Summary

This change implements the foundational authorization privilege extraction system for DocumentDB, introducing a new get_required_privileges() function that analyzes MongoDB commands and returns the required resource privileges needed to execute them. This is the first step in building a MongoDB-compatible Role-Based Access Control (RBAC) system.

Overview

This CR introduces a static privilege extraction system that:

1. Parses MongoDB command BSON specifications
2. Determines which resources (database/collection) are accessed
3. Identifies what privilege actions (find, insert, update, etc.) are required
4. Internal UDF for testing privilege extraction for commands

Current Scope: Implements extraction for find commands as a proof-of-concept. Future commands will follow the same pattern.

Test Coverage (authorization_get_required_privileges_find.sql - 16 tests)

PostgreSQL Interface:

• command_get_required_privileges() - PG_FUNCTION_INFO_V1 wrapper
  • Input: BSON command specification
  • Output: BSON with format:

    {
      "ok": 1.0,
      "canDeterminePrivileges": true,
      "privileges": [
        {
          "resource": {"db": "test", "collection": "users"},
          "actions": ["find"]
        }
      ]
    }

  • Returns canDeterminePrivileges: false for unsupported commands

Positive Test Cases:

• Basic find command
• Find with filters, projections, sort
• Different collections and databases
• Special characters in collection names
• Boundary conditions (very long names)