Function assertOwnerPatch

packages/core/sdk/src/owner-policy.ts:196–212

(
  tableName: string,
  patch: Record<string, unknown> | undefined,
  context: ExecutorOwnerPolicyContext | undefined,
)

/** Assert a patch (`set`) doesn't move a row out of the bound partition. Only
 *  validates the partition columns that are actually being written. */
export const assertOwnerPatch = (
  tableName: string,
  patch: Record<string, unknown> | undefined,
  context: ExecutorOwnerPolicyContext | undefined,
): void => {
  const ctx = requireContext(tableName, "write", context);
  assertReachReadOnly(tableName, "write", ctx);
  if (!patch) return;
  if (patch.tenant !== undefined && patch.tenant !== ctx.tenant) {
    policyViolation(`Storage write on table "${tableName}" cannot move a row across tenants.`);
  }
  if (patch.owner === "user" && (ctx.subject == null || patch.subject !== ctx.subject)) {
    policyViolation(
      `Storage write on table "${tableName}" cannot move a row outside the bound subject.`,
    );
  }
};

export const hasExecutorOwnerPolicy = (table: AnyTable): boolean =>
  table.policies.some((policy) => policy.name === executorOwnerPolicyName);