Check that a rendered metadata filter actually constrains on every key its scope
declared in RequiredMetadataKeys.
This catches the failure mode CheckRenderedTemplate structurally cannot: a filter
that rendered partially. A realistic scope filter is several optional clauses —
— and if the channel dimension is absent (a mistyped dimension name, a caller that omitted
it, a value the dimension resolver discarded as spoofed) the org clause still renders. The
filter is non-empty, contains no leftover template syntax, and passes every other guard,
yet the lane now searches the entire tenant instead of the one channel. The restriction
did not fail; it evaporated, and nothing downstream can tell the difference.
Declaring the keys makes the author's intent checkable. The check is deliberately a
presence test rather than a semantic one: proving that a filter genuinely restricts on
a key would mean interpreting five different provider filter dialects. Presence is cheap,
dialect-agnostic, and catches the whole vanished-clause class, which is what actually
happens in practice.
Parameters
rendered: unknown
the rendered filter — a JSON string, or an already-parsed object
Check that a rendered metadata filter actually constrains on every key its scope declared in
RequiredMetadataKeys.This catches the failure mode CheckRenderedTemplate structurally cannot: a filter that rendered partially. A realistic scope filter is several optional clauses —
— and if the channel dimension is absent (a mistyped dimension name, a caller that omitted it, a value the dimension resolver discarded as spoofed) the org clause still renders. The filter is non-empty, contains no leftover template syntax, and passes every other guard, yet the lane now searches the entire tenant instead of the one channel. The restriction did not fail; it evaporated, and nothing downstream can tell the difference.
Declaring the keys makes the author's intent checkable. The check is deliberately a presence test rather than a semantic one: proving that a filter genuinely restricts on a key would mean interpreting five different provider filter dialects. Presence is cheap, dialect-agnostic, and catches the whole vanished-clause class, which is what actually happens in practice.