Function lint_predicate

nodedb/src/control/security/explain.rs:162–192

Lint an RLS predicate for common issues. Returns a list of warnings (empty = clean).

(predicate: &super::predicate::RlsPredicate)

///
/// Returns a list of warnings (empty = clean).
pub fn lint_predicate(predicate: &super::predicate::RlsPredicate) -> Vec<String> {
    let mut warnings = Vec::new();

    match predicate {
        super::predicate::RlsPredicate::AlwaysTrue => {
            warnings.push("tautology: predicate is always true (no filtering)".into());
        }
        super::predicate::RlsPredicate::AlwaysFalse => {
            warnings.push("contradiction: predicate is always false (blocks everything)".into());
        }
        super::predicate::RlsPredicate::Compare { value, .. }
            if !value.is_auth_ref()
                && matches!(value, super::predicate::PredicateValue::Literal(_)) =>
        {
            warnings
                .push("static predicate: no $auth reference — same result for all users".into());
        }
        super::predicate::RlsPredicate::And(children)
        | super::predicate::RlsPredicate::Or(children) => {
            for child in children {
                warnings.extend(lint_predicate(child));
            }
        }
        super::predicate::RlsPredicate::Not(inner) => {
            warnings.extend(lint_predicate(inner));
        }
        _ => {}
    }

    warnings
}

#[cfg(test)]
mod tests {