CLOUDP-205313: patch dbuser update to support external DB

[matt-condon]

Proposed changes

Jira ticket: CLOUDP-205313

dbuser update arn:aws:iam::**********:user/my-test-user --projectId ********** --role readWrite --authDB $external

Before fix:

{"detail":"No user with username arn:aws:iam::**********:user/my-test-user exists.","error":404,"errorCode":"USERNAME_NOT_FOUND","parameters":["arn:aws:iam::**********:user/my-test-user"],"reason":"Not Found"}
Error: https://cloud-dev.mongodb.com/api/atlas/v2/groups/**********/databaseUsers/admin/arn:aws:iam::**********:user%2Fmy-test-user PATCH: HTTP 404 Not Found (Error code: "USERNAME_NOT_FOUND") Detail: No user with username arn:aws:iam::**********:user/my-test-user exists. Reason: Not Found. Params: [arn:aws:iam::**********:user/my-test-user]
Exiting.

After fix:

{"awsIAMType":"USER","databaseName":"$external","groupId":"**********","labels":[],"ldapAuthType":"NONE","links":[{"href":"https://cloud.mongodb.com/api/atlas/v2/groups/**********/databaseUsers/$external/arn:aws:iam::**********:user%2Fmy-test-user","rel":"self"}],"oidcAuthType":"NONE","roles":[{"databaseName":"admin","roleName":"readWrite"}],"scopes":[],"username":"arn:aws:iam::**********:user/my-test-user","x509Type":"NONE"}
Successfully updated database user 'arn:aws:iam::**********:user/my-test-user'.

Closes #2338

Checklist

• I have signed the MongoDB CLA
• I have added tests that prove my fix is effective or that my feature works
• I have added any necessary documentation in document requirements section listed in CONTRIBUTING.md (if appropriate)
• I have addressed the @mongodb/docs-cloud-team comments (if appropriate)
• I have updated test/README.md (if an e2e test has been added)
• I have run make fmt and formatted my code

Further comments

[blva]

One minor ask if possible, otherwise I can approve

[blva]

[q] what does the API return if you don't set this value?

[matt-condon]

It maintains the previous behavior (setting the DatabaseName from the convert.getAuthDB(out) method)

The intent was to avoid breaking the existing behaviour for programmatic users who won't have the flag set

mongodb-atlas-cli/internal/convert/database_user.go

Lines 116 to 141 in 811c672

	// GetAuthDB determines the authentication database based on the type of user.
	// LDAP, X509 and AWSIAM should all use $external.
	// SCRAM-SHA should use admin.
	func GetAuthDB(user *atlasv2.CloudDatabaseUser) string {
	// base documentation https://registry.terraform.io/providers/mongodb/mongodbatlas/latest/docs/resources/database_user
	_, isX509 := adminX509Type[pointer.GetOrDefault(user.X509Type, "")]
	_, isIAM := awsIAMType[pointer.GetOrDefault(user.AwsIAMType, "")]
	// just USER is external
	isLDAP := user.LdapAuthType != nil && *user.LdapAuthType == userLdapAuthType
	if isX509 || isIAM || isLDAP {
	return ExternalAuthDB
	}
	return defaultUserDatabase
	}
	var adminX509Type = map[string]struct{}{
	"MANAGED": {},
	"CUSTOMER": {},
	}
	var awsIAMType = map[string]struct{}{
	"USER": {},
	"ROLE": {},
	}

[blva]

okay, works for me

[blva]

should we set admin as default here?

[matt-condon]

Same consideration as above

[davidhou17]

LGTM