Enum ReadPredicate 

pub enum ReadPredicate {
    AuthNotNull,
    AuthIsNull,
    AuthIsSystem,
    HasRole {
        role: &'static str,
    },
    InTenant {
        tenant_id: &'static str,
    },
    AuthFieldEqLiteral {
        auth_field: &'static str,
        value: PolicyLiteral,
    },
    AuthFieldNeLiteral {
        auth_field: &'static str,
        value: PolicyLiteral,
    },
    FieldIsTrue {
        column: &'static str,
    },
    FieldEqLiteral {
        column: &'static str,
        value: PolicyLiteral,
    },
    FieldNeLiteral {
        column: &'static str,
        value: PolicyLiteral,
    },
    FieldInLiterals {
        column: &'static str,
        values: &'static [PolicyLiteral],
    },
    FieldNotInLiterals {
        column: &'static str,
        values: &'static [PolicyLiteral],
    },
    FieldEqAuth {
        column: &'static str,
        auth_field: &'static str,
    },
    FieldNeAuth {
        column: &'static str,
        auth_field: &'static str,
    },
    Relation {
        quantifier: RelationQuantifier,
        parent_table: &'static str,
        parent_column: &'static str,
        related_table: &'static str,
        related_column: &'static str,
        expr: &'static PolicyExpr,
    },
}

Variants

AuthNotNull

AuthIsNull

AuthIsSystem

Lowered from auth().isSystem() (issue #486 / ADR 0038 blocker B1). Satisfied only by a CratestackContext minted through cratestack_core::SystemContext.

This is a predicate a schema author writes down, not a bypass: it can only make a policy TRUE where an @@allow/@@deny clause names it. A model whose policies never mention it is entirely unaffected by system callers — the pre-existing default-deny / owner-scoped rules for that action still apply, which is the fail-closed property design constraint #2 asks for.

HasRole

Fields

role: &'static str

InTenant

Fields

tenant_id: &'static str

AuthFieldEqLiteral

Fields

auth_field: &'static str

value: PolicyLiteral

AuthFieldNeLiteral

Fields

auth_field: &'static str

value: PolicyLiteral

FieldIsTrue

Fields

column: &'static str

FieldEqLiteral

Fields

column: &'static str

value: PolicyLiteral

FieldNeLiteral

Fields

column: &'static str

value: PolicyLiteral

FieldInLiterals

field in [A, B, C] (issue #666) — a set membership test that lowers to a single column IN ($1, $2, $3), one bind slot per element.

This is the multi-value shape FieldEqLiteral deliberately did not grow: field == A || field == B already expresses the same policy through the Or combinator, but it repeats the column name once per variant and produces a nested Or tree in the rendered SQL rather than one flat IN.

values is never empty — the macro rejects field in [] at compile time, because an empty set is a constant FALSE that reads as a policy and because SQL has no valid IN () form. The SQL emitters still handle the empty case as a constant rather than trusting that invariant.

Fields

column: &'static str

values: &'static [PolicyLiteral]

FieldNotInLiterals

field not in [A, B, C] — the negation of Self::FieldInLiterals, lowering to column NOT IN (...).

Note the SQL-level asymmetry this inherits from IN: a NULL in column makes both IN and NOT IN evaluate to NULL, so neither matches. That is why literal comparisons are restricted to required fields (see cratestack-macros/src/policy/model/enum_literal.rs) — a nullable column would silently drop rows from both branches.

Fields

column: &'static str

values: &'static [PolicyLiteral]

FieldEqAuth

Fields

column: &'static str

auth_field: &'static str

FieldNeAuth

Fields

column: &'static str

auth_field: &'static str

Relation

Fields

quantifier: RelationQuantifier

parent_table: &'static str

parent_column: &'static str

related_table: &'static str

related_column: &'static str

expr: &'static PolicyExpr

Trait Implementations

impl Clone for ReadPredicate

fn clone(&self) -> ReadPredicate

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ReadPredicate

impl Debug for ReadPredicate

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Eq for ReadPredicate

impl PartialEq for ReadPredicate

fn eq(&self, other: &ReadPredicate) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ReadPredicate