Should this subscriber hear about this event at all?
Entity-level narrowing, raised in review: an event for an entity a session has no read
permission on tells that session the record exists, its stable key, and when it changed — and
the session could never have read it anyway, so nothing is lost by withholding it. This is a
monotonic reduction in disclosure that needs no tenancy model, which is why it is here and the
row-level question is not.
What it does NOT close: two sessions that both hold read permission on an entity still see each
other's keys, because what separates them is row-level. That predicate is tracked separately —
see the class docblock below.
GetUserPermisions is an in-memory match of the entity's permission rows against the user's
roles, so this stays cheap enough to run per subscriber per event. It is not free: it runs for
every connected socket on every save, so keep it free of I/O.
Should this subscriber hear about this event at all?
Entity-level narrowing, raised in review: an event for an entity a session has no read permission on tells that session the record exists, its stable key, and when it changed — and the session could never have read it anyway, so nothing is lost by withholding it. This is a monotonic reduction in disclosure that needs no tenancy model, which is why it is here and the row-level question is not.
What it does NOT close: two sessions that both hold read permission on an entity still see each other's keys, because what separates them is row-level. That predicate is tracked separately — see the class docblock below.
GetUserPermisionsis an in-memory match of the entity's permission rows against the user's roles, so this stays cheap enough to run per subscriber per event. It is not free: it runs for every connected socket on every save, so keep it free of I/O.