( builder: AnyConditionBuilder, context: ExecutorOwnerPolicyContext, )
| 53 | /** The rows the bound `{ tenant, subject }` may see/mutate: org rows in the |
| 54 | * tenant, plus this subject's own user rows. */ |
| 55 | export const ownerVisibilityCondition = ( |
| 56 | builder: AnyConditionBuilder, |
| 57 | context: ExecutorOwnerPolicyContext, |
| 58 | ): Condition | boolean => { |
| 59 | const orgClause = builder.and( |
| 60 | builder("tenant", "=", context.tenant), |
| 61 | builder("owner", "=", "org"), |
| 62 | ); |
| 63 | if (context.subject == null) return orgClause; |
| 64 | const userClause = builder.and( |
| 65 | builder("tenant", "=", context.tenant), |
| 66 | builder("owner", "=", "user"), |
| 67 | builder("subject", "=", context.subject), |
| 68 | ); |
| 69 | return builder.or(orgClause, userClause); |
| 70 | }; |
| 71 | |
| 72 | /** Assert a create/upsert writes a row inside the bound partition. */ |
| 73 | export const assertOwnerWritable = ( |
no test coverage detected