Our team has been tasked with a fairly open ended request for a MongoDB with multiple users that can access and submit documents to collections for a graduate class. The team is all new to MongoDB and are unsure how to handle the user storage side of things.
The internal team discussion is for: a) create a new limited role user in the database level as each user signs up to the service or b) creating a user collection and store users and hashed passwords there.
Does anyone have any advice on which method is better and why?
Best Answer
If you absolutely need to give direct database access to someone, then go with option a) and all that it entails.
Else, then go with option b).
Option a) is a poor choice because, as of right now (MongoDB 4.2), permission granularity is still at collection level. This means that if users have write access to the same collection, they can overwrite documents of each other.
Even for your use case, if each user has their own collection or database, this would only work well with few users (less than five thousand active users). I suppose you could have a million users this way, even a billion, but MongoDB sharding doesn't work this way, and will never scale properly.