If a role has permission to readCollection as allowed but readRecords as denied, when you do a get collection, it still returns the records, even though it is denied cause readCollection returns the whole collection object including records.
Similarly if readDatabase is allowed but readCollection is denied, doing a readDatabase would return all collections, as whole database object is returned.
Need to fix
If a role has permission to readCollection as allowed but readRecords as denied, when you do a get collection, it still returns the records, even though it is denied cause readCollection returns the whole collection object including records.
Similarly if readDatabase is allowed but readCollection is denied, doing a readDatabase would return all collections, as whole database object is returned.
Need to fix