pub fn reject_reserved_keys(body: &ParseMap) -> Result<(), ParseError>Expand description
Refuse a body that carries a server-internal column.
Server-internal columns are _-prefixed: _hashed_password, _rperm, _wperm,
_session_token, _perishable_token. The schema layer deliberately does not validate them,
because the server sets them itself. That makes this guard the only thing standing between a
client and, for example, writing its own _rperm to grant itself read access, or supplying a
_hashed_password it chose.
Applied at the REST boundary rather than in the schema layer so that the server’s own writes, which legitimately carry these keys, do not have to route around their own validation.