import { type Condition, type ConditionBuilder } from "@executor-js/fumadb/query";import type { AnyColumn, AnyTable } from "@executor-js/fumadb/schema"; import { StorageError } from "./fuma-runtime"; /* The v2 owner policy — successor to v1's `executor.scope` policy. Every owned * row carries `tenant` + `owner`('org'|'user') + `subject`; org rows use the * empty-string sentinel for `subject` (NOT null, so unique indexes stay portable). * * An executor binds to `{ tenant, subject }`. The policy guards storage so it can * only read/write rows it owns: *   - read/update/delete → tenant matches AND (owner='org' OR subject matches) *   - create → the written (tenant, owner, subject) must match the binding * No scope stack, no innermost-wins shadowing: a tool address names its owner * segment, so org and user rows are distinct, both visible to the acting subject. */ export const executorOwnerPolicyName = "executor.owner";/** Tenant-shared tables (the integration catalog) — partitioned by `tenant` only. */export const executorTenantPolicyName = "executor.tenant";/** Truly global tables (the blob store) — isolation carried in the row namespace. */export const executorUnscopedPolicyName = "executor.unscoped"; /** Sentinel `subject` value for org-owned rows. */export const ORG_SUBJECT = ""; const unscopedExecutorTables = new Set(["blob"]); export interface ExecutorOwnerPolicyContext {  readonly tenant: string;  /** The acting member, or null for a pure-org executor (no `owner:"user"`   *  reads/writes are allowed when null). */  readonly subject: string | null;} type AnyConditionBuilder = ConditionBuilder<Record<string, AnyColumn>>; const policyViolation = (message: string): never => {  // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: FumaDB table policy callbacks are promise callbacks, not Effect effects  throw new StorageError({ message, cause: undefined });}; const requireContext = (  tableName: string,  access: string,  context: ExecutorOwnerPolicyContext | undefined,): ExecutorOwnerPolicyContext => {  if (context) return context;  return policyViolation(    `Storage ${access} on table "${tableName}" is missing executor owner context.`,  );}; /** The rows the bound `{ tenant, subject }` may see/mutate: org rows in the *  tenant, plus this subject's own user rows. */export const ownerVisibilityCondition = (  builder: AnyConditionBuilder,  context: ExecutorOwnerPolicyContext,): Condition | boolean => {  const orgClause = builder.and(    builder("tenant", "=", context.tenant),    builder("owner", "=", "org"),  );  if (context.subject == null) return orgClause;  const userClause = builder.and(    builder("tenant", "=", context.tenant),    builder("owner", "=", "user"),    builder("subject", "=", context.subject),  );  return builder.or(orgClause, userClause);}; /** Assert a create/upsert writes a row inside the bound partition. */export const assertOwnerWritable = (  tableName: string,  values: Record<string, unknown>,  context: ExecutorOwnerPolicyContext | undefined,): void => {  const ctx = requireContext(tableName, "write", context);  if (values.tenant !== ctx.tenant) {    policyViolation(`Storage write on table "${tableName}" is outside the executor tenant.`);  }  if (values.owner === "org") {    if (values.subject !== ORG_SUBJECT) {      policyViolation(`Storage write on table "${tableName}" set a subject on an org row.`);    }    return;  }  if (values.owner === "user") {    if (ctx.subject == null || values.subject !== ctx.subject) {      policyViolation(        `Storage write on table "${tableName}" targets a user row outside the bound subject.`,      );    }    return;  }  policyViolation(    `Storage write on table "${tableName}" has an invalid owner "${String(values.owner)}".`,  );}; /** Assert a patch (`set`) doesn't move a row out of the bound partition. Only *  validates the partition columns that are actually being written. */export const assertOwnerPatch = (  tableName: string,  patch: Record<string, unknown> | undefined,  context: ExecutorOwnerPolicyContext | undefined,): void => {  const ctx = requireContext(tableName, "write", context);  if (!patch) return;  if (patch.tenant !== undefined && patch.tenant !== ctx.tenant) {    policyViolation(`Storage write on table "${tableName}" cannot move a row across tenants.`);  }  if (patch.owner === "user" && (ctx.subject == null || patch.subject !== ctx.subject)) {    policyViolation(      `Storage write on table "${tableName}" cannot move a row outside the bound subject.`,    );  }}; export const hasExecutorOwnerPolicy = (table: AnyTable): boolean =>  table.policies.some((policy) => policy.name === executorOwnerPolicyName); export function assertExecutorOwnerPolicyTable(table: AnyTable, tableKey?: string): void {  const tableName = table.ormName || tableKey || table.names.sql;  const owned = table.policies.find((policy) => policy.name === executorOwnerPolicyName);  if (owned?.onRead && owned.onCreate && owned.onUpdate && owned.onDelete) return;   const tenant = table.policies.find((policy) => policy.name === executorTenantPolicyName);  if (tenant?.onRead && tenant.onCreate && tenant.onUpdate && tenant.onDelete) return;   const unscoped = table.policies.find((policy) => policy.name === executorUnscopedPolicyName);  if (unscoped && unscopedExecutorTables.has(tableName)) return;   policyViolation(`Storage table "${tableName}" is missing an executor owner policy.`);}