Module clp 

Class-level permissions: the model, and nothing that evaluates it.

CLP lives here rather than in parse-rust-schema for the same reason crate::acl does. It is an authorization data model with a JSON encoding and no I/O, and both the schema crate (which validates it) and the REST crate (which enforces it) need the type. Validation messages and evaluation both live above this crate.

Three shapes here are load-bearing, and each one fails as a security defect rather than as a test failure if it is modelled the obvious way instead of upstream’s way.

CLP is default-open. testPermissions allows when classPermissions[operation] is falsy (SchemaController.js:1365-1382): an absent operation entry means unrestricted, not denied. That is why ClassLevelPermissions::op returns Option<&OpPerm> with None meaning unrestricted, and why OpPerm deliberately has no Default impl. A Default would be an empty entity set, which is deny-all, so a refactor that reached for unwrap_or_default() would invert the rule and lock every existing database out.

The two entity grammars are not interchangeable. Operations and addField accept pointerFields, *, requiresAuthentication, role:<name> and an objectId (validatePermissionKey, SchemaController.js:218-235). protectedFields accepts userField:<name>, *, authenticated, role:<name> and an objectId (validateProtectedFieldsKey, :237-254). One shared enum gets this wrong in both directions, so there are two: OpEntity and PfEntity.

The raw block is kept verbatim. parse-rust must never rewrite a key it does not understand back out of _metadata.class_permissions, because a parse-server node reading the same database would see the key vanish. ClassLevelPermissions::raw is what gets written; the parsed view is only ever read.

Structs

ClassLevelPermissions

Class-level permissions.

OpPerm

One operation’s permission object.

Enums

OpEntity

An entity key inside an operation’s permission object.

Operation

The seven operations a CLP can restrict.

PfEntity

An entity key inside protectedFields.

UserFieldsKey

Which class-wide pointer-field array an operation consults.

Functions

is_js_truthy

JavaScript truthiness, which is what !classPermissions[operation] tests.