AshArcadic.DataLayer.Verifiers.ValidateMultitenancyAttr (AshArcadic v0.1.0)

Copy Markdown View Source

Compile-verifier for :attribute multitenancy. Two fail-open holes turned into compile errors (AshArcadic has no rls_guc; those ash_age clauses are dropped — ArcadeDB has no row-level security):

  • the discriminator must not be in arcade do skip [...] — a skipped discriminator is never written, so the tenant filter Ash injects matches nothing (fail-open).
  • the discriminator must not be binary-storage-typed — it is a plaintext comparator across the vertex filter and traversal per-node scoping; a tag/base64 discriminator would scope those paths inconsistently.