@feltdb/core 0.8.4 → 0.8.5

package/dist/create/server-source/crates/feltdb/src/policy_evaluation.rs

@@ -123,7 +123,9 @@ impl PolicySubject {
     /// Returns None if the subject is not recognized.
     pub fn from_str(s: &str) -> Option<Self> {
         if let Some(field) = s.strip_prefix("self(").and_then(|s| s.strip_suffix(")")) {
-            return Some(PolicySubject::Self_ { field: field.to_string() });
+            return Some(PolicySubject::Self_ {
+                field: field.to_string(),
+            });
         }
         match s {
             "authenticated" => Some(PolicySubject::Authenticated),
@@ -222,9 +224,7 @@ impl AuthorizationState {
         let capability = format!("{}:{}", self.state_namespace, collection);
         self.snapshot_rows
             .iter()
-            .find(|row| {
-                row.capability == capability && row.key == key && !row.deleted
-            })
+            .find(|row| row.capability == capability && row.key == key && !row.deleted)
             .map(|row| row.value.clone())
     }
 
@@ -240,21 +240,28 @@ impl AuthorizationState {
 
     /// Find a field in a collection that references another collection.
     /// Returns the field name if found.
-    pub fn find_reference_field(&self, from_collection: &str, to_collection: &str) -> Option<String> {
-        let collection = self.schema.collections
+    pub fn find_reference_field(
+        &self,
+        from_collection: &str,
+        to_collection: &str,
+    ) -> Option<String> {
+        let collection = self
+            .schema
+            .collections
             .iter()
             .find(|c| c.name == from_collection)?;
 
-        collection.fields
-            .iter()
-            .find_map(|field| {
-                if let crate::state_contract::FieldType::Reference { collection: ref_col } = &field.field_type {
-                    if ref_col == to_collection {
-                        return Some(field.name.clone());
-                    }
+        collection.fields.iter().find_map(|field| {
+            if let crate::state_contract::FieldType::Reference {
+                collection: ref_col,
+            } = &field.field_type
+            {
+                if ref_col == to_collection {
+                    return Some(field.name.clone());
                 }
-                None
-            })
+            }
+            None
+        })
     }
 
     /// Find which collection contains membership information (references both User and Organization).
@@ -263,7 +270,10 @@ impl AuthorizationState {
         // Look for a collection that has references to both User and Organization
         for collection in &self.schema.collections {
             let has_user_ref = collection.fields.iter().any(|f| {
-                if let crate::state_contract::FieldType::Reference { collection: ref_col } = &f.field_type {
+                if let crate::state_contract::FieldType::Reference {
+                    collection: ref_col,
+                } = &f.field_type
+                {
                     ref_col == "User" || ref_col == "Users"
                 } else {
                     false
@@ -271,7 +281,10 @@ impl AuthorizationState {
             });
 
             let has_org_ref = collection.fields.iter().any(|f| {
-                if let crate::state_contract::FieldType::Reference { collection: ref_col } = &f.field_type {
+                if let crate::state_contract::FieldType::Reference {
+                    collection: ref_col,
+                } = &f.field_type
+                {
                     ref_col == "Organization" || ref_col == "Organizations"
                 } else {
                     false
@@ -288,7 +301,9 @@ impl AuthorizationState {
     /// Find field names for user and organization references within a collection.
     /// Returns (user_field, org_field) if both are found.
     pub fn find_membership_fields(&self, collection_name: &str) -> Option<(String, String)> {
-        let collection = self.schema.collections
+        let collection = self
+            .schema
+            .collections
             .iter()
             .find(|c| c.name == collection_name)?;
 
@@ -296,11 +311,15 @@ impl AuthorizationState {
         let mut org_field = None;
 
         for field in &collection.fields {
-            if let crate::state_contract::FieldType::Reference { collection: ref_col } = &field.field_type {
+            if let crate::state_contract::FieldType::Reference {
+                collection: ref_col,
+            } = &field.field_type
+            {
                 if (ref_col == "User" || ref_col == "Users") && user_field.is_none() {
                     user_field = Some(field.name.clone());
                 }
-                if (ref_col == "Organization" || ref_col == "Organizations") && org_field.is_none() {
+                if (ref_col == "Organization" || ref_col == "Organizations") && org_field.is_none()
+                {
                     org_field = Some(field.name.clone());
                 }
             }
@@ -387,12 +406,10 @@ impl PolicyEvaluator {
             PolicySubject::Authenticated => Self::evaluate_authenticated(context),
             PolicySubject::Owner => Self::evaluate_owner(context),
             PolicySubject::Member => Self::evaluate_member(context),
-            PolicySubject::Self_ { .. } => {
-                Err(PolicyAuthorizationError::new(
-                    "INVALID_POLICY_CONTEXT",
-                    "self policies require record-level context; use evaluate_record instead",
-                ))
-            }
+            PolicySubject::Self_ { .. } => Err(PolicyAuthorizationError::new(
+                "INVALID_POLICY_CONTEXT",
+                "self policies require record-level context; use evaluate_record instead",
+            )),
         }
     }
 
@@ -448,12 +465,10 @@ impl PolicyEvaluator {
         if actor.id == *owner_id {
             Ok(AuthorizationDecision::Allow)
         } else {
-            Err(PolicyAuthorizationError::unauthorized(
-                format!(
-                    "actor {} is not the owner ({})",
-                    actor.id, owner_id
-                ),
-            ))
+            Err(PolicyAuthorizationError::unauthorized(format!(
+                "actor {} is not the owner ({})",
+                actor.id, owner_id
+            )))
         }
     }
 
@@ -474,19 +489,19 @@ impl PolicyEvaluator {
             )
         })?;
 
-        let is_member = context.resource_attributes.get("is_member")
+        let is_member = context
+            .resource_attributes
+            .get("is_member")
             .map(|v| v == "true")
             .unwrap_or(false);
 
         if is_member {
             Ok(AuthorizationDecision::Allow)
         } else {
-            Err(PolicyAuthorizationError::unauthorized(
-                format!(
-                    "actor {} is not a member of organization {}",
-                    actor.id, organization_id
-                ),
-            ))
+            Err(PolicyAuthorizationError::unauthorized(format!(
+                "actor {} is not a member of organization {}",
+                actor.id, organization_id
+            )))
         }
     }
 
@@ -530,12 +545,10 @@ impl PolicyEvaluator {
         if actor.id == owner_id {
             Ok(AuthorizationDecision::Allow)
         } else {
-            Err(PolicyAuthorizationError::unauthorized(
-                format!(
-                    "actor {} is not the owner ({})",
-                    actor.id, owner_id
-                ),
-            ))
+            Err(PolicyAuthorizationError::unauthorized(format!(
+                "actor {} is not the owner ({})",
+                actor.id, owner_id
+            )))
         }
     }
 
@@ -559,7 +572,8 @@ impl PolicyEvaluator {
         })?;
 
         // Find the reference field from this collection to Organization
-        let org_ref_field = auth_state.find_reference_field(&context.collection, "Organization")
+        let org_ref_field = auth_state
+            .find_reference_field(&context.collection, "Organization")
             .or_else(|| auth_state.find_reference_field(&context.collection, "Organizations"))
             .ok_or_else(|| {
                 PolicyAuthorizationError::new(
@@ -569,7 +583,8 @@ impl PolicyEvaluator {
             })?;
 
         // Extract the organization ID from the record
-        let organization_id = context.field(&org_ref_field)
+        let organization_id = context
+            .field(&org_ref_field)
             .and_then(|v| v.as_str())
             .ok_or_else(|| {
                 PolicyAuthorizationError::new(
@@ -588,7 +603,8 @@ impl PolicyEvaluator {
             })?;
 
         // Find the field names for user and organization references in the membership collection
-        let (user_field, org_field) = auth_state.find_membership_fields(&membership_collection)
+        let (user_field, org_field) = auth_state
+            .find_membership_fields(&membership_collection)
             .ok_or_else(|| {
                 PolicyAuthorizationError::new(
                     "MEMBERSHIP_NOT_DEFINED",
@@ -622,12 +638,10 @@ impl PolicyEvaluator {
         if has_membership {
             Ok(AuthorizationDecision::Allow)
         } else {
-            Err(PolicyAuthorizationError::unauthorized(
-                format!(
-                    "actor {} is not a member of organization {}",
-                    actor.id, organization_id
-                ),
-            ))
+            Err(PolicyAuthorizationError::unauthorized(format!(
+                "actor {} is not a member of organization {}",
+                actor.id, organization_id
+            )))
         }
     }
 
@@ -639,12 +653,11 @@ impl PolicyEvaluator {
         context: &RecordAuthorizationContext,
     ) -> Result<AuthorizationDecision, PolicyAuthorizationError> {
         let actor = context.actor.as_ref().ok_or_else(|| {
-            PolicyAuthorizationError::unauthenticated(
-                "self policy requires an authenticated actor",
-            )
+            PolicyAuthorizationError::unauthenticated("self policy requires an authenticated actor")
         })?;
 
-        let field_value = context.field(field)
+        let field_value = context
+            .field(field)
             .and_then(|v| v.as_str())
             .ok_or_else(|| {
                 PolicyAuthorizationError::new(
@@ -656,12 +669,10 @@ impl PolicyEvaluator {
         if actor.id == field_value {
             Ok(AuthorizationDecision::Allow)
         } else {
-            Err(PolicyAuthorizationError::unauthorized(
-                format!(
-                    "actor {} does not match identity field {}",
-                    actor.id, field
-                ),
-            ))
+            Err(PolicyAuthorizationError::unauthorized(format!(
+                "actor {} does not match identity field {}",
+                actor.id, field
+            )))
         }
     }
 }
@@ -720,9 +731,15 @@ mod tests {
 
     #[test]
     fn policy_subject_from_str() {
-        assert_eq!(PolicySubject::from_str("authenticated"), Some(PolicySubject::Authenticated));
+        assert_eq!(
+            PolicySubject::from_str("authenticated"),
+            Some(PolicySubject::Authenticated)
+        );
         assert_eq!(PolicySubject::from_str("owner"), Some(PolicySubject::Owner));
-        assert_eq!(PolicySubject::from_str("member"), Some(PolicySubject::Member));
+        assert_eq!(
+            PolicySubject::from_str("member"),
+            Some(PolicySubject::Member)
+        );
         assert_eq!(PolicySubject::from_str("invalid"), None);
     }
 
@@ -932,12 +949,8 @@ mod tests {
     #[test]
     fn existing_owner_policy_works_with_state() {
         let record = serde_json::json!({"_id": "rec1", "owner_id": "user123"});
-        let context = RecordAuthorizationContext::new(
-            Some(Actor::new("user123")),
-            "Project",
-            "rec1",
-            record,
-        );
+        let context =
+            RecordAuthorizationContext::new(Some(Actor::new("user123")), "Project", "rec1", record);
 
         // Should work even though authorization_state is None
         let result = PolicyEvaluator::evaluate_record(PolicySubject::Owner, &context);
@@ -947,12 +960,8 @@ mod tests {
     #[test]
     fn existing_authenticated_policy_works_with_state() {
         let record = serde_json::json!({"_id": "rec1"});
-        let context = RecordAuthorizationContext::new(
-            Some(Actor::new("user123")),
-            "Project",
-            "rec1",
-            record,
-        );
+        let context =
+            RecordAuthorizationContext::new(Some(Actor::new("user123")), "Project", "rec1", record);
 
         // Should work even though authorization_state is None
         let result = PolicyEvaluator::evaluate_record(PolicySubject::Authenticated, &context);
@@ -963,7 +972,9 @@ mod tests {
     // These tests verify that member policy is enforced using database state,
     // not caller-supplied attributes.
 
-    fn make_schema_with_collections(collections: Vec<crate::state_contract::CollectionSchema>) -> Arc<crate::state_contract::StateSchema> {
+    fn make_schema_with_collections(
+        collections: Vec<crate::state_contract::CollectionSchema>,
+    ) -> Arc<crate::state_contract::StateSchema> {
         Arc::new(crate::state_contract::StateSchema {
             contract_version: 1,
             schema_version: 1,
@@ -973,7 +984,10 @@ mod tests {
         })
     }
 
-    fn make_collection(name: &str, fields: Vec<crate::state_contract::FieldSchema>) -> crate::state_contract::CollectionSchema {
+    fn make_collection(
+        name: &str,
+        fields: Vec<crate::state_contract::FieldSchema>,
+    ) -> crate::state_contract::CollectionSchema {
         crate::state_contract::CollectionSchema {
             name: name.into(),
             version: 1,
@@ -982,7 +996,10 @@ mod tests {
         }
     }
 
-    fn make_field(name: &str, field_type: crate::state_contract::FieldType) -> crate::state_contract::FieldSchema {
+    fn make_field(
+        name: &str,
+        field_type: crate::state_contract::FieldType,
+    ) -> crate::state_contract::FieldSchema {
         crate::state_contract::FieldSchema {
             name: name.into(),
             field_type,
@@ -999,19 +1016,51 @@ mod tests {
         use crate::state_contract::FieldType;
 
         let schema = make_schema_with_collections(vec![
-            make_collection("Project", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
-            make_collection("Membership", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("user", FieldType::Reference { collection: "User".into() }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
+            make_collection(
+                "Project",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
+            make_collection(
+                "Membership",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "user",
+                        FieldType::Reference {
+                            collection: "User".into(),
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
         ]);
 
         let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
-        let membership = serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
+        let membership =
+            serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
 
         let snapshot = Arc::new(vec![
             make_stored_row("Project", "proj1", project),
@@ -1036,19 +1085,51 @@ mod tests {
         use crate::state_contract::FieldType;
 
         let schema = make_schema_with_collections(vec![
-            make_collection("Project", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
-            make_collection("Membership", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("user", FieldType::Reference { collection: "User".into() }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
+            make_collection(
+                "Project",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
+            make_collection(
+                "Membership",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "user",
+                        FieldType::Reference {
+                            collection: "User".into(),
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
         ]);
 
         let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
-        let membership = serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
+        let membership =
+            serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
 
         let snapshot = Arc::new(vec![
             make_stored_row("Project", "proj1", project),
@@ -1074,19 +1155,51 @@ mod tests {
         use crate::state_contract::FieldType;
 
         let schema = make_schema_with_collections(vec![
-            make_collection("Project", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
-            make_collection("Membership", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("user", FieldType::Reference { collection: "User".into() }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
+            make_collection(
+                "Project",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
+            make_collection(
+                "Membership",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "user",
+                        FieldType::Reference {
+                            collection: "User".into(),
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
         ]);
 
         let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
-        let membership = serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
+        let membership =
+            serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
 
         let snapshot = Arc::new(vec![
             make_stored_row("Project", "proj1", project),
@@ -1112,20 +1225,52 @@ mod tests {
         use crate::state_contract::FieldType;
 
         let schema = make_schema_with_collections(vec![
-            make_collection("Project", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
-            make_collection("Membership", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("user", FieldType::Reference { collection: "User".into() }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
+            make_collection(
+                "Project",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
+            make_collection(
+                "Membership",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "user",
+                        FieldType::Reference {
+                            collection: "User".into(),
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
         ]);
 
         // Alice is member of org1, project is in org2
         let project = serde_json::json!({"_id": "proj1", "organization": "org2"});
-        let membership = serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
+        let membership =
+            serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
 
         let snapshot = Arc::new(vec![
             make_stored_row("Project", "proj1", project),
@@ -1149,16 +1294,15 @@ mod tests {
     #[test]
     fn member_policy_no_state_fails() {
         let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
-        let context = RecordAuthorizationContext::new(
-            Some(Actor::new("alice")),
-            "Project",
-            "proj1",
-            project,
-        ); // No state attached
+        let context =
+            RecordAuthorizationContext::new(Some(Actor::new("alice")), "Project", "proj1", project); // No state attached
 
         let result = PolicyEvaluator::evaluate_record(PolicySubject::Member, &context);
         assert!(result.is_err());
-        assert_eq!(result.unwrap_err().code, "AUTHORIZATION_STATE_NOT_AVAILABLE");
+        assert_eq!(
+            result.unwrap_err().code,
+            "AUTHORIZATION_STATE_NOT_AVAILABLE"
+        );
     }
 
     #[test]
@@ -1166,21 +1310,45 @@ mod tests {
         use crate::state_contract::FieldType;
 
         let schema = make_schema_with_collections(vec![
-            make_collection("Project", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                // No organization reference
-            ]),
-            make_collection("Membership", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("user", FieldType::Reference { collection: "User".into() }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
+            make_collection(
+                "Project",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    // No organization reference
+                ],
+            ),
+            make_collection(
+                "Membership",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "user",
+                        FieldType::Reference {
+                            collection: "User".into(),
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
         ]);
 
         let project = serde_json::json!({"_id": "proj1"});
-        let snapshot = Arc::new(vec![
-            make_stored_row("Project", "proj1", project),
-        ]);
+        let snapshot = Arc::new(vec![make_stored_row("Project", "proj1", project)]);
 
         let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
         let context = RecordAuthorizationContext::new(
@@ -1201,21 +1369,50 @@ mod tests {
         use crate::state_contract::FieldType;
 
         let schema = make_schema_with_collections(vec![
-            make_collection("Project", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
-            make_collection("Membership", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("user", FieldType::Reference { collection: "User".into() }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
+            make_collection(
+                "Project",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
+            make_collection(
+                "Membership",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "user",
+                        FieldType::Reference {
+                            collection: "User".into(),
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
         ]);
 
         let project = serde_json::json!({"_id": "proj1"}); // Missing organization field
-        let snapshot = Arc::new(vec![
-            make_stored_row("Project", "proj1", project),
-        ]);
+        let snapshot = Arc::new(vec![make_stored_row("Project", "proj1", project)]);
 
         let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
         let context = RecordAuthorizationContext::new(
@@ -1236,20 +1433,54 @@ mod tests {
         use crate::state_contract::FieldType;
 
         let schema = make_schema_with_collections(vec![
-            make_collection("Project", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
-            make_collection("Membership", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("user", FieldType::Reference { collection: "User".into() }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
+            make_collection(
+                "Project",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
+            make_collection(
+                "Membership",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "user",
+                        FieldType::Reference {
+                            collection: "User".into(),
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
         ]);
 
         let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
-        let mut membership = make_stored_row("Membership", "mem1",
-            serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"}));
+        let mut membership = make_stored_row(
+            "Membership",
+            "mem1",
+            serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"}),
+        );
         membership.deleted = true; // Mark as deleted
 
         let snapshot = Arc::new(vec![
@@ -1276,24 +1507,67 @@ mod tests {
         use crate::state_contract::FieldType;
 
         let schema = make_schema_with_collections(vec![
-            make_collection("Project", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
-            make_collection("Membership", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("user", FieldType::Reference { collection: "User".into() }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
+            make_collection(
+                "Project",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
+            make_collection(
+                "Membership",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "user",
+                        FieldType::Reference {
+                            collection: "User".into(),
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
         ]);
 
         let project = serde_json::json!({"_id": "proj1", "organization": "org2"});
 
         let snapshot = Arc::new(vec![
             make_stored_row("Project", "proj1", project),
-            make_stored_row("Membership", "mem1", serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"})),
-            make_stored_row("Membership", "mem2", serde_json::json!({"_id": "mem2", "user": "alice", "organization": "org2"})),
-            make_stored_row("Membership", "mem3", serde_json::json!({"_id": "mem3", "user": "bob", "organization": "org2"})),
+            make_stored_row(
+                "Membership",
+                "mem1",
+                serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"}),
+            ),
+            make_stored_row(
+                "Membership",
+                "mem2",
+                serde_json::json!({"_id": "mem2", "user": "alice", "organization": "org2"}),
+            ),
+            make_stored_row(
+                "Membership",
+                "mem3",
+                serde_json::json!({"_id": "mem3", "user": "bob", "organization": "org2"}),
+            ),
         ]);
 
         let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
@@ -1314,21 +1588,51 @@ mod tests {
         use crate::state_contract::FieldType;
 
         let schema = make_schema_with_collections(vec![
-            make_collection("Project", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
-            make_collection("Membership", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("user", FieldType::Reference { collection: "User".into() }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
+            make_collection(
+                "Project",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
+            make_collection(
+                "Membership",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "user",
+                        FieldType::Reference {
+                            collection: "User".into(),
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
         ]);
 
-        let project = serde_json::json!({"_id": "proj1", "organization": "org1", "is_member": "true"});
-        let snapshot = Arc::new(vec![
-            make_stored_row("Project", "proj1", project),
-        ]);
+        let project =
+            serde_json::json!({"_id": "proj1", "organization": "org1", "is_member": "true"});
+        let snapshot = Arc::new(vec![make_stored_row("Project", "proj1", project)]);
 
         let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
         let context = RecordAuthorizationContext::new(
@@ -1350,19 +1654,51 @@ mod tests {
         use crate::state_contract::FieldType;
 
         let schema = make_schema_with_collections(vec![
-            make_collection("Project", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
-            make_collection("Membership", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("user", FieldType::Reference { collection: "User".into() }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
+            make_collection(
+                "Project",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
+            make_collection(
+                "Membership",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "user",
+                        FieldType::Reference {
+                            collection: "User".into(),
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
         ]);
 
         let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
-        let membership = serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
+        let membership =
+            serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
 
         let snapshot = Arc::new(vec![
             make_stored_row("Project", "proj1", project),
@@ -1392,19 +1728,51 @@ mod tests {
         use crate::state_contract::FieldType;
 
         let schema = make_schema_with_collections(vec![
-            make_collection("Project", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
-            make_collection("Membership", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("user_id", FieldType::Reference { collection: "User".into() }), // Variation: user_id not user
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
+            make_collection(
+                "Project",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
+            make_collection(
+                "Membership",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "user_id",
+                        FieldType::Reference {
+                            collection: "User".into(),
+                        },
+                    ), // Variation: user_id not user
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
         ]);
 
         let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
-        let membership = serde_json::json!({"_id": "mem1", "user_id": "alice", "organization": "org1"});
+        let membership =
+            serde_json::json!({"_id": "mem1", "user_id": "alice", "organization": "org1"});
 
         let snapshot = Arc::new(vec![
             make_stored_row("Project", "proj1", project),
@@ -1433,21 +1801,50 @@ mod tests {
         use crate::state_contract::FieldType;
 
         let schema = make_schema_with_collections(vec![
-            make_collection("Project", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
-            make_collection("Membership", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("user", FieldType::Reference { collection: "User".into() }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
+            make_collection(
+                "Project",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
+            make_collection(
+                "Membership",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "user",
+                        FieldType::Reference {
+                            collection: "User".into(),
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
         ]);
 
         let project = serde_json::json!({"_id": "proj1", "organization": "org1", "role": "admin"});
-        let snapshot = Arc::new(vec![
-            make_stored_row("Project", "proj1", project),
-        ]);
+        let snapshot = Arc::new(vec![make_stored_row("Project", "proj1", project)]);
 
         let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
         let context = RecordAuthorizationContext::new(
@@ -1469,17 +1866,28 @@ mod tests {
         use crate::state_contract::FieldType;
 
         let schema = make_schema_with_collections(vec![
-            make_collection("Project", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
-            ]),
+            make_collection(
+                "Project",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organization".into(),
+                        },
+                    ),
+                ],
+            ),
             // No membership collection defined
         ]);
 
         let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
-        let snapshot = Arc::new(vec![
-            make_stored_row("Project", "proj1", project),
-        ]);
+        let snapshot = Arc::new(vec![make_stored_row("Project", "proj1", project)]);
 
         let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
         let context = RecordAuthorizationContext::new(
@@ -1500,19 +1908,51 @@ mod tests {
         use crate::state_contract::FieldType;
 
         let schema = make_schema_with_collections(vec![
-            make_collection("Project", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("organization", FieldType::Reference { collection: "Organizations".into() }), // Plural
-            ]),
-            make_collection("Membership", vec![
-                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
-                make_field("user", FieldType::Reference { collection: "Users".into() }), // Plural
-                make_field("organization", FieldType::Reference { collection: "Organizations".into() }), // Plural
-            ]),
+            make_collection(
+                "Project",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organizations".into(),
+                        },
+                    ), // Plural
+                ],
+            ),
+            make_collection(
+                "Membership",
+                vec![
+                    make_field(
+                        "_id",
+                        FieldType::Primitive {
+                            primitive: crate::state_contract::PrimitiveType::String,
+                        },
+                    ),
+                    make_field(
+                        "user",
+                        FieldType::Reference {
+                            collection: "Users".into(),
+                        },
+                    ), // Plural
+                    make_field(
+                        "organization",
+                        FieldType::Reference {
+                            collection: "Organizations".into(),
+                        },
+                    ), // Plural
+                ],
+            ),
         ]);
 
         let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
-        let membership = serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
+        let membership =
+            serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
 
         let snapshot = Arc::new(vec![
             make_stored_row("Project", "proj1", project),
@@ -1543,7 +1983,9 @@ mod tests {
         );
 
         let result = PolicyEvaluator::evaluate_record(
-            PolicySubject::Self_ { field: "user".to_string() },
+            PolicySubject::Self_ {
+                field: "user".to_string(),
+            },
             &context,
         );
         assert_eq!(result, Ok(AuthorizationDecision::Allow));
@@ -1559,7 +2001,9 @@ mod tests {
         );
 
         let result = PolicyEvaluator::evaluate_record(
-            PolicySubject::Self_ { field: "user".to_string() },
+            PolicySubject::Self_ {
+                field: "user".to_string(),
+            },
             &context,
         );
         assert!(result.is_err());
@@ -1576,7 +2020,9 @@ mod tests {
         );
 
         let result = PolicyEvaluator::evaluate_record(
-            PolicySubject::Self_ { field: "user".to_string() },
+            PolicySubject::Self_ {
+                field: "user".to_string(),
+            },
             &context,
         );
         assert!(result.is_err());
@@ -1593,7 +2039,9 @@ mod tests {
         );
 
         let result = PolicyEvaluator::evaluate_record(
-            PolicySubject::Self_ { field: "user".to_string() },
+            PolicySubject::Self_ {
+                field: "user".to_string(),
+            },
             &context,
         );
         assert!(result.is_err());
@@ -1610,7 +2058,9 @@ mod tests {
         );
 
         let result = PolicyEvaluator::evaluate_record(
-            PolicySubject::Self_ { field: "user".to_string() },
+            PolicySubject::Self_ {
+                field: "user".to_string(),
+            },
             &context,
         );
         assert!(result.is_err());
@@ -1627,7 +2077,9 @@ mod tests {
         );
 
         let result = PolicyEvaluator::evaluate_record(
-            PolicySubject::Self_ { field: "owner".to_string() },
+            PolicySubject::Self_ {
+                field: "owner".to_string(),
+            },
             &context,
         );
         assert_eq!(result, Ok(AuthorizationDecision::Allow));
@@ -1643,7 +2095,9 @@ mod tests {
         );
 
         let result = PolicyEvaluator::evaluate_record(
-            PolicySubject::Self_ { field: "owner".to_string() },
+            PolicySubject::Self_ {
+                field: "owner".to_string(),
+            },
             &context,
         );
         assert!(result.is_err());
@@ -1663,7 +2117,9 @@ mod tests {
 
     #[test]
     fn policy_subject_as_str_for_self() {
-        let subject = PolicySubject::Self_ { field: "user".to_string() };
+        let subject = PolicySubject::Self_ {
+            field: "user".to_string(),
+        };
         assert_eq!(subject.as_str(), "self");
     }
 }