db/cell_view_sql.ts

can_view_cell in SQL — the view predicate a query applies to a cell row before LIMIT, so a page holds only rows the caller may view.

can_view_cell_sql is the one SQL form of the predicate: query_cell_list embeds it (adding the steward arm beside it), and the relation lists apply it to the cell at the other end of each edge. It binds the caller through a CellViewer (auth/cell_authorize.ts's cell_viewer_from_auth builds one from a request context), and the role-shaped grant arm reads the caller_role_grants CTE caller_role_grants_cte defines. Twin of the Rust fuz_cell::cell_view_sql.

view source

Declarations
#

8 declarations

caller_role_grants_cte
#

db/cell_view_sql.ts view source

(roles: string, scope_ids: string): string import {caller_role_grants_cte} from '@fuzdev/fuz_app/db/cell_view_sql.js';

The caller_role_grants CTE body (no WITH): the caller's (role, scope_id) pairs, unnested once per query from the parallel arrays at placeholders roles and scope_ids. PG 12+ inlines a non-recursive single-use CTE, so this is planner-equivalent to a subquery — the form is for clarity.

roles

the placeholder of the roles array (text[])

type string

scope_ids

the placeholder of the scope-id array (uuid[])

type string

returns

string

the CTE body

can_view_cell_sql
#

db/cell_view_sql.ts view source

(c_alias: string, params: CellViewerSqlParams): string import {can_view_cell_sql} from '@fuzdev/fuz_app/db/cell_view_sql.js';

can_view_cell over the cell alias c_alias: admin, the owner, or — while the cell's moderation admits an audience — public or a cell_grant admitting the caller.

Reads the caller at params; the grant arm needs the caller_role_grants_cte in scope. Liveness (deleted_at IS NULL) is the query's own clause, as can_view_cell reads a loaded live row.

c_alias

the cell alias in the enclosing query

type string

params

where the query binds the caller

type CellViewerSqlParams

returns

string

the SQL predicate (parenthesized)

cell_grant_admits_caller_sql
#

db/cell_view_sql.ts view source

(g_alias: string, actor_id: string): string import {cell_grant_admits_caller_sql} from '@fuzdev/fuz_app/db/cell_view_sql.js';

The cell_grant admits-caller predicate over grant alias g_alias: an actor-shaped grant matches the actor at placeholder actor_id; a role-shaped grant matches a (role, scope_id) pair in the caller_role_grants CTE (a NULL grant scope_id matches any scope). Mirrors grant_admits in auth/cell_authorize.ts.

g_alias

the cell_grant alias in the enclosing query

type string

actor_id

the placeholder of the caller's actor (uuid)

type string

returns

string

the SQL predicate

CELL_VIEWER_ANONYMOUS
#

db/cell_view_sql.ts view source

CellViewer import {CELL_VIEWER_ANONYMOUS} from '@fuzdev/fuz_app/db/cell_view_sql.js';

An anonymous caller — admitted by the public arm alone.

cell_viewer_params
#

db/cell_view_sql.ts view source

(viewer: CellViewer): [boolean, (string & $brand<"Uuid">) | null, readonly string[], readonly ((string & $brand<"Uuid">) | null)[]] import {cell_viewer_params} from '@fuzdev/fuz_app/db/cell_view_sql.js';

The viewer's bind values, in the order `[is_admin, actor_id, roles, scope_ids]`.

viewer

the caller

type CellViewer

returns

[boolean, Uuid | null, readonly string[], readonly (Uuid | null)[]]

the four bind values

throws

  • Error - when the role-grant arrays aren't parallel

CELL_VIEWER_UNRESTRICTED
#

db/cell_view_sql.ts view source

CellViewer import {CELL_VIEWER_UNRESTRICTED} from '@fuzdev/fuz_app/db/cell_view_sql.js';

A server-side read that filters nothing — the admin arm admits every cell. For a caller that applies its own view check afterwards (the cell_get bundle) or acts for the server itself.

CellViewer
#

db/cell_view_sql.ts view source

CellViewer import type {CellViewer} from '@fuzdev/fuz_app/db/cell_view_sql.js';

The caller a view predicate binds — what can_view_cell reads off the request context.

role_grant_roles and role_grant_scope_ids are parallel, one entry per active role grant (null = a global grant): unnest pads the shorter with NULLs, and a NULL scope reads as a global grant, so cell_viewer_params refuses a mismatch.

actor_id

The acting actor; null for an anonymous or account-grain caller.

type Uuid | null

readonly

is_admin

Whether the caller holds the global admin role — the arm that admits every cell.

type boolean

readonly

role_grant_roles

The roles of the caller's active role grants, parallel to role_grant_scope_ids.

type readonly string[]

readonly

role_grant_scope_ids

The scopes of the caller's active role grants, parallel to role_grant_roles.

type readonly (Uuid | null)[]

readonly

CellViewerSqlParams
#

db/cell_view_sql.ts view source

CellViewerSqlParams import type {CellViewerSqlParams} from '@fuzdev/fuz_app/db/cell_view_sql.js';

Where a query binds the CellViewer facts can_view_cell_sql reads — each a $N placeholder.

is_admin

The global-admin flag (bool).

type string

readonly

actor_id

The acting actor (uuid, NULL when anonymous) — the owner arm and the grant arm's guard.

type string

readonly

grant_actor_id?

The actor an actor-shaped grant matches, when a query binds it apart from actor_id (query_cell_list does). Defaults to actor_id.

type string

readonly

Depends on
#

Imported by
#