pub struct WriteSelections<'a>(/* private fields */);Expand description
A write’s result selection set, guaranteed non-empty.
§Why this is a type and not a &[FieldSelection]
An empty selection set is the permissive shape at the write entries, not a neutral one. It is the input to two security decisions at once:
project_entityfilters the returned entity to it — and an empty slice means “no field filtering”, so the whole stored entity is returned;selection_set_selects_gated_fielddecides whether the #423 field authorizer runs at all — and it is false for an empty slice, so the authorizer takes zero calls.
So &[] is not a value a write entry should be able to receive by accident.
REST’s anonymous arm passed one (#1352); gRPC reached the same slice a different
way, through unwrap_or_default(); and an ordinary mutation { createUser }
carried one in from a client document (#1357). Three transports, three spellings,
one shape — which is what a type, rather than a fourth grep gate, is for.
§Why “non-empty” is sound
Every mutation’s return type is composite (#1358), and GraphQL § 5.3.3 refuses a
composite field named without a selection set (#1357), so a document that reaches
a write entry always carries one. A transport with no document of its own uses
mutation_return_selections, which never returns empty.
new is still fallible rather than an assertion: the compiler is
only a gate for schemas that go through the compiler, and
schema.compiled.json can be hand-authored. This is the runtime backstop for
one that declares a leaf-returning mutation anyway.
Implementations§
Source§impl<'a> WriteSelections<'a>
impl<'a> WriteSelections<'a>
Sourcepub fn new(selections: &'a [FieldSelection]) -> Result<Self>
pub fn new(selections: &'a [FieldSelection]) -> Result<Self>
Adopt a selection set for a write.
§Errors
Returns FraiseQLError::Validation when selections is empty. See the type
docs for why that is a refusal rather than a permissive default.
Sourcepub const fn as_slice(self) -> &'a [FieldSelection]
pub const fn as_slice(self) -> &'a [FieldSelection]
The selection set, for the projector and the field authorizer.