( builder: AnyConditionBuilder, context: ExecutorOwnerPolicyContext, )
| 95 | * but the write assertions below reject a tenant-reach context outright, so a |
| 96 | * widened context can never be the one doing the mutating. */ |
| 97 | export const ownerVisibilityCondition = ( |
| 98 | builder: AnyConditionBuilder, |
| 99 | context: ExecutorOwnerPolicyContext, |
| 100 | ): Condition | boolean => { |
| 101 | // The platform view: partition by tenant alone. Still never cross-tenant — |
| 102 | // `tenant` is the one clause that is NEVER relaxed, at any reach. |
| 103 | if (context.reach === "tenant") return builder("tenant", "=", context.tenant); |
| 104 | const orgClause = builder.and( |
| 105 | builder("tenant", "=", context.tenant), |
| 106 | builder("owner", "=", "org"), |
| 107 | ); |
| 108 | if (context.subject == null) return orgClause; |
| 109 | const userClause = builder.and( |
| 110 | builder("tenant", "=", context.tenant), |
| 111 | builder("owner", "=", "user"), |
| 112 | builder("subject", "=", context.subject), |
| 113 | ); |
| 114 | return builder.or(orgClause, userClause); |
| 115 | }; |
| 116 | |
| 117 | /** |
| 118 | * THE security property of the platform view: it never mutates. Two contexts |
no test coverage detected