In checkOperationAuthorization, the command is parsed to perform an authorization check, but the parse result is discarded. When the operation is later executed via run(), the command is parsed again.

The TODO at line 126 notes that the parse result should be cached and reused, with the caveat that the dbname may differ between the two phases (e.g., renameCollection uses admin for auth but the original namespace for execution).