Commit-time guard for relation removal.
The ordinary preflight count provides a useful error with a count, but it is necessarily stale by commit time. This transactor-side check closes the race where a relationship is created after that count and before the relation entity is retracted.
Commit-time guard for relation removal. The ordinary preflight count provides a useful error with a count, but it is necessarily stale by commit time. This transactor-side check closes the race where a relationship is created after that count and before the relation entity is retracted.
(count-relationships-using-relation
db
{:eacl.relation/keys [resource-type relation-name subject-type] :as relation})Counts current forward relationship tuples that reference the given relation.
Counts current forward relationship tuples that reference the given relation.
(install! conn)Explicitly installs and bootstraps fresh Relationship storage 8. Existing v7 databases must use eacl.datomic.migrations.relationships-v7-to-v8/migrate! instead.
Explicitly installs and bootstraps fresh Relationship storage 8. Existing v7 databases must use eacl.datomic.migrations.relationships-v7-to-v8/migrate! instead.
(migrate-v6-schema! conn schema-string)Migration-only conversion of released flat v6 schema rows to canonical expression storage. If schema-string is supplied it is fully parsed and validated before replacement; otherwise the stored union-only rows are converted deterministically. The strict v8 read path is never relaxed.
Migration-only conversion of released flat v6 schema rows to canonical expression storage. If schema-string is supplied it is fully parsed and validated before replacement; otherwise the stored union-only rows are converted deterministically. The strict v8 read path is never relaxed.
(migrate-v7-permissions! conn schema-string)(migrate-v7-permissions! conn schema-string expression-limit-overrides)Atomically replaces released v7 flat permissions with v8 expressions.
The complete candidate and relation-identity diff are computed before any additive v8 attribute is installed. Relation additions/retractions are rejected: v7 relationship tuples refer to relation entity ids and this migration is intentionally permission-only. A supplied replacement schema must additionally be semantically equivalent to the stored v7 permissions for every permission present in both; only additive permissions may differ. The final write atomically retracts old permission entities, asserts expressions, stores the schema text when supplied, advances :eacl/schema-version, and stamps :eacl/permission-storage-version.
Atomically replaces released v7 flat permissions with v8 expressions. The complete candidate and relation-identity diff are computed before any additive v8 attribute is installed. Relation additions/retractions are rejected: v7 relationship tuples refer to relation entity ids and this migration is intentionally permission-only. A supplied replacement schema must additionally be semantically equivalent to the stored v7 permissions for every permission present in both; only additive permissions may differ. The final write atomically retracts old permission entities, asserts expressions, stores the schema text when supplied, advances :eacl/schema-version, and stamps :eacl/permission-storage-version.
(permission-storage-shape db)Classifies only permission-definition storage without touching relationship
tuples. :flat is the released v7 input; ordinary v8 reads accept only
:expression or :none.
Classifies only permission-definition storage without touching relationship tuples. `:flat` is the released v7 input; ordinary v8 reads accept only `:expression` or `:none`.
(plan-schema-replacement db schema-string options)Pure prospective schema replacement plan for one immutable Datomic db.
Parsing, validation, semantic diffing, orphan policy, transaction data and
stable effect identities are shared with committed write-schema!.
Pure prospective schema replacement plan for one immutable Datomic db. Parsing, validation, semantic diffing, orphan policy, transaction data and stable effect identities are shared with committed `write-schema!`.
(prepare-cache-coherence! conn)Initializes missing physical relation generations in an upgraded database.
Datomic schema generations predate this migration and must already exist; a missing schema version fails closed instead of inventing authority.
Initializes missing physical relation generations in an upgraded database. Datomic schema generations predate this migration and must already exist; a missing schema version fails closed instead of inventing authority.
(read-authorization-schema db)Reads permission structure without compiling undemanded Caveat programs.
Reads permission structure without compiling undemanded Caveat programs.
(read-caveats db)(read-permissions db)Enumerates all EACL permission schema entities in DB and returns maps.
Enumerates all EACL permission schema entities in DB and returns maps.
(read-relations db)Canonical Relation definitions, including named Caveat alternatives.
Canonical Relation definitions, including named Caveat alternatives.
(read-schema db & [_format])Enumerates all EACL permission schema entities in DB and returns maps.
Enumerates all EACL permission schema entities in DB and returns maps.
Per-relation change stamp: a ref to the transaction that last added or retracted a relationship using this relation.
EACL's relationship write helpers append
[:db/add <relation-eid> :eacl/relation-version "datomic.tx"] to their own
tx-data, so a writer publishes exactly which relations moved, atomically with
the move itself. A reader takes the max stamp over the relations a permission
actually depends on, which is why an unrelated relation's churn cannot
invalidate a cached answer.
The value is the tx entity, not a fresh squuid, so the assertion is
IDEMPOTENT: a transaction touching a thousand relationships of one relation
emits one identical datom rather than a thousand conflicting ones, and
callers may freely concat the output of several helpers into one transaction.
Tx entity ids increase monotonically with t, so a max over a dependency set
is strictly increasing on any write to it.
History must remain available because proof-equivalent reuse is valid for any
readable immutable basis, including d/as-of values. Datomic indexing may
discard superseded values of a :db/noHistory true attribute, which would
make an otherwise valid historical proof unreadable.
Per-relation change stamp: a ref to the transaction that last added or retracted a relationship using this relation. EACL's relationship write helpers append `[:db/add <relation-eid> :eacl/relation-version "datomic.tx"]` to their own tx-data, so a writer publishes exactly which relations moved, atomically with the move itself. A reader takes the max stamp over the relations a permission actually depends on, which is why an unrelated relation's churn cannot invalidate a cached answer. The value is the tx entity, not a fresh squuid, so the assertion is IDEMPOTENT: a transaction touching a thousand relationships of one relation emits one identical datom rather than a thousand conflicting ones, and callers may freely concat the output of several helpers into one transaction. Tx entity ids increase monotonically with `t`, so a max over a dependency set is strictly increasing on any write to it. History must remain available because proof-equivalent reuse is valid for any readable immutable basis, including `d/as-of` values. Datomic indexing may discard superseded values of a `:db/noHistory true` attribute, which would make an otherwise valid historical proof unreadable.
(relationship-present-for-relation?
db
{:eacl.relation/keys [resource-type subject-type] :as relation})A bounded endpoint-index presence decision used only by speculative retain-inert planning. It performs at most one seek per physical direction and deliberately does not enumerate or count relationship tuples.
A bounded endpoint-index presence decision used only by speculative retain-inert planning. It performs at most one seek per physical direction and deliberately does not enumerate or count relationship tuples.
Schema-generation stamp. write-schema! asserts a fresh squuid here in the same transaction as any definition change. Staged Caveat-reference creation also advances it to serialize against definition removal. A connection-backed EACL client reads it once at construction and replaces its one cached generation when write-schema! is invoked through that client. Do not edit EACL definitions outside write-schema!.
Schema-generation stamp. write-schema! asserts a fresh squuid here in the same transaction as any definition change. Staged Caveat-reference creation also advances it to serialize against definition removal. A connection-backed EACL client reads it once at construction and replaces its one cached generation when write-schema! is invoked through that client. Do not edit EACL definitions outside write-schema!.
Compatibility name for the former all-in-one installer. New v8 databases
should call install!; released-v7 databases already contain the flat
attributes required by the explicit permission migration.
Compatibility name for the former all-in-one installer. New v8 databases should call `install!`; released-v7 databases already contain the flat attributes required by the explicit permission migration.
Clean v8 Datomic install. Released-v7 flat permission attributes are intentionally omitted; an existing v7 database retains those immutable Datomic schema entities as inert upgrade history after its flat rows retire.
Clean v8 Datomic install. Released-v7 flat permission attributes are intentionally omitted; an existing v7 database retains those immutable Datomic schema entities as inert upgrade history after its flat rows retire.
The shared reference validator (eacl.schema.model/validate-schema-references):
direct permissions reference existing relations, arrows reference valid
source relations and targets that exist on every subject type, self
permissions reference existing permissions, and relation subject types are
defined definitions. ADR 012 requires that an invalid schema is rejected
with no changes made.
The shared reference validator (`eacl.schema.model/validate-schema-references`): direct permissions reference existing relations, arrows reference valid source relations and targets that exist on every subject type, self permissions reference existing permissions, and relation subject types are defined definitions. ADR 012 requires that an invalid schema is rejected with no changes made.
(write-schema! conn schema-string)(write-schema! conn schema-string opts)(write-schema! conn schema-string opts known-schema-version)Computes delta between existing schema and new schema, checks for any orphaned relationships on retracted schema, produces tx-ops and applies.
Throws if schema is invalid (parse failure, operator validation, reference validation, orphan check), or if the new schema contains zero definitions while a non-empty schema is stored (belt-and-braces against parser gaps — a malformed input must never be able to retract the whole schema). Pass {:allow-empty-schema? true} to explicitly wipe the stored schema.
Computes delta between existing schema and
new schema, checks for any orphaned relationships on retracted schema,
produces tx-ops and applies.
Throws if schema is invalid (parse failure, operator validation, reference
validation, orphan check), or if the new schema contains zero definitions
while a non-empty schema is stored (belt-and-braces against parser gaps —
a malformed input must never be able to retract the whole schema). Pass
{:allow-empty-schema? true} to explicitly wipe the stored schema.cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |