AccessFilterSpec

The access filter contract: every snapshot query backend answers an access policy's filter (AccessFilters) as the kernel evaluates the policy (AccessPredicate.allows), so a policy grants the same aggregates whether a query, a point read or a command asks. A backend's test extends it, stores the records each test gives in store, and supplies its binding of an aggregate type in binding; on the in-memory backend it is the matrix that holds the kernel's evaluator to the point reads', on the others the access attributes' push-down.

Each record holds an aggregate's access attributes as its snapshot does: the built-in owner and space as owner and space (ownerId and spaceId; an event stream's access.owner and access.space), each declared attribute under fieldOf it, access.<name> by default, its value as stored (accessTree: a string, an enum by its name, an integer as a long, a boolean, a multiple attribute a sorted array of distinct values), an absent one left out: a record written before the attribute was declared. A record not yet stamped has a null access. Every filter is guarded by IS_NOT_NULL of access, as the query assembly guards it, so a record not stamped is never read, not even by a check of absence.

The matrix covers each operator of one value and of several, negated or not, on present values, on values a record lacks and on a record not stamped, with claims the caller holds and those it does not: a negation over a missing value never grants (a document store's $nor matches a missing field, which the guard of each negation excludes).