From 817b781c880ae8354fb926c0292086675f966a09 Mon Sep 17 00:00:00 2001
From: Hein <hein.puth@gmail.com>
Date: Sun, 20 Sep 2026 15:52:25 +0200
Subject: [PATCH] fix(security): skip loading security rules if disabled

---
 pkg/resolvespec/security_hooks.go | 3 +++
 pkg/security/hooks.go             | 9 +++++++++
 2 files changed, 12 insertions(+)

diff --git a/pkg/resolvespec/security_hooks.go b/pkg/resolvespec/security_hooks.go
index 24ac114..c1148fa 100644
--- a/pkg/resolvespec/security_hooks.go
+++ b/pkg/resolvespec/security_hooks.go
@@ -25,6 +25,9 @@ func RegisterSecurityHooks(handler *Handler, securityList *security.SecurityList
 	// Hook 1: BeforeRead - Load security rules
 	handler.Hooks().Register(BeforeRead, func(hookCtx *HookContext) error {
 		secCtx := newSecurityContext(hookCtx)
+		if security.IsModelSecurityDisabled(secCtx) {
+			return nil
+		}
 		return security.LoadSecurityRules(secCtx, securityList)
 	})
 
diff --git a/pkg/security/hooks.go b/pkg/security/hooks.go
index 25693fd..fdb7f9e 100644
--- a/pkg/security/hooks.go
+++ b/pkg/security/hooks.go
@@ -254,6 +254,15 @@ func ShouldSkipRowSecurity(secCtx SecurityContext, operation string) bool {
 	return rules.SecurityDisabled || (operation == "read" && rules.CanPublicRead)
 }
 
+// IsModelSecurityDisabled reports whether all model-level security processing
+// is disabled for the model. This is distinct from ShouldSkipRowSecurity:
+// CanPublicRead skips row filtering for reads but must still allow other read
+// security, such as column masking, to be loaded.
+func IsModelSecurityDisabled(secCtx SecurityContext) bool {
+	rules, ok := resolveModelRules(secCtx)
+	return ok && rules.SecurityDisabled
+}
+
 // ApplyColumnSecurity is a public wrapper for applyColumnSecurity that accepts a SecurityContext
 // This allows other packages to apply column-level security using the generic interface
 func ApplyColumnSecurity(secCtx SecurityContext, securityList *SecurityList) error {