conditionReadsDeniedField.php
Table of Contents
Functions
- conditionReadsDeniedField() : bool
- Decides whether a conditional projection would **read** a field the caller may not read — an inference oracle through a condition (T5). The field that *carries* the condition is already gated by {@see \oihana\arango\db\helpers\isAuthorized()}; this closes the complementary hole where the condition *reads* a masked field:
Functions
conditionReadsDeniedField()
Decides whether a conditional projection would **read** a field the caller may not read — an inference oracle through a condition (T5). The field that *carries* the condition is already gated by {@see \oihana\arango\db\helpers\isAuthorized()}; this closes the complementary hole where the condition *reads* a masked field:
conditionReadsDeniedField(array<string|int, mixed> $options, array<string|int, mixed>|null $fields, array<string|int, mixed> $init) : bool
- Field::WHEN — the boolean guard (
price: doc.secretFlag == true ? … : …): its attributes are read at the current projection level, gated against$fields; - Field::ELSE — the fallback branch declaring a
Field::PROPERTY(cond ? … : doc.secretAttr): a direct leak, gated against$fields; - Field::WHERE — the
Filter::MAPelement filter (FOR item … FILTER item.region == …): its attributes read the array elements, so they are gated against the map's own sub-fields (Field::FIELDS).
Fail-open, exactly like the projection: an attribute absent from the projection,
carrying no Field::REQUIRES, or with no authorizer injected, is allowed — only a
field explicitly gated and refused makes this return true. The caller then drops
the whole conditional field (fail-closed), never emitting a partial oracle.
Parameters
- $options : array<string|int, mixed>
-
The field definition (reads WHEN / ELSE / WHERE / FIELDS).
- $fields : array<string|int, mixed>|null
-
The current projection map (the WHEN/ELSE context).
- $init : array<string|int, mixed>
-
The request-level init. Reads
Arango::AUTHORIZER.
Tags
Return values
bool —true when a read attribute is refused (drop the field), false otherwise.