QueryEngine

The read side of a node, composed once: the gateways of the three query models (the snapshots and events of each aggregate type a backend serves, the datasets), the schema catalog they compile against, which aggregates and datasets a caller sees (visibility, datasetVisibility), and the reads every entry reads a state through. A host only maps its configuration onto a Builder; the security rules are the builder's:

• every gateway runs the scope policy (the tenant, the owner of the aggregates their owners hold) first, then the access policies of the aggregates that have one (AccessQueryPolicy, checked against the Manifest as the engine is built: AccessPolicies.of), then the application's policies, and is observed by the query log and the application's observers;

• when an access policy or an application's policy may hide an aggregate from a caller of its scope, a type whose snapshots are not queried still has its policies evaluated on its states (SnapshotPolicyGateway), so its state reads and its events fail closed;

• an aggregate the snapshot queries hide is hidden from the state reads too, and from the events model: an access policy by its filter on the access attributes each stream records, the aggregate's current ones; an application's policy, which reads the state, by pinning the events queries to the aggregates they name;

• every query of the snapshots and the events runs under its store's QueryBulkhead, whichever entry asks, and an events query that names no aggregate is refused where UnpinnedEvents.REFUSE says so.