chore(oidc): start mongodb with auth enabled to ensure we're testing it correctly

[Anemy]

Previously we would keep default authentication enabled. This made it so that command would successfully run against the server when auth was failing, so testing with this config could give some false positives on behavior. This pr makes it so that the server requires auth for commands, and creates roles for the OIDC user to use.

It's currently in draft as I can't figure out what the correct db.createRole command should be for the mock oidc auth user.

db.createRole({
  role: 'dev/groups',
  privileges: [ ],
  roles: [ 'dbOwner' ]
})

[addaleax]

The role(s) would need to match the entries inside the groups claim, so that would be whatever OIDC_TOKEN_PAYLOAD_GROUPS specifies (and we probably want to use that because it is supposed to be a parameter for this image, right?)

Suggested change

	mongosh "mongodb://localhost:27017/admin" --eval "JSON.stringify(db.createRole({ role: \"dev/groups\", privileges: [ ], roles: [ \"dbOwner\" ] }));"
	mongosh "mongodb://localhost:27017/admin" --eval "JSON.stringify((process.env.OIDC_TOKEN_PAYLOAD_GROUPS ?? 'testgroup').split(',').map(group => db.createRole({ role: 'dev/' + group, privileges: [ ], roles: [ \"dbOwner\" ] })));"

or, if we’re sticking with a recent mongosh anyway,

Suggested change

	mongosh "mongodb://localhost:27017/admin" --eval "JSON.stringify(db.createRole({ role: \"dev/groups\", privileges: [ ], roles: [ \"dbOwner\" ] }));"
	mongosh "mongodb://localhost:27017/admin" --json --eval "(process.env.OIDC_TOKEN_PAYLOAD_GROUPS ?? 'testgroup').split(',').map(group => db.createRole({ role: 'dev/' + group, privileges: [ ], roles: [ \"dbOwner\" ] }));"

(otherwise, the default is testgroup)

[gribnoysup]

Tbh maybe I overkilled it by making them configurable, wouldn't mind if we don't want to do that, just felt like it wouldn't hurt 🙂

[addaleax]

I don’t think it’s a bad idea at all, but yeah, if we really want to leverage this, we’d probably also want to give the user the ability to apply a specific role to each group (i.e. make this a map group → role rather than a list of groups) so that behavior actually differs?

[Anemy]

Updated - thanks for the help on this.