QueryTargets
Where a read decides the tenant and scope its caller reads in: the one home of the read side's scope authorization, which every edge asks instead of deciding it itself. A query route, a state read and the dataset listing all read through of.
A caller names another scope (
Wow-Scope) only when it may act across scopes (Caller.crossScope); any other caller naming one is refused, QueryErrors.FORBIDDEN.A cross-tenant read is refused while crossTenant is off (
wow.query.allow-cross-tenant), QueryErrors.FORBIDDEN too.The tenant follows tenants: a type whose tenant is fixed is read in that tenant alone, so a cross-tenant read of it is narrowed to it, and one whose tenants leave it out, or a target naming another tenant, is refused, QueryErrors.MALFORMED.
Functions
The caller caller acts as on a route that reads no aggregate type of its own, such as a service route: in the target scope and its tenant when it names one and may act across scopes, else in its own. Throws the QueryErrors.FORBIDDEN QueryError that refuses it.
Whether caller may name target and the tenants it reads at all, whatever it reads: only a caller that may act across scopes names either, and the tenants only while cross-tenant queries are on. Throws the QueryErrors.FORBIDDEN QueryError that refuses it.
Checks again, as the engine admits caller's read of type, what of decided for an HTTP caller: the target and the tenants it reads are refused unless its identity may name them (admit), and a type whose tenant is fixed is read in it alone. A caller of built passes; one built otherwise reaches no further. An in-process caller is trusted by its entry.