In jstests/auth/commands_user_defined_roles.js, the function runOneTest() tests that each test case works when either the database or collection named in each resource is the empty string. But it attempts to do this by manipulating a local copy of the privileges array, and these modifications aren't used when testProperAuthorization() is called.