WRWCC3ANCNFSM6AAAAAATIJ4DGE . You are receiving this because you were mentioned.Message ID: @.***>

Seems to work for me! Thanks a lot for the fix =)

I can confirm this exact same issue. Essentially, if you have any views in your database, it makes introspection impossible. I even tried the suggestion recommended by @Jolg42, but MongoDB Atlas version 5.0 and above does not allow configuring a Custom Role with access to system.views.

Thanks for trying it out 🙌🏼 and Thanks to @christianledgard for the PR 💚

I use 5.3.0-dev.9 and it seems works fine for now. Thankyou.

Note: this is now fixed in 5.3.0-dev.9 if you want to try it out. Let us know if it works like expected. It will be released in the official 5.3.0 version on Tuesday, September, 12th.

@Jolg42, will a trivial continue work? Related to #18424.

Hi everyone, any news on this ? I’ve seen the views are in the pipe, and it seems to be already available for postgres with a preview flag, so I’m right by guessing it should come any time soon ?

This bug and the #18424 are still pretty bloquing to work with mongo and introspection.

If you’re using Atlas, you can give your db user the atlasAdmin@admin role, which is a default available role. This will give the user the correct rights to run the command.

Of course, this is a security issue and should not be considered a valid workaround.

I hope a actual fix for this issue (and all other view related issues) will be available soon.

@Jolg42 @yannickschuchmann

use admin
db.runCommand({ createRole: "readViewCollection",
  privileges: [
    { resource: { db: "", collection: "system.views" }, actions: [ "find", "listIndexes"] }],
    roles : []
})
db.grantRolesToUser('<your_user>', ['readViewCollection']);

The admin user can no longer access this collection as it is internal. This is documented here. This is the error you get for MongoDB 5.0 or higher:

MongoServerError: not authorized on admin to execute command { createRole: "readViewCollection", privileges: [ { resource: { db: "", collection: "system.views" }, actions: [ "find", "listIndexes" ] } ], roles: [], lsid: { id: UUID("7e2582f9-72ce-4ec1-8516-b995848d6011") }, $clusterTime: { clusterTime: Timestamp(1673288282, 1), signature: { hash: BinData(0, FFF638BF83E62A8FBF0B05BE2567B1D0825538D2), keyId: 7154416750556086274 } }, $db: "admin" }

Therefore, I currently see no workaround for version 5.0+ unless I am missing something.

Thx @Jolg42.

I had to add the listIndexes action as well to the snippet from stackexchange. So what works for me in the meantime is:

use admin
db.runCommand({ createRole: "readViewCollection",
  privileges: [
    { resource: { db: "", collection: "system.views" }, actions: [ "find", "listIndexes"] }],
    roles : []
})
db.grantRolesToUser('<your_user>', ['readViewCollection']);

You could try creating a role / adding privileges, so your user can read “system.views” like in https://dba.stackexchange.com/a/248945