code: func validateAuthDB(db *protocol.AuthDB) error {
  	groups := make(map[string]*protocol.AuthGroup, len(db.GetGroups()))
  	for _, g := range db.GetGroups() {
  		groups[g.GetName()] = g
  	}
  	for name := range groups {
  		if err := validateAuthGroup(name, groups); err != nil {
  			return err
  		}
  	}
  	for _, wl := range db.GetIpWhitelists() {
  		if err := validateIPWhitelist(wl); err != nil {
  			return fmt.Errorf("auth: bad IP whitlist %q - %s", wl.GetName(), err)
  		}
  	}
  
  	// Make sure NewSnapshotDB is able to process it as well, since this is where
  	// this proto usually ends up. Note that NewSnapshotDB relies on absence of
  	// cycles in the groups, so the checks above are also important.
  	_, err := authdb.NewSnapshotDB(db, "", 0)
  	return err
  }
docs: // validateAuthDB returns nil if AuthDB looks correct.