Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Mongo tools silently accept a wrong database name and misreport `{collection, find}` commands as "undefined" or as permission denials

未关闭
  • 哪里不对？
#1,487 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
45/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
mongodb, sql, typescript
领域
databases

调研方向

Start with normalizeMqlCommand in packages/drivers/src/mongodb.ts (around lines 79-102), which only rewrites string-valued native keys, and the resolveDb lookup near lines 241 and 413. Then read MONGO_READ_COMMANDS and the write fallback in packages/opencode/src/altimate/tools/sql-classify.ts, plus the error path in sql-materialize.ts around lines 180-185. Done when the acceptance checks in the issue pass: the collection/find shape matches the canonical form, a wrong database name lists valid databases, and listCollections is classified as a read.

由索引模型根据 Issue 内容生成。

描述

Problem

  1. A command containing the wrong database name silently targets an empty database and returns "0 rows and no column information", which looks like a legitimate empty result.
  2. The natural shape {"collection": "articles", "find": {...}} (or "aggregate": [...]) is not normalised. sql_materialize says MongoDB command "undefined" is not allowed; sql_execute treats it as a write and returns "The user has specified a rule which prevents you from using this specific tool call".
  3. listCollections is classified as a write; SQL text sent to a Mongo warehouse is denied as a permission problem instead of "this is MongoDB, use a JSON command".

Mechanism

  • normalizeMqlCommand only rewrites native keys whose value is a string (packages/drivers/src/mongodb.ts:79-102), so command stays undefined when find is an object.
  • resolveDb(parsed.database) accepts any name (mongodb.ts:241-243, :413); no existence check.
  • sql_materialize error: sql-materialize.ts:180-185. sql_execute path: MONGO_READ_COMMANDS lacks listCollections and estimatedDocumentCount (packages/opencode/src/altimate/tools/sql-classify.ts:197), and an unparseable shape falls into the write path (:216-220).

Evidence

Recorded analyst sessions against a 127k-document collection:

  • 7 silent empty reads (5 used the warehouse name as the database; 2 a nonexistent collection).
  • 31 sql_materialize calls reported command "undefined" in one set of sessions (16 in another, 4 in a third) and 9 sql_execute calls returned the permission text; it was the first Mongo call in all 10 sessions of one batch.
  • 9 SQL-on-Mongo permission denials.
    Most sessions recovered after one turn; the silent empty read can silently corrupt an answer.

Impact

Correctness-risk (silent empty result) plus about one wasted turn per occurrence.

Proposed fix

  • Accept {collection, find: <filter>} and {collection, aggregate: <pipeline>}.
  • Validate database and collection once per connection (listCollections / listDatabases) and return the available names on mismatch.
  • Add listCollections and estimatedDocumentCount to the read commands.
  • Return a shape error, never a permission error, for unparseable Mongo input or SQL sent to Mongo.

Acceptance check

  • {"collection":"c","find":{"a":1}} runs identically to {"command":"find","collection":"c","filter":{"a":1}} in both tools.
  • A wrong database name returns an error listing valid databases, not an empty result.
  • listCollections is classified as a read.
主要语言
TypeScript
星标
810
派生
121
平均合并
1 天 10 小时
30 天内合并 PR
89

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

AltimateAI/altimate-code 的其他 Issue

查看 AltimateAI/altimate-code 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。