Function rls_check_document

nodedb/src/data/executor/handlers/rls_eval.rs:21–37

Evaluate RLS filters against a document. Returns `true` if the document passes all RLS filters (or if no filters). Returns `false` if any filter rejects the document (caller must deny). Used by point-get and key-get handlers after fetching the raw document.

(rls_filters: &[u8], doc: &serde_json::Value)

///
/// Used by point-get and key-get handlers after fetching the raw document.
pub fn rls_check_document(rls_filters: &[u8], doc: &serde_json::Value) -> bool {
    if rls_filters.is_empty() {
        return true;
    }

    let filters: Vec<ScanFilter> = match zerompk::from_msgpack(rls_filters) {
        Ok(f) => f,
        Err(_) => {
            // Deserialization failure → deny (fail-closed).
            tracing::warn!("RLS filter deserialization failed — denying access");
            return false;
        }
    };

    let msgpack = nodedb_types::json_to_msgpack_or_empty(doc);
    filters.iter().all(|f| f.matches_binary(&msgpack))
}

/// Evaluate RLS filters against raw MessagePack document bytes.
///