Function check_value

nodedb/src/control/security/predicate_parser.rs:399–435

(val: &PredicateValue, known: &[&str])

    }

    fn check_value(val: &PredicateValue, known: &[&str]) -> crate::Result<()> {
        match val {
            PredicateValue::AuthRef(field) => {
                let base = field.split('.').next().unwrap_or(field);
                // Allow metadata.* sub-fields
                if base == "metadata" {
                    return Ok(());
                }
                if !known.contains(&base) {
                    return Err(crate::Error::BadRequest {
                        detail: format!(
                            "unknown $auth field: '{field}'. Valid fields: {}",
                            known.join(", ")
                        ),
                    });
                }
            }
            PredicateValue::AuthFunc { func, .. } => {
                const KNOWN_FUNCS: &[&str] = &[
                    "scope_status",
                    "scope_expires_at",
                    "quota_remaining",
                    "quota_pct",
                ];
                if !KNOWN_FUNCS.contains(&func.as_str()) {
                    return Err(crate::Error::BadRequest {
                        detail: format!(
                            "unknown $auth function: '{func}'. Valid functions: {}",
                            KNOWN_FUNCS.join(", ")
                        ),
                    });
                }
            }
            _ => {}
        }
        Ok(())
    }

    check(predicate, &known_fields)
}