fix(station): reject empty-approver quorums and zero-requirement policies

[MRmarioruci]

Problem

Approval quorums can be evaluated or created in ways that bypass the intended approval requirement. Two related issues:

1. Zero-vote auto-approval on empty-approver quorums. RequestApprovalSummary::evaluate clamps the required approvals with cmp::min(min_approved, total_possible_approvers). When a Quorum/QuorumPercentage rule resolves to zero eligible approvers (e.g. the target user group is empty or all members went inactive), the clamp collapses the threshold to 0, and approved (0) >= 0 returns Approved — the request passes with no votes. QuorumPercentage is affected directly too: calculate_minimum_threshold(100%, 0) == 0.

2. Zero-requirement policies are creatable. Quorum(_, 0) and QuorumPercentage(_, 0%) pass validation today, producing a rule that approves with zero votes regardless of the approver set.

Changes

• RequestApprovalSummary::evaluate fails closed (Rejected) when total_possible_approvers == 0, before the cmp::min clamp. This covers both Quorum and QuorumPercentage. evaluate is only reached from those two arms, both of which now always require a positive amount (see below), so an empty approver set can never legitimately be satisfied.
• RequestPolicyRule::validate rejects Quorum(_, 0) and QuorumPercentage(_, 0%) with a new dedicated RequestPolicyRuleValidationError::InvalidRule, guiding users to AutoApproved for no-approval rules.

Note on the fix for (1)

An obvious guard of min_approved > 0 && total_possible_approvers == 0 does not cover QuorumPercentage, whose min_approved computes to 0 over an empty set, so the guard would never fire for it. Keying on total_possible_approvers == 0 alone closes both variants and is safe because evaluate(min_approved) is only ever called from the Quorum and QuorumPercentage evaluation arms.

Tests

New unit tests (full station lib suite passes; cargo fmt/clippy clean):

• positive_quorum_with_no_possible_approvers_is_rejected — direct evaluate guard, including the min_approved == 0 percentage case.
• quorum_with_no_possible_approvers_is_rejected / quorum_percentage_with_no_possible_approvers_is_rejected — end-to-end evaluation via RequestEvaluator with an empty group; both return Rejected.
• quorum_and_percentage_reject_zero_requirement_on_validation — Quorum(_, 0) / QuorumPercentage(_, 0%) rejected; positive variants and AutoApproved accepted.

The existing misconfigured_min_approved_when_not_enough_approvers_should_still_approve test (one active approver, total == 1) is unaffected.

[Copilot]

Pull request overview

This PR hardens Station request-approval policy evaluation and validation to prevent accidental or malicious “no-vote” approvals caused by empty approver sets or zero-requirement quorum rules.

Changes:

• Fail-closed in RequestApprovalSummary::evaluate when there are zero eligible approvers to avoid cmp::min(..., 0) collapsing approval thresholds to 0.
• Reject creation of Quorum(_, 0) and QuorumPercentage(_, 0%) rules during RequestPolicyRule::validate, guiding users to AutoApproved for no-approval workflows.
• Add regression tests covering both the direct evaluation guard and end-to-end evaluation via RequestEvaluator.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
core/station/impl/src/models/request_policy_rule.rs	Adds validation against zero-requirement quorum rules, adds fail-closed evaluation guard for empty approver sets, and adds unit tests.
core/station/impl/src/errors/validation.rs	Introduces RequestPolicyRuleValidationError and wires it into ValidationError display/details/conversions.
core/station/impl/src/errors/request.rs	Propagates the new validation error variant through RequestError conversions.
core/station/impl/src/errors/request_policy.rs	Propagates the new validation error variant through RequestPolicyError conversions.
core/station/impl/src/core/request.rs	Adds end-to-end evaluator tests for empty approver sets in quorum/quorum-percentage rules.

Comments suppressed due to low confidence (1)

core/station/impl/src/models/request_policy_rule.rs:349

• RequestApprovalSummary::evaluate still approves unconditionally when min_approved == 0 (because approved >= 0), which means stations with pre-upgrade persisted Quorum(_, 0) / QuorumPercentage(_, 0%) rules would remain auto-approving even after this change (since evaluation doesn’t re-run validation). Adding a min_approved == 0 fail-closed guard here provides defense-in-depth and closes that backwards-compatibility hole.

        if self.total_possible_approvers == 0 {
            return EvaluationStatus::Rejected;
        }

        let min_approved = cmp::min(min_approved, self.total_possible_approvers);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 50f3ed5.

Security Overview

• 🔎 Scanned files: 5 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/5243341a-e7d7-47de-848a-f52264761c93?scanId=a408fff8-e6dc-4b90-8148-870f01626562&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► core/station/impl/src/core/request.rs     Add tests for quorum with no possible approvers and quorum percentage with no possible approvers
Bug Fix	► core/station/impl/src/errors/request.rs     Add From for RequestError     and propagate into error handling
Bug Fix	► core/station/impl/src/errors/request_policy.rs     Add From for RequestPolicyError     and propagate into error handling
Enhancement	► core/station/impl/src/errors/validation.rs     Include RequestPolicyRuleValidationError in ValidationError enum and conversions     Display/DetailableError support     Add From for ValidationError
Enhancement	► core/station/impl/src/models/request_policy_rule.rs     Import RequestPolicyRuleValidationError and ValidationError; extend validation for Quorum and QuorumPercentage to use RequestPolicyRuleValidationError
Enhancement	► core/station/impl/src/test/mod.rs     Add regression and evaluation tests for zero/invalid quorum scenarios