( name: string, columns: TColumns, uniqueKey: readonly string[], )
| 54 | |
| 55 | /** A tenant-shared table (catalog / blobs) — partitioned only by `tenant`. */ |
| 56 | const tenantExecutorTable = <const TColumns extends UserColumns>( |
| 57 | name: string, |
| 58 | columns: TColumns, |
| 59 | uniqueKey: readonly string[], |
| 60 | ) => { |
| 61 | const out = table(name, { |
| 62 | ...columns, |
| 63 | row_id: idColumn("row_id", "varchar(255)").defaultTo$("auto"), |
| 64 | tenant: keyColumn("tenant"), |
| 65 | }); |
| 66 | out.unique(`${name}_uidx`, [...uniqueKey]); |
| 67 | return out.policy<ExecutorOwnerPolicyContext>({ |
| 68 | name: executorTenantPolicyName, |
| 69 | onRead: ({ builder, context }) => builder("tenant", "=", context.tenant), |
| 70 | onCreate: ({ values, context }) => { |
| 71 | // Tenant-scoped reads are already tenant-wide, so reach doesn't widen |
| 72 | // them — but the platform view must stay read-only on EVERY table it can |
| 73 | // reach, and `subject` is one of these. |
| 74 | assertReachReadOnly(name, "write", context); |
| 75 | if (values.tenant !== context.tenant) { |
| 76 | // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: FumaDB table policy callbacks are promise callbacks, not Effect effects |
| 77 | throw new StorageError({ |
| 78 | message: `Storage write on table "${name}" is outside the executor tenant.`, |
| 79 | cause: undefined, |
| 80 | }); |
| 81 | } |
| 82 | }, |
| 83 | onUpdate: ({ builder, context }) => { |
| 84 | assertReachReadOnly(name, "write", context); |
| 85 | return builder("tenant", "=", context.tenant); |
| 86 | }, |
| 87 | onDelete: ({ builder, context }) => { |
| 88 | assertReachReadOnly(name, "delete", context); |
| 89 | return builder("tenant", "=", context.tenant); |
| 90 | }, |
| 91 | }); |
| 92 | }; |
| 93 | |
| 94 | /** An owner-scoped table — partitioned by `(tenant, owner, subject)`, guarded by |
| 95 | * the executor owner policy. `uniqueKey` must include those three columns. */ |
no test coverage detected