auth/cell_relation_visibility.ts

Strict relation-read visibility filter.

Forward relation reads (the cell_get bundle, forward cell_field_list / cell_item_list, the deep-clone walk) must not surface edges whose target the caller cannot view — otherwise an editor of a public parent could enumerate private children by id, or a public cell could leak the existence of private linked cells. This helper bulk-loads the target cells + their grants and runs can_view_cell per target in memory, returning the set of viewable target ids. Batched (two queries for the whole id-set) to avoid the N+1 a naive per-row check would cause.

view source

Declarations
#

filter_visible_target_ids
#

auth/cell_relation_visibility.ts view source

(deps: QueryDeps, auth: RequestContext | null, target_ids: readonly (string & $brand<"Uuid">)[]): Promise<Set<string & $brand<"Uuid">>>

import {filter_visible_target_ids} from '@fuzdev/fuz_app/auth/cell_relation_visibility.js';

Return the subset of target_ids the caller may view.

Soft-deleted targets and ids with no matching cell are absent from the result (treated as not-viewable). Grants are loaded only for authenticated callers — null auth admits solely via the public branch of can_view_cell, so the grant load is skipped entirely.

`deps`

query deps

type QueryDeps

`auth`

request context, or null for unauthenticated callers

type RequestContext | null

`target_ids`

candidate cell ids (duplicates are harmless)

type readonly (string & $brand<"Uuid">)[]

returns

Promise<Set<string & $brand<"Uuid">>>

the set of ids the caller may view