Should this subscriber hear about this event at all?
Entity-level narrowing, raised in review: an event for an entity a session has no read
permission on tells that session the record exists, its stable key, and when it changed — and
the session could never have read it anyway, so nothing is lost by withholding it. This is a
monotonic reduction in disclosure that needs no tenancy model, which is why it is here and the
row-level question is not.
What it does NOT close: two sessions that both hold read permission on an entity still see each
other's keys, because what separates them is row-level. That predicate is tracked separately —
see the class docblock below.
GetUserPermisions is an in-memory match of the entity's permission rows against the user's
roles, memoized per (payload, entityName, roleFingerprint) by the active
BaseCacheInvalidationBroadcastProvider so $N$ connected subscribers sharing $R$ role
combinations only run GetUserPermisions $R$ times per event.
Should this subscriber hear about this event at all?
Entity-level narrowing, raised in review: an event for an entity a session has no read permission on tells that session the record exists, its stable key, and when it changed — and the session could never have read it anyway, so nothing is lost by withholding it. This is a monotonic reduction in disclosure that needs no tenancy model, which is why it is here and the row-level question is not.
What it does NOT close: two sessions that both hold read permission on an entity still see each other's keys, because what separates them is row-level. That predicate is tracked separately — see the class docblock below.
GetUserPermisionsis an in-memory match of the entity's permission rows against the user's roles, memoized per(payload, entityName, roleFingerprint)by the active BaseCacheInvalidationBroadcastProvider so $N$ connected subscribers sharing $R$ role combinations only runGetUserPermisions$R$ times per event.