Documentation
¶
Overview ¶
Package scope makes the namespace an operation is bounded to a first-class value.
Every namespace-bound operation takes a Scope as a required argument, so forgetting to bound a query is a compile error rather than something review has to notice. Crossing namespaces is a positive act: NewUnbounded cannot be called without a reason explaining why it is safe, and a grep for it lists every such site in one pass.
Not to be confused with the `scope` database column, which records a namespace's type.
Index ¶
Constants ¶
const ErrCodeEmptyTenantID = 1
ErrCodeEmptyTenantID is the code reported when a bounded scope is built without a tenant.
const ErrLayer = "scope"
ErrLayer is the layer that scope errors are reported from.
Variables ¶
var ErrEmptyTenantID = errors.New("cannot bound a scope to an empty tenant ID", ErrLayer, ErrCodeEmptyTenantID)
ErrEmptyTenantID is returned by NewBounded when the tenant ID is empty. Unlike the neighbouring value types, an invalid input is not normalised to a sentinel: normalising an empty tenant would reintroduce the fail-open unbounded query this package exists to remove.
Functions ¶
This section is empty.
Types ¶
type Kind ¶
type Kind uint8
Kind distinguishes the two ways a Scope can be constructed. The zero value is KindInvalid, so a Scope that was never constructed is neither bounded nor unbounded and stores reject it.
type Scope ¶
type Scope struct {
// contains filtered or unexported fields
}
Scope is the namespace an operation is bounded to, or an explicit statement that it is not bounded at all. Construct it with NewBounded or NewUnbounded; the zero value is invalid.
func MustBounded ¶
MustBounded is NewBounded for tenant IDs that cannot be empty by construction, such as one read back from a model the store just returned. It panics on an empty tenant ID.
func NewBounded ¶
NewBounded returns a Scope bounded to tenantID. It returns ErrEmptyTenantID when tenantID is empty, so a missing request header becomes an error at the edge instead of an unbounded query deep in the store.
func NewUnbounded ¶
NewUnbounded returns a Scope that deliberately spans every namespace. The reason is what makes the crossing auditable, so it should say why crossing is safe here, not merely that it happens.
Source Files