Function evaluate_conditions

nodedb/src/control/security/conditional.rs:52–141

Evaluate whether all conditions on a grant are satisfied. Returns `Ok(())` if all conditions pass, `Err(reason)` if any fails.

(
    conditions: &[GrantCondition],
    auth: &AuthContext,
    client_ip: &str,
)

///
/// Returns `Ok(())` if all conditions pass, `Err(reason)` if any fails.
pub fn evaluate_conditions(
    conditions: &[GrantCondition],
    auth: &AuthContext,
    client_ip: &str,
) -> crate::Result<()> {
    for cond in conditions {
        match cond {
            GrantCondition::Temporal {
                start_hour,
                end_hour,
                days,
            } => {
                let now = current_time_components();
                let hour = now.0;
                let weekday = now.1;

                if hour < *start_hour || hour >= *end_hour {
                    return Err(crate::Error::RejectedAuthz {
                        tenant_id: auth.tenant_id,
                        resource: format!(
                            "temporal condition: current hour {hour} not in {start_hour}..{end_hour}"
                        ),
                    });
                }
                if !days.is_empty() && !days.contains(&weekday) {
                    return Err(crate::Error::RejectedAuthz {
                        tenant_id: auth.tenant_id,
                        resource: format!("temporal condition: day {weekday} not in allowed days"),
                    });
                }
            }

            GrantCondition::RequireMfa => {
                // MFA is indicated by $auth.metadata.mfa_verified = "true".
                let mfa_ok = auth
                    .metadata
                    .get("mfa_verified")
                    .is_some_and(|v| v == "true");
                if !mfa_ok {
                    return Err(crate::Error::RejectedAuthz {
                        tenant_id: auth.tenant_id,
                        resource: "MFA verification required".to_string(),
                    });
                }
            }

            GrantCondition::RequireIp { allowed_cidrs } => {
                let ip_ok = super::blacklist::ip::check_ip_against_cidrs(client_ip, allowed_cidrs)
                    .is_some();
                if !ip_ok {
                    return Err(crate::Error::RejectedAuthz {
                        tenant_id: auth.tenant_id,
                        resource: format!("IP {client_ip} not in allowed ranges"),
                    });
                }
            }

            GrantCondition::StepUpAuth { max_age_secs } => {