Currently users with collection-specific read or read/write permissions are not authorized to perform the following commands:

db.listCollections()
show collections
db.getCollectionNames()

This impacts the shell (and also third party tools that won't let users access their permitted collections because the list of collections is blocked in the first place)

Suggestion:

Users with collection-specific read or read/write permissions should be able to run the above commands and the result would only present the collections for which the user has some read or write privileges (instead of blocking everything).