( tableName: string, access: string, context: ExecutorOwnerPolicyContext | undefined, )
| 144 | * and the leftovers would otherwise survive as orphans that agents still see. |
| 145 | */ |
| 146 | export const assertReachReadOnly = ( |
| 147 | tableName: string, |
| 148 | access: string, |
| 149 | context: ExecutorOwnerPolicyContext | undefined, |
| 150 | ): void => { |
| 151 | if (context === undefined) return; |
| 152 | if (context.writes === "delete-only") { |
| 153 | if (access === "delete") return; |
| 154 | policyViolation( |
| 155 | `Storage ${access} on table "${tableName}" is not allowed: this context may only delete.`, |
| 156 | ); |
| 157 | } |
| 158 | if (context.reach !== "tenant" && context.writes !== "denied") return; |
| 159 | policyViolation( |
| 160 | `Storage ${access} on table "${tableName}" is not allowed: the platform view is read-only.`, |
| 161 | ); |
| 162 | }; |
| 163 | |
| 164 | /** Assert a create/upsert writes a row inside the bound partition. */ |
| 165 | export const assertOwnerWritable = ( |
no test coverage detected