SERVER-67656 Implement authorization checks for the analyze command

1 files changed, 7 insertions, 1 deletions

diff --git a/src/mongo/s/commands/cluster_analyze_cmd.cpp b/src/mongo/s/commands/cluster_analyze_cmd.cpp
index 6d529282762..04dae01aadf 100644
--- a/src/mongo/s/commands/cluster_analyze_cmd.cpp
+++ b/src/mongo/s/commands/cluster_analyze_cmd.cpp
@@ -28,6 +28,7 @@
  */
 
 #include "mongo/bson/bsonobj.h"
+#include "mongo/db/auth/authorization_session.h"
 #include "mongo/db/commands.h"
 #include "mongo/db/query/analyze_command_gen.h"
 #include "mongo/db/query/query_feature_flags_gen.h"
@@ -104,7 +105,12 @@ public:
 
     private:
         void doCheckAuthorization(OperationContext* opCtx) const override {
-            // TODO SERVER-67656
+            auto* authzSession = AuthorizationSession::get(opCtx->getClient());
+            const NamespaceString& ns = request().getNamespace();
+
+            uassert(ErrorCodes::Unauthorized,
+                    str::stream() << "Not authorized to call analyze on collection " << ns,
+                    authzSession->isAuthorizedForActionsOnNamespace(ns, ActionType::analyze));
         }
     };
 } clusterAnalyzeCmd;