Fix mock decision context to flatten user attributes

The test context in DecisionFunctionModal nested attributes under an
"attributes" key, but the real proxy flattens them as top-level fields
on ctx.session.user. This caused runtime errors (e.g. "Cannot read
properties of undefined") when testing decision functions that access
custom attributes like ctx.session.user.departments.

Added cross-reference comments in both context.rs and the modal to
prevent future drift between the real and mock context shapes.

Author: jumpbetweenrows

admin-ui/src/components/DecisionFunctionModal.tsx

@@ -348,6 +348,10 @@ export function DecisionFunctionModal({
         }
       }
     }
+    // This mock must mirror the shape built by proxy/src/decision/context.rs
+    // (build_session_context / build_query_context). Keep in sync when the
+    // real context changes — user attributes are flattened onto the user
+    // object, NOT nested under an "attributes" key.
     setTestContextStr(
       JSON.stringify(
         {
@@ -357,7 +361,7 @@ export function DecisionFunctionModal({
               username: currentUser?.username ?? 'testuser',
               tenant: currentUser?.tenant ?? 'default',
               roles: ['analyst'],
-              attributes: testAttrs,
+              ...testAttrs, // flattened — matches build_user_object() in context.rs
             },
             time: { hour: 14, day_of_week: 'Monday' },
             datasource: { name: 'my_ds', access_mode: 'policy_required' },

proxy/src/decision/context.rs

@@ -48,6 +48,8 @@ pub struct QueryMetadata {
 /// - `admin-ui/src/pages/UserEditPage.tsx` — attributes section hint text
 /// - `docs/permission-system.md` — Decision Functions → Context modes
 /// - `proxy/src/admin/dto.rs` — `EXTRA_RESERVED_USER_KEYS` if adding a virtual field
+/// - `admin-ui/src/components/DecisionFunctionModal.tsx` — mock test context
+///   (search for "context.rs" — the mock must mirror this shape exactly)
 /// - Any CodeMirror editor in `admin-ui/` that references `ctx.session.user.*` in
 ///   autocomplete, placeholders, hints, or templates
 fn build_user_object(session: &SessionInfo) -> serde_json::Value {