如何使用LoopBack4在MongoDB数据库（含动态创建库）中创建用户并分配角色

Hey there! Let's tackle these two MongoDB user management tasks with LoopBack 4 clearly, step by step. Both require working directly with MongoDB's native driver since LoopBack's core tools focus on business data models, not database-level user administration.

First, you'll need a LoopBack 4 project with a MongoDB data source already configured. The key here is to use MongoDB's native createUser command, which we can access through LoopBack's data source client.

Step-by-Step Implementation: #

• Inject the MongoDB Data Source: Create a service to handle user creation, and inject your configured MongoDB data source into it.
• Access the Admin Database: MongoDB user management typically happens in the admin database (this is where super users are stored, and you can assign roles to other databases from here).
• Execute the createUser Command: Pass in the username, password, and desired roles for the user.

Example Service Code:

// src/services/mongo-user.service.ts
import {inject} from '@loopback/core';
import {MongoDataSource} from '../datasources';

export class MongoUserService {
  constructor(
    @inject('datasources.mongo') protected dataSource: MongoDataSource,
  ) {}

  async createMongoDbUser(
    username: string,
    password: string,
    roles: Array<{role: string; db: string}>
  ) {
    // Get the native MongoDB client from LoopBack's data source
    const client = await this.dataSource.connect();
    const adminDb = client.db('admin');

    try {
      // Execute MongoDB's createUser command
      await adminDb.command({
        createUser: username,
        pwd: password,
        roles: roles,
      });
      return {success: true, message: `User ${username} created successfully`};
    } catch (err) {
      return {success: false, error: err.message};
    }
  }
}

Usage in a Controller:

You can inject this service into a controller to expose an API endpoint for user creation:

// src/controllers/mongo-user.controller.ts
import {post, requestBody} from '@loopback/rest';
import {inject} from '@loopback/core';
import {MongoUserService} from '../services/mongo-user.service';

export class MongoUserController {
  constructor(
    @inject('services.MongoUserService') protected mongoUserService: MongoUserService,
  ) {}

  @post('/mongo-users')
  async createUser(
    @requestBody() userData: {username: string; password: string; roles: Array<{role: string; db: string}>}
  ) {
    return this.mongoUserService.createMongoDbUser(
      userData.username,
      userData.password,
      userData.roles
    );
  }
}

For this task, we'll first "create" the database (MongoDB auto-creates databases when you first write data to them), then create a user with userAdmin permissions specifically for that new database.

Step-by-Step Implementation: #

• Connect to the Target Database: Even if it doesn't exist yet, connecting to it and performing a small operation (like creating a temporary collection) ensures the database is initialized.
• Create the User with Targeted Roles: Use the admin database to create the user, specifying the userAdmin role for the newly created database (you can add other roles like readWrite too).

Example Extension to the Service:

Add this method to the MongoUserService we created earlier:

async createDbAndAssignUser(
  dbName: string,
  username: string,
  password: string
) {
  const client = await this.dataSource.connect();

  // Initialize the database (MongoDB auto-creates it when we interact with it)
  const targetDb = client.db(dbName);
  // Create a temporary collection to trigger database creation (optional but recommended)
  await targetDb.createCollection('_temp_init');

  // Create the user in admin db with userAdmin role for the new database
  const adminDb = client.db('admin');
  try {
    await adminDb.command({
      createUser: username,
      pwd: password,
      roles: [
        {role: 'userAdmin', db: dbName},
        {role: 'readWrite', db: dbName}, // Optional: Add write access
      ],
    });

    // Clean up the temporary collection
    await targetDb.collection('_temp_init').drop();
    return {
      success: true,
      message: `Database ${dbName} created, user ${username} assigned userAdmin role`,
    };
  } catch (err) {
    return {success: false, error: err.message};
  }
}

Important Notes #

• Permission Requirements: The user your LoopBack application uses to connect to MongoDB must have elevated privileges (like userAdminAnyDatabase or root) to create other users and databases.
• Password Security: Never hardcode passwords in your code. Use environment variables (LoopBack supports .env files via @loopback/core) to store sensitive credentials securely.
• Role Clarification: The userAdmin role only grants control over user management for the target database. If you need the user to access or modify data, add the readWrite role to their permissions.

内容的提问来源于stack exchange，提问作者Akhi Balakrishnan