Function parse_conditions

nodedb/src/control/security/conditional.rs:151–235

Parse condition clauses from DDL parts. Recognizes: - `WHEN BETWEEN ' ' AND ' ' ON WEEKDAYS` - `REQUIRE MFA` - `REQUIRE IP IN (' ', ...)` - `REQUIRE STEP_UP ` - `REQUIRE DEVICE_TRUST`

(parts: &[&str])

/// - `REQUIRE STEP_UP <seconds>`
/// - `REQUIRE DEVICE_TRUST`
pub fn parse_conditions(parts: &[&str]) -> Vec<GrantCondition> {
    let mut conditions = Vec::new();
    let mut i = 0;

    while i < parts.len() {
        let upper = parts[i].to_uppercase();

        if upper == "WHEN" && i + 4 < parts.len() && parts[i + 1].to_uppercase() == "BETWEEN" {
            let start = parts[i + 2].trim_matches('\'');
            let end = parts[i + 4].trim_matches('\'');
            let start_hour = parse_hour(start);
            let end_hour = parse_hour(end);

            // Check for ON WEEKDAYS.
            let days = if i + 6 < parts.len() && parts[i + 5].to_uppercase() == "ON" {
                let day_str = parts[i + 6].to_uppercase();
                match day_str.as_str() {
                    "WEEKDAYS" => vec![1, 2, 3, 4, 5],
                    "WEEKENDS" => vec![0, 6],
                    "ALL" => vec![],
                    _ => vec![],
                }
            } else {
                vec![]
            };

            conditions.push(GrantCondition::Temporal {
                start_hour,
                end_hour,
                days,
            });
            i += 7;
            continue;
        }

        if upper == "REQUIRE" && i + 1 < parts.len() {
            let req = parts[i + 1].to_uppercase();
            match req.as_str() {
                "MFA" => {
                    conditions.push(GrantCondition::RequireMfa);
                    i += 2;
                }
                "IP" => {
                    // REQUIRE IP IN ('cidr1', 'cidr2')
                    let cidrs: Vec<String> = parts[i + 3..]
                        .iter()
                        .take_while(|p| !p.starts_with(')'))
                        .map(|s| {
                            s.trim_matches('\'')
                                .trim_matches('(')
                                .trim_matches(')')
                                .trim_end_matches(',')
                                .to_string()
                        })
                        .filter(|s| !s.is_empty() && s.to_uppercase() != "IN")
                        .collect();
                    conditions.push(GrantCondition::RequireIp {
                        allowed_cidrs: cidrs,