( tableName: string, patch: Record<string, unknown> | undefined, context: ExecutorOwnerPolicyContext | undefined, )
| 101 | /** Assert a patch (`set`) doesn't move a row out of the bound partition. Only |
| 102 | * validates the partition columns that are actually being written. */ |
| 103 | export const assertOwnerPatch = ( |
| 104 | tableName: string, |
| 105 | patch: Record<string, unknown> | undefined, |
| 106 | context: ExecutorOwnerPolicyContext | undefined, |
| 107 | ): void => { |
| 108 | const ctx = requireContext(tableName, "write", context); |
| 109 | if (!patch) return; |
| 110 | if (patch.tenant !== undefined && patch.tenant !== ctx.tenant) { |
| 111 | policyViolation(`Storage write on table "${tableName}" cannot move a row across tenants.`); |
| 112 | } |
| 113 | if (patch.owner === "user" && (ctx.subject == null || patch.subject !== ctx.subject)) { |
| 114 | policyViolation( |
| 115 | `Storage write on table "${tableName}" cannot move a row outside the bound subject.`, |
| 116 | ); |
| 117 | } |
| 118 | }; |
| 119 | |
| 120 | export const hasExecutorOwnerPolicy = (table: AnyTable): boolean => |
| 121 | table.policies.some((policy) => policy.name === executorOwnerPolicyName); |
no test coverage detected