Function parse_atom

nodedb/src/control/security/predicate_parser.rs:173–271

(tokens: &[String], pos: &mut usize)

}

fn parse_atom(tokens: &[String], pos: &mut usize) -> Result<RlsPredicate, PredicateParseError> {
    if *pos >= tokens.len() {
        return Err(PredicateParseError::UnexpectedEnd);
    }

    // NOT prefix
    if tokens[*pos].to_uppercase() == "NOT" {
        *pos += 1;
        let inner = parse_atom(tokens, pos)?;
        return Ok(RlsPredicate::Not(Box::new(inner)));
    }

    // Parenthesized expression
    if tokens[*pos] == "(" {
        *pos += 1;
        let inner = parse_or_expr(tokens, pos)?;
        if *pos >= tokens.len() || tokens[*pos] != ")" {
            return Err(PredicateParseError::UnmatchedParen);
        }
        *pos += 1;
        return Ok(inner);
    }

    // Look ahead for CONTAINS / INTERSECTS / comparison operator
    let left_value = parse_value_ref(tokens, pos)?;

    if *pos >= tokens.len() {
        // Standalone value — treat as boolean (truthy).
        return match left_value {
            PredicateValue::AuthRef(_)
            | PredicateValue::Field(_)
            | PredicateValue::AuthFunc { .. } => Ok(RlsPredicate::Compare {
                field: match &left_value {
                    PredicateValue::Field(f) => f.clone(),
                    _ => String::new(),
                },
                op: CompareOp::IsNotNull,
                value: left_value,
            }),
            PredicateValue::Literal(_) => Ok(RlsPredicate::AlwaysTrue),
        };
    }

    let op_token = tokens[*pos].to_uppercase();

    match op_token.as_str() {
        "CONTAINS" => {
            *pos += 1;
            let element = parse_value_ref(tokens, pos)?;
            Ok(RlsPredicate::Contains {
                set: left_value,
                element,
            })
        }
        "INTERSECTS" => {
            *pos += 1;
            let right = parse_value_ref(tokens, pos)?;
            Ok(RlsPredicate::Intersects {