Function rls_check_msgpack_bytes

nodedb/src/data/executor/handlers/rls_eval.rs:43–59

Evaluate RLS filters against raw MessagePack document bytes. Evaluates filters directly on msgpack bytes — no decode to serde_json::Value. Returns `true` if passes. Returns `false` if any filter rejects.

(rls_filters: &[u8], doc_bytes: &[u8])

/// Evaluates filters directly on msgpack bytes — no decode to serde_json::Value.
/// Returns `true` if passes. Returns `false` if any filter rejects.
pub fn rls_check_msgpack_bytes(rls_filters: &[u8], doc_bytes: &[u8]) -> bool {
    if rls_filters.is_empty() {
        return true;
    }

    let filters: Vec<ScanFilter> = match zerompk::from_msgpack(rls_filters) {
        Ok(f) => f,
        Err(_) => {
            tracing::warn!("RLS filter deserialization failed — denying access");
            return false;
        }
    };

    // Ensure bytes are standard msgpack for matches_binary.
    let mp = super::super::doc_format::json_to_msgpack(doc_bytes);
    filters.iter().all(|f| f.matches_binary(&mp))
}

#[cfg(test)]
mod tests {