AshArcadic. DataLayer. Verifiers. ValidateMultitenancyAttr
(AshArcadic v0.1.0)
Copy Markdown
View Source
Compile-verifier for :attribute multitenancy. Two fail-open holes turned into
compile errors (AshArcadic has no rls_guc; those ash_age clauses are dropped —
ArcadeDB has no row-level security):
- the discriminator must not be in
arcade do skip [...]— a skipped discriminator is never written, so the tenant filter Ash injects matches nothing (fail-open). - the discriminator must not be binary-storage-typed — it is a plaintext comparator across the vertex filter and traversal per-node scoping; a tag/base64 discriminator would scope those paths inconsistently.