SERVER-41657 Create new ActionType called refineCollectionShardKey

3 files changed, 6 insertions, 4 deletions

diff --git a/src/mongo/db/auth/action_types.txt b/src/mongo/db/auth/action_types.txt
index a353f154847..431d18373e6 100644
--- a/src/mongo/db/auth/action_types.txt
+++ b/src/mongo/db/auth/action_types.txt
@@ -85,6 +85,7 @@
 "planCacheIndexFilter", # view/update index filters
 "planCacheRead", # view contents of plan cache
 "planCacheWrite", # clear cache, drop cache entry, pin/unpin/shun plans
+"refineCollectionShardKey",
 "reIndex",
 "remove",
 "removeShard",
diff --git a/src/mongo/db/auth/role_graph_builtin_roles.cpp b/src/mongo/db/auth/role_graph_builtin_roles.cpp
index daecf3176fc..0646c8219d0 100644
--- a/src/mongo/db/auth/role_graph_builtin_roles.cpp
+++ b/src/mongo/db/auth/role_graph_builtin_roles.cpp
@@ -251,7 +251,8 @@ MONGO_INITIALIZER(AuthorizationBuiltinRoles)(InitializerContext* context) {
         << ActionType::splitChunk
         << ActionType::moveChunk
         << ActionType::enableSharding
-        << ActionType::splitVector;
+        << ActionType::splitVector
+        << ActionType::refineCollectionShardKey;
 
     return Status::OK();
 }
diff --git a/src/mongo/s/commands/cluster_refine_collection_shard_key_cmd.cpp b/src/mongo/s/commands/cluster_refine_collection_shard_key_cmd.cpp
index aec7565ee9f..fa96a95b10f 100644
--- a/src/mongo/s/commands/cluster_refine_collection_shard_key_cmd.cpp
+++ b/src/mongo/s/commands/cluster_refine_collection_shard_key_cmd.cpp
@@ -49,7 +49,7 @@ public:
         using InvocationBase::InvocationBase;
 
         void typedRun(OperationContext* opCtx) {
-            const NamespaceString nss = request().getCommandParameter();
+            const NamespaceString nss = ns();
 
             ConfigsvrRefineCollectionShardKey configsvrRefineCollShardKey(nss, request().getKey());
             configsvrRefineCollShardKey.setDbName(request().getDbName());
@@ -80,8 +80,8 @@ public:
             uassert(ErrorCodes::Unauthorized,
                     "Unauthorized",
                     AuthorizationSession::get(opCtx->getClient())
-                        ->isAuthorizedForActionsOnResource(ResourcePattern::forClusterResource(),
-                                                           ActionType::enableSharding));
+                        ->isAuthorizedForActionsOnResource(ResourcePattern::forExactNamespace(ns()),
+                                                           ActionType::refineCollectionShardKey));
         }
     };