Function check_compiled_write

nodedb/src/control/security/rls/eval.rs:94–165

(
    policy: &RlsPolicy,
    compiled: &RlsPredicate,
    document: &serde_json::Value,
    auth: &AuthContext,
    tenant_id: u64,
    collection: &str,
    emitter: &dyn AuditEmitter,
)

}

fn check_compiled_write(
    policy: &RlsPolicy,
    compiled: &RlsPredicate,
    document: &serde_json::Value,
    auth: &AuthContext,
    tenant_id: u64,
    collection: &str,
    emitter: &dyn AuditEmitter,
) -> crate::Result<()> {
    let filters = match substitute_to_scan_filters(compiled, auth) {
        Some(f) => f,
        None => {
            info!(
                policy = %policy.name,
                username = %auth.username,
                %collection,
                "RLS write policy: unresolved $auth reference → denied"
            );
            emitter.emit(
                AuditEvent::RlsRejected,
                &auth.username,
                &format!(
                    "RLS policy '{}' on '{}': unresolved session variable",
                    policy.name, collection
                ),
                AuditEmitContext::new(
                    Some(crate::types::TenantId::new(tenant_id)),
                    &auth.id,
                    &auth.username,
                ),
            );
            return Err(crate::Error::RejectedAuthz {
                tenant_id: crate::types::TenantId::new(tenant_id),
                resource: format!(
                    "RLS policy '{}' on '{}': unresolved session variable",
                    policy.name, collection
                ),
            });
        }
    };

    let doc_mp = nodedb_types::json_to_msgpack_or_empty(document);
    if !filters.iter().all(|f| f.matches_binary(&doc_mp)) {
        info!(
            policy = %policy.name,
            username = %auth.username,
            %collection,
            "RLS write policy rejected (compiled)"
        );
        emitter.emit(
            AuditEvent::RlsRejected,
            &auth.username,
            &format!(
                "RLS policy '{}' on collection '{}' rejected write",
                policy.name, collection
            ),
            AuditEmitContext::new(
                Some(crate::types::TenantId::new(tenant_id)),