Function validate_auth_refs

nodedb/src/control/security/predicate_parser.rs:360–438

Validate that all `$auth.*` references in a predicate are known fields. Called at policy creation time to reject typos like `$auth.usrname`.

(predicate: &RlsPredicate)

///
/// Called at policy creation time to reject typos like `$auth.usrname`.
pub fn validate_auth_refs(predicate: &RlsPredicate) -> crate::Result<()> {
    let known_fields = [
        "id",
        "username",
        "email",
        "tenant_id",
        "org_id",
        "org_ids",
        "roles",
        "groups",
        "permissions",
        "status",
        "auth_method",
        "auth_time",
        "session_id",
    ];

    fn check(pred: &RlsPredicate, known: &[&str]) -> crate::Result<()> {
        match pred {
            RlsPredicate::Compare { value, .. } => check_value(value, known),
            RlsPredicate::Contains { set, element } => {
                check_value(set, known)?;
                check_value(element, known)
            }
            RlsPredicate::Intersects { left, right } => {
                check_value(left, known)?;
                check_value(right, known)
            }
            RlsPredicate::And(children) | RlsPredicate::Or(children) => {
                for child in children {
                    check(child, known)?;
                }
                Ok(())
            }
            RlsPredicate::Not(inner) => check(inner, known),
            RlsPredicate::AlwaysTrue | RlsPredicate::AlwaysFalse => Ok(()),
        }
    }

    fn check_value(val: &PredicateValue, known: &[&str]) -> crate::Result<()> {
        match val {
            PredicateValue::AuthRef(field) => {
                let base = field.split('.').next().unwrap_or(field);
                // Allow metadata.* sub-fields
                if base == "metadata" {
                    return Ok(());
                }
                if !known.contains(&base) {
                    return Err(crate::Error::BadRequest {
                        detail: format!(
                            "unknown $auth field: '{field}'. Valid fields: {}",
                            known.join(", ")
                        ),
                    });
                }
            }
            PredicateValue::AuthFunc { func, .. } => {
                const KNOWN_FUNCS: &[&str] = &[