Function inject_rls

nodedb/src/control/planner/rls_injection.rs:35–45

Inject RLS predicates into physical tasks after plan conversion. This is the read-path RLS enforcement entry point. For each task: 1. Extracts the collection name from the physical plan. 2. Fetches RLS read policies for `(tenant_id, collection)`. 3. Substitutes `$auth.*` references using the `AuthContext`. 4. Injects the resulting concrete filters into the plan: - **Scans**: merged into the exist

(
    tasks: &mut [PhysicalTask],
    rls_store: &RlsPolicyStore,
    auth: &AuthContext,
)

///
/// Returns `Err` if a required `$auth` field is missing (fail-closed).
pub fn inject_rls(
    tasks: &mut [PhysicalTask],
    rls_store: &RlsPolicyStore,
    auth: &AuthContext,
) -> crate::Result<()> {
    for task in tasks.iter_mut() {
        let tenant_id = task.tenant_id.as_u64();
        inject_rls_for_plan(tenant_id, &mut task.plan, rls_store, auth)?;
    }
    Ok(())
}

/// Inject RLS into a single physical plan (public for native protocol dispatch).
pub fn inject_rls_for_single_plan(