Function newReservedPredicateGuard

edgraph/server.go:2291–2309

newReservedPredicateGuard builds the per-request reserved-value guard. The GraphQL admin path (IsGraphql) owns the dgraph.graphql.* predicates. A registered ReservedNamespace may additionally value-lock predicates to its own trusted writer (see x.RegisterReservedNamespace): such a predicate may be w

(ctx context.Context)

// written only when the request context carries the namespace's TrustMarker.
// Every other caller is blocked.
func newReservedPredicateGuard(ctx context.Context) reservedPredicateGuard {
	isGraphql, _ := ctx.Value(IsGraphql).(bool)
	return func(nq *api.NQuad) error {
		if !isGraphql && x.IsOtherReservedPredicate(nq.Predicate) {
			return errors.Errorf("Cannot mutate graphql reserved predicate %s", nq.Predicate)
		}
		if marker, locked := x.ReservedPredicateValueLock(nq.Predicate); locked {
			trusted := false
			if marker != nil {
				trusted, _ = ctx.Value(marker).(bool)
			}
			if !trusted {
				return errors.Errorf("Cannot mutate reserved predicate %s outside its "+
					"owning service", nq.Predicate)
			}
		}
		return nil
	}
}

func validateNQuads(set, del []*api.NQuad, guardReserved reservedPredicateGuard) error {
	for _, nq := range set {