use std::collections::{BTreeMap, BTreeSet};
use serde::de::{self, Deserializer, MapAccess, SeqAccess, Visitor};
use serde::{Deserialize, Serialize};
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(tag = "kind", rename_all = "snake_case")]
#[derive(Default)]
pub enum TenantSource {
Token {
#[serde(default = "default_tid_claim")]
claim: String,
#[serde(default, skip_serializing_if = "Option::is_none")]
extract: Option<ClaimExtract>,
#[serde(default, skip_serializing_if = "Option::is_none")]
namespace: Option<String>,
},
Domain,
SignedContext,
#[default]
None,
}
fn default_tid_claim() -> String {
"tid".to_string()
}
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum ExtractSyntax {
Template,
Regex,
}
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct ClaimExtract {
pub syntax: ExtractSyntax,
pub pattern: String,
}
fn default_sources() -> Vec<TenantSource> {
vec![TenantSource::None]
}
fn de_sources<'de, D>(deserializer: D) -> Result<Vec<TenantSource>, D::Error>
where
D: Deserializer<'de>,
{
struct SourcesVisitor;
impl<'de> Visitor<'de> for SourcesVisitor {
type Value = Vec<TenantSource>;
fn expecting(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
f.write_str("a TenantSource map or a list of TenantSource maps")
}
fn visit_seq<A: SeqAccess<'de>>(self, mut seq: A) -> Result<Self::Value, A::Error> {
let mut out = Vec::new();
while let Some(s) = seq.next_element::<TenantSource>()? {
out.push(s);
}
Ok(out)
}
fn visit_map<A: MapAccess<'de>>(self, map: A) -> Result<Self::Value, A::Error> {
let s = TenantSource::deserialize(de::value::MapAccessDeserializer::new(map))?;
Ok(vec![s])
}
}
deserializer.deserialize_any(SourcesVisitor)
}
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
#[non_exhaustive]
pub enum TargetSource {
Domain,
Handle,
Capability,
}
#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, Default)]
#[serde(tag = "scope", rename_all = "snake_case")]
#[non_exhaustive]
pub enum TenancyClass {
#[default]
Own,
Target {
via: Vec<TargetSource>,
public: String,
#[serde(default)]
write: Vec<String>,
#[serde(default)]
null_base: bool,
},
}
impl TenancyClass {
pub fn is_target(&self) -> bool {
matches!(self, Self::Target { .. })
}
}
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(tag = "kind", rename_all = "snake_case")]
pub enum PublicTerm {
Cmp {
column: String,
op: PublicCmp,
value: PublicLiteral,
},
Null { column: String, negated: bool },
}
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum PublicCmp {
Eq,
Ne,
Lt,
Le,
Gt,
Ge,
}
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum PublicLiteral {
Bool(bool),
Int(i64),
Text(String),
}
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)]
pub struct PublicPredicate {
pub terms: Vec<PublicTerm>,
}
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)]
#[serde(default, deny_unknown_fields)]
pub struct PublicSubset {
pub predicate: PublicPredicate,
pub world_public: bool,
pub listable: bool,
}
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
#[non_exhaustive]
pub enum ScopeAxis {
Tenant,
Session,
TargetTenant,
}
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum AccessMode {
None,
Null,
Own,
OwnOrNull,
All,
}
impl AccessMode {
pub fn is_cross_tenant(self) -> bool {
matches!(self, Self::All)
}
pub fn needs_own_value(self) -> bool {
matches!(self, Self::Own | Self::OwnOrNull)
}
pub fn within(self, ceiling: Self) -> bool {
use AccessMode::*;
match self {
None => true, Null => matches!(ceiling, Null | OwnOrNull | All),
Own => matches!(ceiling, Own | OwnOrNull | All),
OwnOrNull => matches!(ceiling, OwnOrNull | All),
All => matches!(ceiling, All),
}
}
}
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize, Default)]
#[serde(rename_all = "snake_case")]
pub enum PrincipalKind {
#[default]
Tenant,
System,
}
impl PrincipalKind {
pub fn is_system(self) -> bool {
matches!(self, Self::System)
}
}
fn default_own() -> AccessMode {
AccessMode::Own
}
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
#[serde(rename_all = "snake_case")]
pub enum OnUnresolved {
#[default]
Deny,
Pass,
}
impl OnUnresolved {
pub fn is_deny(&self) -> bool {
matches!(self, Self::Deny)
}
pub fn is_pass(&self) -> bool {
matches!(self, Self::Pass)
}
}
pub fn de_opt_tenancy<'de, D>(deserializer: D) -> Result<Option<Tenancy>, D::Error>
where
D: serde::Deserializer<'de>,
{
use serde::Deserialize;
match Option::<ron::Value>::deserialize(deserializer)? {
Some(value) => value
.into_rust::<Tenancy>()
.map(Some)
.map_err(serde::de::Error::custom),
None => Ok(None),
}
}
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(tag = "mode", rename_all = "snake_case")]
pub enum Tenancy {
Disabled,
Scoped {
column: String,
#[serde(
default = "default_sources",
alias = "source",
deserialize_with = "de_sources"
)]
sources: Vec<TenantSource>,
#[serde(default = "default_own")]
read: AccessMode,
#[serde(default = "default_own")]
write: AccessMode,
#[serde(default, skip_serializing_if = "std::ops::Not::not")]
exceed_site_ceiling: bool,
#[serde(default, skip_serializing_if = "Vec::is_empty")]
unscoped_writes: Vec<String>,
#[serde(default, skip_serializing_if = "OnUnresolved::is_deny")]
on_unresolved: OnUnresolved,
},
Target {
via: Vec<TargetSource>,
public: String,
#[serde(default, skip_serializing_if = "Vec::is_empty")]
write: Vec<String>,
#[serde(default, skip_serializing_if = "std::ops::Not::not")]
null_base: bool,
},
}
impl Tenancy {
pub fn is_scoped(&self) -> bool {
matches!(self, Self::Scoped { .. } | Self::Target { .. })
}
pub fn is_target(&self) -> bool {
matches!(self, Self::Target { .. })
}
pub fn unscoped_writes(&self) -> &[String] {
match self {
Self::Scoped {
unscoped_writes, ..
} => unscoped_writes,
Self::Disabled | Self::Target { .. } => &[],
}
}
pub fn on_unresolved(&self) -> OnUnresolved {
match self {
Self::Scoped { on_unresolved, .. } => *on_unresolved,
Self::Disabled | Self::Target { .. } => OnUnresolved::Deny,
}
}
pub fn declares_signed_context(&self) -> bool {
matches!(self, Self::Scoped { sources, .. } if sources.contains(&TenantSource::SignedContext))
}
pub fn narrows_within(&self, ceiling: &Self) -> bool {
use Tenancy::*;
match (self, ceiling) {
(_, Disabled) => true,
(Disabled, _) => false,
(
Scoped {
column: c,
read: r,
write: w,
..
},
Scoped {
column: cc,
read: rc,
write: wc,
..
},
) => c == cc && r.within(*rc) && w.within(*wc),
(Target { .. }, Target { .. }) => true,
_ => false,
}
}
pub fn narrows_within_authorized(&self, ceiling: &Self, site_allows_exceptions: bool) -> bool {
use Tenancy::*;
if self.narrows_within(ceiling) {
return true;
}
matches!(
(self, ceiling),
(
Scoped { exceed_site_ceiling: true, column: c, .. },
Scoped { column: cc, .. },
) if site_allows_exceptions && c == cc
)
}
}
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(tag = "kind", rename_all = "snake_case")]
#[non_exhaustive]
pub enum TableScope {
Tenant,
TenantKeyed { key: String },
Owned { column: String },
Unscoped {
#[serde(default, skip_serializing_if = "std::ops::Not::not")]
writable: bool,
},
TenantOrSession,
TenantOrBase,
}
#[cfg(all(feature = "owned-gate-mutation", not(test), not(debug_assertions)))]
compile_error!(
"owned-gate-mutation is a test-only anti-hollow seam and must never be compiled into a release \
build — remove it from the feature set"
);
#[cfg(any(test, feature = "owned-gate-mutation"))]
fn owned_mutation() -> Option<String> {
std::env::var("BOATRAMP_OWNED_MUTATION").ok()
}
#[cfg(not(any(test, feature = "owned-gate-mutation")))]
#[inline]
fn owned_mutation() -> Option<String> {
None
}
fn owned_scope(default_tenant_key: &str, column: &str) -> ResolvedScope {
match owned_mutation().as_deref() {
Some("wrong_column") => ResolvedScope::Column(default_tenant_key.to_string()),
Some("unscoped") => ResolvedScope::Unscoped,
_ => ResolvedScope::Column(column.to_string()),
}
}
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum ResolvedScope {
Column(String),
Unscoped,
SharedWritable,
TenantOrSession {
tenant: String,
session: String,
},
TenantOrBase {
tenant: String,
},
}
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(default, deny_unknown_fields)]
pub struct TenancySchema {
pub default_tenant_key: String,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub session_key: Option<String>,
pub tables: BTreeMap<String, TableScope>,
#[serde(default, skip_serializing_if = "BTreeSet::is_empty")]
pub target_eligible_fields: BTreeSet<String>,
#[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
pub public_subsets: BTreeMap<String, PublicSubset>,
#[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
pub handles: BTreeMap<String, String>,
}
impl Default for TenancySchema {
fn default() -> Self {
Self {
default_tenant_key: "tenant_id".to_string(),
session_key: None,
tables: BTreeMap::new(),
target_eligible_fields: BTreeSet::new(),
public_subsets: BTreeMap::new(),
handles: BTreeMap::new(),
}
}
}
impl TenancySchema {
pub fn deny_all() -> Self {
Self {
default_tenant_key: "tenant_id".to_string(),
session_key: None,
tables: BTreeMap::new(),
target_eligible_fields: BTreeSet::new(),
public_subsets: BTreeMap::new(),
handles: BTreeMap::new(),
}
}
pub fn target_field_eligible(&self, field: &str) -> bool {
self.target_eligible_fields.contains(field)
}
pub fn subset_is_world_public(&self, subset: &str) -> bool {
self.public_subsets
.get(subset)
.is_some_and(|s| s.world_public)
}
pub fn resolve_handle(&self, slug: &str) -> Option<&str> {
self.handles.get(slug).map(String::as_str)
}
pub fn public_subset(&self, table: &str) -> Option<&PublicSubset> {
self.public_subsets.get(table)
}
pub fn validate(&self) -> Result<(), String> {
for (table, subset) in &self.public_subsets {
if subset.predicate.terms.is_empty() {
return Err(format!(
"public subset for table `{table}` has an empty predicate (would match every \
row, defeating the target-read confinement) — declare at least one visibility \
term (e.g. `published = true`)"
));
}
}
Ok(())
}
pub fn resolve(&self, table: &str) -> Option<ResolvedScope> {
match self.tables.get(table)? {
TableScope::Tenant => Some(ResolvedScope::Column(self.default_tenant_key.clone())),
TableScope::TenantKeyed { key } => Some(ResolvedScope::Column(key.clone())),
TableScope::Owned { column } => Some(owned_scope(&self.default_tenant_key, column)),
TableScope::Unscoped { writable: true } => Some(ResolvedScope::SharedWritable),
TableScope::Unscoped { writable: false } => Some(ResolvedScope::Unscoped),
TableScope::TenantOrSession => Some(ResolvedScope::TenantOrSession {
tenant: self.default_tenant_key.clone(),
session: self.session_key.clone()?,
}),
TableScope::TenantOrBase => Some(ResolvedScope::TenantOrBase {
tenant: self.default_tenant_key.clone(),
}),
}
}
pub fn table_key_map(&self) -> BTreeMap<String, ResolvedScope> {
self.tables
.iter()
.filter_map(|(table, scope)| {
let resolved = match scope {
TableScope::Tenant => ResolvedScope::Column(self.default_tenant_key.clone()),
TableScope::TenantKeyed { key } => ResolvedScope::Column(key.clone()),
TableScope::Owned { column } => owned_scope(&self.default_tenant_key, column),
TableScope::Unscoped { writable: true } => ResolvedScope::SharedWritable,
TableScope::Unscoped { writable: false } => ResolvedScope::Unscoped,
TableScope::TenantOrSession => ResolvedScope::TenantOrSession {
tenant: self.default_tenant_key.clone(),
session: self.session_key.clone()?, },
TableScope::TenantOrBase => ResolvedScope::TenantOrBase {
tenant: self.default_tenant_key.clone(),
},
};
Some((table.clone(), resolved))
})
.collect()
}
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn schema_resolves_per_table_key_and_denies_undeclared() {
let schema: TenancySchema = serde_json::from_str(
r#"{"default_tenant_key":"tenant_id","tables":{
"orders":{"kind":"tenant"},
"tenant":{"kind":"tenant_keyed","key":"id"},
"countries":{"kind":"unscoped"}}}"#,
)
.unwrap();
assert_eq!(
schema.resolve("orders"),
Some(ResolvedScope::Column("tenant_id".into()))
);
assert_eq!(
schema.resolve("tenant"),
Some(ResolvedScope::Column("id".into())) );
assert_eq!(schema.resolve("countries"), Some(ResolvedScope::Unscoped));
assert_eq!(schema.resolve("secrets_table"), None); }
#[test]
fn unscoped_writable_flag_round_trips_and_resolves_distinctly() {
let legacy: TableScope = serde_json::from_str(r#"{"kind":"unscoped"}"#).unwrap();
assert_eq!(legacy, TableScope::Unscoped { writable: false });
assert_eq!(
serde_json::to_string(&legacy).unwrap(),
r#"{"kind":"unscoped"}"#
);
let explicit_false: TableScope =
serde_json::from_str(r#"{"kind":"unscoped","writable":false}"#).unwrap();
assert_eq!(explicit_false, TableScope::Unscoped { writable: false });
let writable: TableScope =
serde_json::from_str(r#"{"kind":"unscoped","writable":true}"#).unwrap();
assert_eq!(writable, TableScope::Unscoped { writable: true });
assert_eq!(
serde_json::to_string(&writable).unwrap(),
r#"{"kind":"unscoped","writable":true}"#
);
let schema: TenancySchema = serde_json::from_str(
r#"{"default_tenant_key":"tenant_id","tables":{
"countries":{"kind":"unscoped"},
"oauth_state":{"kind":"unscoped","writable":true}}}"#,
)
.unwrap();
assert_eq!(schema.resolve("countries"), Some(ResolvedScope::Unscoped));
assert_eq!(
schema.resolve("oauth_state"),
Some(ResolvedScope::SharedWritable)
);
assert_eq!(
schema.table_key_map().get("countries"),
Some(&ResolvedScope::Unscoped)
);
assert_eq!(
schema.table_key_map().get("oauth_state"),
Some(&ResolvedScope::SharedWritable)
);
}
#[test]
fn tenant_or_base_resolves_to_the_default_tenant_key_and_round_trips_json() {
let schema: TenancySchema = serde_json::from_str(
r#"{"default_tenant_key":"tenant_id","tables":{"pack":{"kind":"tenant_or_base"}}}"#,
)
.unwrap();
assert_eq!(schema.tables.get("pack"), Some(&TableScope::TenantOrBase));
assert_eq!(
schema.resolve("pack"),
Some(ResolvedScope::TenantOrBase {
tenant: "tenant_id".into()
})
);
assert_eq!(
schema.table_key_map().get("pack"),
Some(&ResolvedScope::TenantOrBase {
tenant: "tenant_id".into()
})
);
assert!(
serde_json::to_string(&TableScope::TenantOrBase)
.unwrap()
.contains("tenant_or_base")
);
}
#[test]
fn schema_default_is_tenant_id_no_tables() {
let s = TenancySchema::default();
assert_eq!(s.default_tenant_key, "tenant_id");
assert!(s.tables.is_empty());
assert_eq!(s.resolve("orders"), None);
}
#[test]
fn table_scope_roundtrips_through_json() {
for ts in [
TableScope::Tenant,
TableScope::TenantKeyed { key: "id".into() },
TableScope::Owned {
column: "owner_user_id".into(),
},
TableScope::Unscoped { writable: false },
TableScope::Unscoped { writable: true },
TableScope::TenantOrSession,
TableScope::TenantOrBase,
] {
let j = serde_json::to_string(&ts).unwrap();
assert_eq!(ts, serde_json::from_str::<TableScope>(&j).unwrap());
}
}
#[test]
fn owned_scope_lowers_to_its_column_not_the_default_tenant_key() {
let s = TenancySchema {
default_tenant_key: "tenant_id".into(),
tables: BTreeMap::from([(
"docs".into(),
TableScope::Owned {
column: "owner_user_id".into(),
},
)]),
..Default::default()
};
let col = ResolvedScope::Column("owner_user_id".into());
assert_eq!(s.resolve("docs"), Some(col.clone()));
assert_eq!(s.table_key_map().get("docs"), Some(&col));
assert_eq!(
serde_json::to_string(&TableScope::Owned {
column: "owner_user_id".into()
})
.unwrap(),
r#"{"kind":"owned","column":"owner_user_id"}"#
);
}
#[test]
fn tenant_or_session_needs_a_session_key_else_denies() {
let s = TenancySchema {
default_tenant_key: "tenant_id".into(),
session_key: Some("session_id".into()),
tables: BTreeMap::from([("carts".into(), TableScope::TenantOrSession)]),
..Default::default()
};
assert_eq!(
s.resolve("carts"),
Some(ResolvedScope::TenantOrSession {
tenant: "tenant_id".into(),
session: "session_id".into(),
})
);
let s = TenancySchema {
default_tenant_key: "tenant_id".into(),
session_key: None,
tables: BTreeMap::from([("carts".into(), TableScope::TenantOrSession)]),
..Default::default()
};
assert_eq!(s.resolve("carts"), None);
assert!(
!s.table_key_map().contains_key("carts"),
"a TenantOrSession table without a session_key must be omitted (denied), not scoped"
);
}
#[test]
fn scoped_defaults_are_own_own_none_source() {
let t: Tenancy = serde_json::from_str(r#"{"mode":"scoped","column":"tenant_id"}"#).unwrap();
assert_eq!(
t,
Tenancy::Scoped {
column: "tenant_id".into(),
sources: vec![TenantSource::None],
read: AccessMode::Own,
write: AccessMode::Own,
exceed_site_ceiling: false,
unscoped_writes: Vec::new(),
on_unresolved: OnUnresolved::Deny,
}
);
let out = serde_json::to_string(&t).unwrap();
assert!(
!out.contains("unscoped_writes"),
"empty unscoped_writes must elide (got {out})"
);
let listed: Tenancy = serde_json::from_str(
r#"{"mode":"scoped","column":"tenant_id","unscoped_writes":["oauth_state"]}"#,
)
.unwrap();
assert_eq!(listed.unscoped_writes(), &["oauth_state".to_string()]);
assert_eq!(
listed,
serde_json::from_str::<Tenancy>(&serde_json::to_string(&listed).unwrap()).unwrap()
);
assert!(Tenancy::Disabled.unscoped_writes().is_empty());
assert!(t.is_scoped());
}
#[test]
fn sources_accept_both_the_legacy_singular_and_the_stage2_list() {
let legacy: Tenancy = serde_json::from_str(
r#"{"mode":"scoped","column":"tenant_id","source":{"kind":"domain"}}"#,
)
.unwrap();
let Tenancy::Scoped { sources, .. } = &legacy else {
panic!("scoped")
};
assert_eq!(sources, &vec![TenantSource::Domain]);
let listed: Tenancy = serde_json::from_str(
r#"{"mode":"scoped","column":"tenant_id","sources":[{"kind":"token"},{"kind":"domain"}]}"#,
)
.unwrap();
let Tenancy::Scoped { sources, .. } = &listed else {
panic!("scoped")
};
assert_eq!(
sources,
&vec![
TenantSource::Token {
claim: "tid".into(),
extract: None,
namespace: None,
},
TenantSource::Domain
]
);
}
#[test]
fn on_unresolved_defaults_to_deny_elides_and_round_trips_pass() {
let default: Tenancy = serde_json::from_str(
r#"{"mode":"scoped","column":"tenant_id","sources":[{"kind":"domain"}]}"#,
)
.unwrap();
assert_eq!(default.on_unresolved(), OnUnresolved::Deny);
let out = serde_json::to_string(&default).unwrap();
assert!(
!out.contains("on_unresolved"),
"a Deny (default) on_unresolved must elide on serialize (got {out})"
);
let pass: Tenancy = serde_json::from_str(
r#"{"mode":"scoped","column":"tenant_id","sources":[{"kind":"domain"}],"read":"own","write":"none","on_unresolved":"pass"}"#,
)
.unwrap();
assert_eq!(pass.on_unresolved(), OnUnresolved::Pass);
let out = serde_json::to_string(&pass).unwrap();
assert!(
out.contains(r#""on_unresolved":"pass""#),
"pass must serialize (got {out})"
);
assert_eq!(
pass,
serde_json::from_str::<Tenancy>(&serde_json::to_string(&pass).unwrap()).unwrap(),
"on_unresolved: pass must round-trip through JSON"
);
let explicit_deny: Tenancy = serde_json::from_str(
r#"{"mode":"scoped","column":"tenant_id","sources":[{"kind":"domain"}],"on_unresolved":"deny"}"#,
)
.unwrap();
assert_eq!(explicit_deny.on_unresolved(), OnUnresolved::Deny);
assert_eq!(explicit_deny, default);
use serde::Deserialize;
#[derive(Debug, Deserialize)]
struct W {
#[serde(default, deserialize_with = "de_opt_tenancy")]
tenancy: Option<Tenancy>,
}
let ron_opts = ron::Options::default()
.with_default_extension(ron::extensions::Extensions::IMPLICIT_SOME);
let ron_pass: W = ron_opts
.from_str(
r#"(tenancy: (mode: "scoped", column: "tenant_id", sources: [(kind: "domain")],
read: "own", write: "none", on_unresolved: "pass"))"#,
)
.expect("on_unresolved: pass parses from RON via the bridge");
assert_eq!(
ron_pass.tenancy.unwrap().on_unresolved(),
OnUnresolved::Pass
);
let ron_default: W = ron_opts
.from_str(
r#"(tenancy: (mode: "scoped", column: "tenant_id", sources: [(kind: "domain")]))"#,
)
.expect("a RON config with no on_unresolved parses (defaults to Deny)");
assert_eq!(
ron_default.tenancy.unwrap().on_unresolved(),
OnUnresolved::Deny
);
assert_eq!(Tenancy::Disabled.on_unresolved(), OnUnresolved::Deny);
}
#[test]
fn disabled_is_an_explicit_decision() {
let t: Tenancy = serde_json::from_str(r#"{"mode":"disabled"}"#).unwrap();
assert_eq!(t, Tenancy::Disabled);
assert!(!t.is_scoped());
}
#[test]
fn token_source_defaults_the_claim_to_tid() {
let t: Tenancy = serde_json::from_str(
r#"{"mode":"scoped","column":"tenant_id","source":{"kind":"token"},"read":"own_or_null","write":"own"}"#,
)
.unwrap();
let Tenancy::Scoped { sources, read, .. } = t else {
panic!("scoped")
};
assert_eq!(
sources,
vec![TenantSource::Token {
claim: "tid".into(),
extract: None,
namespace: None,
}]
);
assert_eq!(read, AccessMode::OwnOrNull);
}
#[test]
fn access_mode_cross_tenant_and_own_value_flags() {
assert!(AccessMode::All.is_cross_tenant());
assert!(!AccessMode::Own.is_cross_tenant());
assert!(AccessMode::Own.needs_own_value());
assert!(AccessMode::OwnOrNull.needs_own_value());
assert!(!AccessMode::Null.needs_own_value());
assert!(!AccessMode::All.needs_own_value());
assert!(!AccessMode::None.needs_own_value());
}
#[test]
fn roundtrips_through_json() {
let t = Tenancy::Scoped {
column: "org_id".into(),
sources: vec![TenantSource::Domain],
read: AccessMode::OwnOrNull,
write: AccessMode::Own,
exceed_site_ceiling: false,
unscoped_writes: Vec::new(),
on_unresolved: OnUnresolved::Deny,
};
let s = serde_json::to_string(&t).unwrap();
assert_eq!(t, serde_json::from_str::<Tenancy>(&s).unwrap());
}
#[test]
fn tenancy_class_default_is_own_and_target_flag() {
assert_eq!(TenancyClass::default(), TenancyClass::Own);
assert!(!TenancyClass::Own.is_target());
let tgt = TenancyClass::Target {
via: vec![TargetSource::Domain, TargetSource::Handle],
public: "storefront".into(),
write: vec![],
null_base: false,
};
assert!(tgt.is_target());
assert_eq!(
tgt,
serde_json::from_str(&serde_json::to_string(&tgt).unwrap()).unwrap()
);
}
#[test]
fn target_schema_facts_roundtrip_and_gate_deny_by_default() {
let mut schema = TenancySchema {
default_tenant_key: "tenant_id".into(),
tables: BTreeMap::from([("products".into(), TableScope::Tenant)]),
..Default::default()
};
schema
.target_eligible_fields
.insert("publicProducts".into());
schema.public_subsets.insert(
"products".into(),
PublicSubset {
predicate: PublicPredicate {
terms: vec![
PublicTerm::Cmp {
column: "published".into(),
op: PublicCmp::Eq,
value: PublicLiteral::Bool(true),
},
PublicTerm::Null {
column: "deleted_at".into(),
negated: false,
},
],
},
world_public: true,
listable: true,
},
);
assert!(schema.target_field_eligible("publicProducts"));
assert!(!schema.target_field_eligible("secretOrders"));
assert!(schema.public_subset("products").unwrap().world_public);
assert!(schema.public_subset("orders").is_none());
let s = serde_json::to_string(&schema).unwrap();
assert_eq!(schema, serde_json::from_str::<TenancySchema>(&s).unwrap());
}
#[test]
fn validate_rejects_an_empty_public_predicate() {
let mut schema = TenancySchema::default();
schema.public_subsets.insert(
"products".into(),
PublicSubset {
predicate: PublicPredicate {
terms: vec![PublicTerm::Cmp {
column: "published".into(),
op: PublicCmp::Eq,
value: PublicLiteral::Bool(true),
}],
},
world_public: true,
listable: true,
},
);
assert!(schema.validate().is_ok());
schema.public_subsets.insert(
"orders".into(),
PublicSubset {
predicate: PublicPredicate { terms: vec![] },
world_public: true,
listable: false,
},
);
let err = schema.validate().unwrap_err();
assert!(
err.contains("orders") && err.contains("empty predicate"),
"got: {err}"
);
}
#[test]
fn a_pre_stage5_schema_deserializes_with_empty_target_facts() {
let legacy = r#"{"default_tenant_key":"tenant_id","tables":{"notes":{"kind":"tenant"}}}"#;
let schema: TenancySchema = serde_json::from_str(legacy).unwrap();
assert!(schema.target_eligible_fields.is_empty());
assert!(schema.public_subsets.is_empty());
assert!(!schema.target_field_eligible("anything"));
}
#[test]
fn access_mode_subset_lattice() {
use AccessMode::*;
for c in [None, Null, Own, OwnOrNull, All] {
assert!(None.within(c));
}
assert!(!Own.within(Null));
assert!(!Null.within(Own));
assert!(Own.within(Own) && Own.within(OwnOrNull) && Own.within(All));
assert!(Null.within(Null) && Null.within(OwnOrNull) && Null.within(All));
assert!(OwnOrNull.within(OwnOrNull) && OwnOrNull.within(All));
assert!(!OwnOrNull.within(Own) && !OwnOrNull.within(Null));
assert!(All.within(All));
assert!(!All.within(OwnOrNull) && !All.within(Own));
}
fn scoped(read: AccessMode, write: AccessMode) -> Tenancy {
Tenancy::Scoped {
column: "tenant_id".into(),
sources: vec![TenantSource::Token {
claim: "tid".into(),
extract: None,
namespace: None,
}],
read,
write,
exceed_site_ceiling: false,
unscoped_writes: Vec::new(),
on_unresolved: OnUnresolved::Deny,
}
}
fn scoped_exceeding(read: AccessMode, write: AccessMode) -> Tenancy {
match scoped(read, write) {
Tenancy::Scoped {
column,
sources,
read,
write,
..
} => Tenancy::Scoped {
column,
sources,
read,
write,
exceed_site_ceiling: true,
unscoped_writes: Vec::new(),
on_unresolved: OnUnresolved::Deny,
},
_ => unreachable!(),
}
}
#[test]
fn tenancy_narrows_within_ceiling() {
use AccessMode::*;
assert!(scoped(Own, Own).narrows_within(&scoped(All, All)));
assert!(scoped(All, Own).narrows_within(&scoped(All, All)));
assert!(scoped(All, All).narrows_within(&scoped(All, All)));
assert!(!scoped(All, Own).narrows_within(&scoped(Own, Own)));
assert!(!scoped(Own, All).narrows_within(&scoped(Own, Own)));
assert!(
!Tenancy::Scoped {
column: "org_id".into(),
sources: vec![TenantSource::None],
read: Own,
write: Own,
exceed_site_ceiling: false,
unscoped_writes: Vec::new(),
on_unresolved: OnUnresolved::Deny,
}
.narrows_within(&scoped(All, All))
);
}
#[test]
fn tenancy_authorized_ceiling_exception() {
use AccessMode::*;
let ceiling = scoped(Own, Own);
assert!(!scoped(All, All).narrows_within_authorized(&ceiling, true));
assert!(!scoped(All, All).narrows_within_authorized(&ceiling, false));
assert!(!scoped_exceeding(All, All).narrows_within_authorized(&ceiling, false));
assert!(scoped_exceeding(All, All).narrows_within_authorized(&ceiling, true));
assert!(scoped_exceeding(All, Own).narrows_within_authorized(&ceiling, true));
assert!(scoped(Own, Own).narrows_within_authorized(&ceiling, true));
assert!(scoped_exceeding(Own, Own).narrows_within_authorized(&ceiling, true));
let other_col = match scoped_exceeding(All, All) {
Tenancy::Scoped {
sources,
read,
write,
exceed_site_ceiling,
..
} => Tenancy::Scoped {
column: "org_id".into(),
sources,
read,
write,
exceed_site_ceiling,
unscoped_writes: Vec::new(),
on_unresolved: OnUnresolved::Deny,
},
_ => unreachable!(),
};
assert!(!other_col.narrows_within_authorized(&ceiling, true));
assert!(!Tenancy::Disabled.narrows_within_authorized(&ceiling, true));
let target = Tenancy::Target {
via: vec![TargetSource::Domain],
public: "storefront".into(),
write: vec![],
null_base: false,
};
assert!(!target.narrows_within_authorized(&ceiling, true));
assert!(!scoped_exceeding(All, All).narrows_within_authorized(&target, true));
assert_eq!(
scoped(All, All).narrows_within_authorized(&ceiling, false),
scoped(All, All).narrows_within(&ceiling),
);
}
#[test]
fn tenancy_disabled_widening_is_refused() {
use AccessMode::*;
assert!(scoped(Own, Own).narrows_within(&Tenancy::Disabled));
assert!(Tenancy::Disabled.narrows_within(&Tenancy::Disabled));
assert!(!Tenancy::Disabled.narrows_within(&scoped(Own, Own)));
let target = Tenancy::Target {
via: vec![TargetSource::Domain],
public: "storefront".into(),
write: vec![],
null_base: false,
};
assert!(!target.narrows_within(&scoped(All, All)));
assert!(!scoped(Own, Own).narrows_within(&target));
assert!(target.narrows_within(&target));
}
#[test]
fn declares_signed_context_detects_the_async_lane_source() {
let ctx = Tenancy::Scoped {
column: "tenant_id".into(),
sources: vec![TenantSource::SignedContext],
read: AccessMode::Own,
write: AccessMode::Own,
exceed_site_ceiling: false,
unscoped_writes: Vec::new(),
on_unresolved: OnUnresolved::Deny,
};
assert!(ctx.declares_signed_context());
let mixed = Tenancy::Scoped {
column: "tenant_id".into(),
sources: vec![
TenantSource::Token {
claim: "tid".into(),
extract: None,
namespace: None,
},
TenantSource::SignedContext,
],
read: AccessMode::Own,
write: AccessMode::Own,
exceed_site_ceiling: false,
unscoped_writes: Vec::new(),
on_unresolved: OnUnresolved::Deny,
};
assert!(mixed.declares_signed_context());
let no_ctx = Tenancy::Scoped {
column: "tenant_id".into(),
sources: vec![TenantSource::None],
read: AccessMode::Null,
write: AccessMode::Null,
exceed_site_ceiling: false,
unscoped_writes: Vec::new(),
on_unresolved: OnUnresolved::Deny,
};
assert!(!no_ctx.declares_signed_context());
assert!(!Tenancy::Disabled.declares_signed_context());
}
#[test]
fn de_opt_tenancy_bridges_ron_and_json() {
use serde::Deserialize;
#[derive(Debug, Deserialize)]
struct W {
#[serde(default, deserialize_with = "de_opt_tenancy")]
tenancy: Option<Tenancy>,
}
let ron_opts = ron::Options::default()
.with_default_extension(ron::extensions::Extensions::IMPLICIT_SOME);
let scoped_ron: W = ron_opts
.from_str(
r#"(tenancy: (mode: "scoped", column: "tenant_id",
sources: [(kind: "token", claim: "tid"), (kind: "signed_context")],
read: "all", write: "own"))"#,
)
.expect("scoped RON parses via the bridge");
let scoped_json: W = serde_json::from_str(
r#"{"tenancy":{"mode":"scoped","column":"tenant_id",
"sources":[{"kind":"token","claim":"tid"},{"kind":"signed_context"}],
"read":"all","write":"own"}}"#,
)
.expect("scoped JSON parses via the bridge");
assert_eq!(scoped_ron.tenancy, scoped_json.tenancy);
match scoped_ron.tenancy.unwrap() {
Tenancy::Scoped {
column,
sources,
read,
write,
..
} => {
assert_eq!(column, "tenant_id");
assert_eq!(
sources,
vec![
TenantSource::Token {
claim: "tid".into(),
extract: None,
namespace: None,
},
TenantSource::SignedContext
]
);
assert_eq!(read, AccessMode::All);
assert_eq!(write, AccessMode::Own);
}
other => panic!("expected scoped, got {other:?}"),
}
let target_ron: W = ron_opts
.from_str(
r#"(tenancy: (mode: "target", via: ["domain"], public: "storefront",
write: ["status"]))"#,
)
.expect("target RON parses");
match target_ron.tenancy.unwrap() {
Tenancy::Target {
via,
public,
write,
null_base,
} => {
assert_eq!(via, vec![TargetSource::Domain]);
assert_eq!(public, "storefront");
assert_eq!(write, vec!["status".to_string()]);
assert!(
!null_base,
"absent null_base defaults to false (plain target)"
);
}
other => panic!("expected target, got {other:?}"),
}
let ton_ron: W = ron_opts
.from_str(
r#"(tenancy: (mode: "target", via: ["domain"], public: "vocab", null_base: true))"#,
)
.expect("target_or_null RON parses");
let ton_json: W = serde_json::from_str(
r#"{"tenancy":{"mode":"target","via":["domain"],"public":"vocab","null_base":true}}"#,
)
.expect("target_or_null JSON parses");
assert_eq!(ton_ron.tenancy, ton_json.tenancy);
assert!(
matches!(
ton_ron.tenancy,
Some(Tenancy::Target {
null_base: true,
..
})
),
"null_base survives the bridge"
);
let exc_ron: W = ron_opts
.from_str(
r#"(tenancy: (mode: "scoped", column: "tenant_id",
sources: [(kind: "token", claim: "tid")],
read: "all", write: "all", exceed_site_ceiling: true))"#,
)
.expect("exceed_site_ceiling RON parses via the bridge");
let exc_json: W = serde_json::from_str(
r#"{"tenancy":{"mode":"scoped","column":"tenant_id",
"sources":[{"kind":"token","claim":"tid"}],
"read":"all","write":"all","exceed_site_ceiling":true}}"#,
)
.expect("exceed_site_ceiling JSON parses via the bridge");
assert_eq!(exc_ron.tenancy, exc_json.tenancy);
assert!(
matches!(
exc_ron.tenancy,
Some(Tenancy::Scoped {
exceed_site_ceiling: true,
..
})
),
"exceed_site_ceiling survives the bridge"
);
assert!(
matches!(
scoped_json.tenancy,
Some(Tenancy::Scoped {
exceed_site_ceiling: false,
..
})
),
"an omitted exceed_site_ceiling defaults to false"
);
let disabled: W = ron_opts
.from_str(r#"(tenancy: (mode: "disabled"))"#)
.expect("disabled RON parses");
assert_eq!(disabled.tenancy, Some(Tenancy::Disabled));
let absent: W = ron_opts.from_str(r#"()"#).expect("absent parses");
assert_eq!(absent.tenancy, None);
}
}