rbac_plug: per-classid field mask default (sensitive fields, HubSPO D-IAM-3)

[AdaWorldAPI]

What

RbacBinding::with_class_field_defaults(Vec<(u16, WideFieldMask)>): for each plugged classid, the field mask a role gets when the authority declared no mask of its own for it.

Why

A role with no declared mask sees every field (ClassRbac::field_mask's open default). authorize_scoped / authorize_memberships take the union over the user's roles, so one such role opens every field, sensitive ones included. HubSPO-rs D-IAM-3 needs sensitive properties hidden unless a role grants them.

How

This is policy data keyed by classid, not a derivation:

• it replaces only the open default;
• it never changes a mask a role was given;
• it is dropped outside the plug, like grants and role masks.

field_mask_for resolves in this order: the role's own mask, then the class default, then None.

Tests

• rbac_plug::a_class_default_replaces_the_open_default_and_nothing_else
• authorize::plug_tests::a_class_default_keeps_sensitive_fields_out_of_the_union. Its first assertion pins the open behaviour without a default, so the test can tell the two cases apart.

Disable run: with the class-default lookup removed, both tests fail. Restored, both pass.

Gates: fmt --check, clippy -D warnings on contract and rbac, lance-graph-rbac tests, and dir-sim --features rbac tests.

Not in this PR

• OGAR's authority does not set the default yet. GrantSource needs a class-level mask; that is a follow-up PR in OGAR once this merges.
• No output stage drops the masked columns yet (H7).

🤖 Generated with Claude Code

https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

---

Generated by Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2d989f64-b31c-4ef7-bdfe-b872184b73b0

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T21:50:31.192670Z	e6da5fd	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.