Function assertOwnerWritable

packages/core/sdk/src/owner-policy.ts:148–175

(
  tableName: string,
  values: Record<string, unknown>,
  context: ExecutorOwnerPolicyContext | undefined,
)

/** Assert a create/upsert writes a row inside the bound partition. */
export const assertOwnerWritable = (
  tableName: string,
  values: Record<string, unknown>,
  context: ExecutorOwnerPolicyContext | undefined,
): void => {
  const ctx = requireContext(tableName, "write", context);
  assertReachReadOnly(tableName, "write", ctx);
  if (values.tenant !== ctx.tenant) {
    policyViolation(`Storage write on table "${tableName}" is outside the executor tenant.`);
  }
  if (values.owner === "org") {
    if (values.subject !== ORG_SUBJECT) {
      policyViolation(`Storage write on table "${tableName}" set a subject on an org row.`);
    }
    return;
  }
  if (values.owner === "user") {
    if (ctx.subject == null || values.subject !== ctx.subject) {
      policyViolation(
        `Storage write on table "${tableName}" targets a user row outside the bound subject.`,
      );
    }
    return;
  }
  policyViolation(
    `Storage write on table "${tableName}" has an invalid owner "${String(values.owner)}".`,
  );
};

/** Assert a patch (`set`) doesn't move a row out of the bound partition. Only
 *  validates the partition columns that are actually being written. */