Function check_inheritance_chain

nodedb/src/control/security/role.rs:336–376

Walk the inheritance chain starting from `start_name` upward through the given `roles` map. Returns the chain length (number of hops including `start_name` itself). If the chain is a cycle or exceeds `MAX_ROLE_INHERITANCE_DEPTH`, returns the corresponding error. This is the single authoritative write-time check — both `create_role` and `prepare_role` call it so the guarantee holds for every catal

(
    proposed_child: &str,
    proposed_parent: &str,
    roles: &HashMap<String, CustomRole>,
)

/// This is the single authoritative write-time check — both `create_role` and
/// `prepare_role` call it so the guarantee holds for every catalog mutation path.
fn check_inheritance_chain(
    proposed_child: &str,
    proposed_parent: &str,
    roles: &HashMap<String, CustomRole>,
) -> crate::Result<()> {
    // Walk upward from the proposed parent. If we encounter `proposed_child`
    // we have a cycle. If we exceed MAX_ROLE_INHERITANCE_DEPTH hops we stop.
    let mut current = proposed_parent;
    // depth counts the total chain: proposed_child (1) + proposed_parent (2) + ancestors.
    let mut depth: usize = 2;

    loop {
        if current == proposed_child {
            return Err(crate::Error::RoleInheritanceCycle {
                child: proposed_child.to_string(),
                parent: proposed_parent.to_string(),
            });
        }
        if depth > MAX_ROLE_INHERITANCE_DEPTH {
            return Err(crate::Error::RoleInheritanceDepthExceeded {
                depth,
                limit: MAX_ROLE_INHERITANCE_DEPTH,
            });
        }
        // Built-in roles have no further parents; chain ends here.
        if is_builtin(current) {
            break;
        }
        match roles.get(current) {
            Some(role) => match &role.parent {
                Some(parent_name) => {
                    current = parent_name.as_str();
                    depth += 1;
                }
                None => break,
            },
            None => break,
        }
    }
    Ok(())
}

/// Validate that `parent_name` refers to an existing role (built-in or
/// custom) and that adopting it as `child_name`'s parent does not create a