nodedb 0.3.0

Local-first, real-time, edge-to-cloud hybrid database for multi-modal workloads
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

// SPDX-License-Identifier: BUSL-1.1

//! Cross-tenant isolation: Key-Value engine.
//!
//! Tenant A puts a key. Tenant B gets the same key — must get NotFound.

use nodedb::bridge::envelope::{ErrorCode, Status};
use nodedb_physical::physical_plan::{KvOp, PhysicalPlan};

use crate::helpers::*;

#[test]
fn kv_get_isolated() {
    let (mut core, mut tx, mut rx, _dir) = make_core();

    // Tenant A puts a key.
    send_ok_as_tenant(
        &mut core,
        &mut tx,
        &mut rx,
        TENANT_A,
        PhysicalPlan::Kv(KvOp::Put {
            collection: "cache".into(),
            key: b"session_abc".to_vec(),
            value: b"tenant_a_session_data".to_vec(),
            ttl_ms: 0,
            surrogate: nodedb_types::Surrogate::ZERO,
        }),
    );

    // Tenant A can read it.
    let resp_a = send_raw_as_tenant(
        &mut core,
        &mut tx,
        &mut rx,
        TENANT_A,
        PhysicalPlan::Kv(KvOp::Get {
            collection: "cache".into(),
            key: b"session_abc".to_vec(),
            rls_filters: Vec::new(),
            surrogate_ceiling: None,
        }),
    );
    assert_eq!(resp_a.status, Status::Ok);
    assert!(
        !resp_a.payload.is_empty(),
        "Tenant A should see own KV data"
    );

    // Tenant B gets the same key — must be empty or NotFound.
    let resp_b = send_raw_as_tenant(
        &mut core,
        &mut tx,
        &mut rx,
        TENANT_B,
        PhysicalPlan::Kv(KvOp::Get {
            collection: "cache".into(),
            key: b"session_abc".to_vec(),
            rls_filters: Vec::new(),
            surrogate_ceiling: None,
        }),
    );
    // KV engine returns Ok with empty payload or NotFound for missing keys.
    let is_empty = resp_b.payload.is_empty()
        || resp_b.error_code == Some(ErrorCode::NotFound)
        || payload_json(&resp_b.payload).contains("null");
    assert!(
        is_empty,
        "Tenant B must NOT see Tenant A's KV data, got: {:?}",
        payload_json(&resp_b.payload)
    );
}