use super::MiddlewareStack;
impl MiddlewareStack {
pub fn enforce_namespace_boundary(
&self,
requester_namespace: &str,
resolved_name: &str,
) -> String {
if !self.namespace_isolation || !resolved_name.starts_with('/') {
return resolved_name.to_string();
}
let Some(requester_tenant) = tenant_root(requester_namespace) else {
return resolved_name.to_string();
};
let segments = split_absolute_segments(resolved_name);
if segments.is_empty() {
return format!("/{requester_tenant}");
}
if segments[0] == requester_tenant {
return resolved_name.to_string();
}
if segments.len() == 1 {
return format!("/{requester_tenant}");
}
format!("/{requester_tenant}/{}", segments[1..].join("/"))
}
}
fn tenant_root(namespace: &str) -> Option<&str> {
namespace
.trim_matches('/')
.split('/')
.find(|segment| !segment.is_empty())
}
fn split_absolute_segments(name: &str) -> Vec<&str> {
name.trim_matches('/')
.split('/')
.filter(|segment| !segment.is_empty())
.collect()
}