docs(formula): say why the RLS check evaluator has no token axis - #4145
Merged
Conversation
The temporal conformance matrix (#4109) gives every case a `tokenFilter` spelling, and the driver + analytics suites resolve it before asserting. This suite runs only the literal `filter`, with nothing saying why — so the absence reads as an omission, and the next person either "fixes" a non-gap or assumes coverage that cannot exist. It is architecture: an RLS `check` is a CEL expression (`check` is a string, compiled by rlsCompiler.compileFilter) where a relative date is the function today() evaluated at compile time. A {token} string never reaches this evaluator — resolveFilterTokens runs on the ObjectQL read path and the write-side check does not go through it; verified that plugin-security never calls the resolver. Comment only; the suite is unchanged and still 13/13. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EkL3RGJrzjLEGURsLxfS2f
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Contributor
📓 Docs Drift CheckNo hand-written docs reference the 0 changed package(s). ✅ |
os-zhuang
added
documentation
Claude
The changeset gate is `if: !contains(labels, 'skip-changeset')`, so the label only takes effect on a fresh run. This PR is comment-only in a published package: a changeset would ship a patch CHANGELOG entry that describes no user-facing change, which is what the label exists for. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EkL3RGJrzjLEGURsLxfS2f
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#4109 之后的一条小补充——仅注释，无行为改动。
问题
#4109 给温度一致性矩阵的每个 case 都加了
tokenFilter（同一 filter 的 token 拼写），driver 与 analytics 的套件都会先resolveFilterTokens再断言。formula的套件只跑字面量filter，且没有任何说明。这样读起来像疏漏。下一个看到的人只有两种反应，都是错的：把它当漏测去"补"（会写出一个这个后端根本收不到的输入的测试），或者默认它已被覆盖（而那种覆盖不可能存在）。
为什么它不可能有 token 轴（实查，非推断）
RLS
check是 CEL 表达式——PermissionSet.check是字符串，经rlsCompiler.compileFilter编译，其中相对日期是函数today()，在编译期求值。{token}字符串到不了这个求值器：resolveFilterTokens只在 ObjectQL 读路径运行（engine.ts解析ast.where），写侧 check 不经过它——plugin-security全文没有调用该解析器，这一点我 grep 确认过。注释里同时写了失效条件：若将来
check支持带 token 的 filter 形态，删掉这段注释即可，轴已在共享表里备好。出处
本来是 #4125 的一部分。#4109 在评审期间落地了同一个 token 轴且更全（7 个消费者、16 个 case、
tokenFilter+dateRange两种拼写、writerForm混合写入形态、pre-epoch 行、legacy-storage sweep），所以 #4125 已关闭为 superseded，不做重复实现。这段说明是那轮里 #4109 没有覆盖到的唯一增量，单独带过来。测试
formula该套件 13/13 不变（纯注释）；eslint 干净。🤖 Generated with Claude Code
https://claude.ai/code/session_01EkL3RGJrzjLEGURsLxfS2f
Generated by Claude Code