Struct ReferenceTenancy 

pub struct ReferenceTenancy { /* private fields */ }

A reference tenancy: every partition resolves to a placement of the configured PlacementMode. The default SharedIndex mode isolates by an injected _tenant field; the dedicated modes isolate by index/cluster with no body rewrite.

Implementations

impl ReferenceTenancy

pub fn new( cluster: ClusterId, index: IndexName, endpoint: impl Into<String>, ) -> Self

Builds the reference tenancy over one cluster and shared index, served at endpoint (the cluster’s base URL, reported as part of the placement result so the sink can pool it). Defaults to PlacementMode::SharedIndex.

pub fn with_placement_mode(self, mode: PlacementMode) -> Self

Sets the placement mode (builder). SharedIndex rewrites the body; DedicatedIndex/DedicatedCluster route without touching it.

Trait Implementations

impl Debug for ReferenceTenancy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl TenancySpi for ReferenceTenancy

fn resolve_partition( &self, ctx: &RequestCtx<'_>, body: BodyDoc<'_>, ) -> Result<PartitionId, SpiError>

Resolves the partition id for a request.

fn doc_id_rule(&self) -> Option<DocIdRule>

Optional rule to construct the document _id (and _routing).

fn injected_fields(&self) -> Vec<InjectedField>

Fields injected on ingest and stripped on read. The field names are chosen here (the SPI decides them).

fn cluster_endpoint(&self, cluster: &ClusterId) -> Option<String>

The base URL of a cluster, by id. The data plane carries each cluster’s endpoint on the placement result, but the cursor-affinity and admin pass-through paths route to a cluster by id with no placement to consult, so they resolve the endpoint through this lookup. Return None for an unknown cluster; the request then fails closed rather than route blind.

async fn placement_for( &self, partition: &PartitionId, ) -> Result<PlacementAt, SpiError>

Resolves a partition to its current placement and the epoch it was read at. NOT a pure function, migration mutates the placement state.

fn sensitive_fields(&self) -> SensitivitySpec

Declares which field values observability may capture, driving value-suppression (NFR-S2). Deny-by-default: the standard implementation returns SensitivitySpec::all_sensitive (everything redacted) and allow-lists known-safe fields with SensitivitySpec::allowing. The default here is all_sensitive, so a tenancy that does not override it leaks nothing.

async fn admit_write(&self, _partition: &PartitionId, _epoch: Epoch) -> bool

The migration write gate (docs/06 §2): may a write that resolved at epoch for partition still commit? Re-checked at dispatch, after the decision was stamped, so a placement that advanced (or entered cutover) in the meantime is caught. false means reject as a retryable stale-epoch error; the client re-resolves against the new placement.