Further tweak mongodb permissions.

Author: rkistner

README.md

@@ -12,22 +12,16 @@ There is also a WYSIWYG editor available in our [Mintlify dashboard](https://das
 
 ### Development
 
-Install the [Mintlify CLI](https://www.npmjs.com/package/mintlify) to preview the documentation changes locally. To install, use the following command
-
-```
-npm i -g mintlify
-```
-
 Run the following command at the root of your documentation (where mint.json is)
 
 ```
-mintlify dev
+npx mintlify dev
 ```
 
 Regularly check for broken links by running
 
 ```
-mintlify broken-links
+npx mintlify broken-links
 ```
 
 Navigation (and other global settings) is defined in `mint.json`. Learn more about these in [Mintlify's docs](https://mintlify.com/docs/settings/global).

installation/database-setup.mdx

@@ -356,20 +356,29 @@ replicated collections, additionally add the `dbAdmin` permission:
 
 ```
 readWrite@<your_database>._powersync_checkpoints
+read@<your_database>
 dbAdmin@<your_database>
 ```
 
-If you are replicating from multiple databases in the cluster, you need read permissions on the entire cluster:
+If you are replicating from multiple databases in the cluster, you need read permissions on the entire cluster, in addtion to the above:
 
 ```
 readAnyDatabase@admin
 ```
 
-### Permissions required - Self-hosted
+### Privileges required - Self-hosted / Custom roles
+
+For self-hosted MongoDB, or for creating custom roles on MongoDB Atlas, PowerSync requires the following privileges/granted actions:
 
-For self-hosted MongoDB, PowerSync requires the `find`, `changeStream` and `listCollections` permissions on the database being replicated.
+* On the database being replicated: `listCollections`.
+* On all collections in the database: `changeStream`.
+   * This must apply to the entire database, not individual collections, `collection: ""`.
+   * If replicating from multiple databases, this must apply to the entire cluster, `db: ""`.
+* On each collection being replicated: `find`.
+* On the `_powersync_checkpoints` collection: `createCollection`, `dropCollection`, `find`, `changeStream`, `insert`, `update`, and `remove`.
+* To allow PowerSync to automatically enable [`changeStreamPreAndPostImages`](#post-images) on
+replicated collections, additionally add the `collMod` permission all replicated collections.
 
-PowerSync also requires `createCollection`, `dropCollection`, `insert`, `update`, and `remove` permissions to the `_powersync_checkpoints` collection.
 
 ### Post-Images