zeekay a9d2f1ff46 An aggregate reads no private email, and history no removed field ...

Red's review. The aggregate route reads columns directly, so it gated
only hidden fields: grouping an auth collection by email, or counting
its unique emails, answered addresses the records keep private, which
the list masks and the filter resolver will not compare. core.EmailGated
is now the one rule both ask: an auth collection's email, which a caller
who is not a superuser reads only where emailVisibility is set. The
aggregate route refuses it as it refuses a hidden field.
TestAPrivateEmailIsNotAFigure is red's proof inverted: the group and the
count are refused, and fail without the change.

A record's history showed the changes of a field the collection had
since removed. An org admin who removes a field means its values to be
gone from view, so a caller who is not a superuser no longer reads
them; _history keeps the row for a superuser.

The composite uniqueness check is a read before the write, which
PostgreSQL can race; that is now said where it is done and in LLM.md,
with the fix (a unique expression index from the dialect).

2026-10-19 09:24:43 -07:00

..

validators

base: the table wire is ours, named in our own words

2026-08-13 22:46:01 -07:00

actor.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

app.go

the storage tier can address the backend it selects

2026-08-11 10:39:19 -07:00

base_backup_engine_test.go

a backup that cannot hold the database refuses, and a deadlock is retried

2026-08-13 13:09:18 -07:00

base_backup_test.go

a backup that cannot hold the database refuses, and a deadlock is retried

2026-08-13 13:09:18 -07:00

base_backup.go

a Base can say where it keeps its records, and reclaim what they no longer use

2026-08-21 11:53:27 -07:00

base_network.go

chore(sqlite): align Base to hanzoai/sqlite v0.3.2 + fix backend-naming comments (#51)

2026-07-18 09:15:04 -07:00

base_test.go

they are Bases, one per org — the word tenant is gone

2026-08-10 18:23:40 -07:00

base.go

Test apps open a migrated fixture, so core and apis fit the runner

2026-10-19 09:08:39 -07:00

bindings.go

a hook is about a Base, and which Base arrives with the event

2026-08-13 19:56:46 -07:00

collection_grow_test.go

A member reads the org's schema, and a grow keeps an index it already has

2026-10-18 21:29:25 -07:00

collection_grow.go

A member reads the org's schema, and a grow keeps an index it already has

2026-10-18 21:29:25 -07:00

collection_import_test.go

they are Bases, one per org — the word tenant is gone

2026-08-10 18:23:40 -07:00

collection_import.go

updated collection indexes on system fields validator and normalized v0.23 old collections migration

2024-11-15 09:13:00 +02:00

collection_model_auth_options_test.go

Refuse an auth provider Base cannot serve

2026-09-10 21:32:48 -07:00

collection_model_auth_options.go

Declare operations on the group that serves them

2026-09-17 05:50:27 -07:00

collection_model_base_options.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

collection_model_test.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

collection_model_view_options_test.go

merge newui branch

2026-04-18 16:50:39 +03:00

collection_model_view_options.go

merge v0.23.0-rc changes

2024-09-29 21:09:46 +03:00

collection_model.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

collection_name_id_test.go

a collection whose id is its own name can be updated again

2026-08-25 13:35:50 -07:00

collection_query_test.go

tests: stop asserting numbers and strings that were never ours to pin

2026-07-27 07:34:22 -07:00

collection_query.go

the storage tier can address the backend it selects

2026-08-11 10:39:19 -07:00

collection_record_table_sync_test.go

they are Bases, one per org — the word tenant is gone

2026-08-10 18:23:40 -07:00

collection_record_table_sync.go

A multi-valued field can be added on PostgreSQL, and composites read as text

2026-10-18 22:08:03 -07:00

collection_validate_test.go

tests,migrations: align fixtures with the IAM-native auth shape

2026-05-15 03:40:04 -07:00

collection_validate.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

database.go

a Base can say where it keeps its records, and reclaim what they no longer use

2026-08-21 11:53:27 -07:00

db_builder.go

feat: Base platform — CRDT privacy, React admin, on-chain anchor SDK

2026-03-01 18:00:00 -08:00

db_connect_nodefaultdriver.go

feat: Base platform — CRDT privacy, React admin, on-chain anchor SDK

2026-03-01 18:00:00 -08:00

db_connect_postgres_nopg.go

feat(base): add PostgreSQL dialect and DBConnect

2026-03-01 18:37:50 -08:00

db_connect_postgres.go

settings encrypt on Postgres, and the write pool is not pinned to one

2026-08-13 12:26:38 -07:00

db_connect.go

Ask the SQLite engine for its math functions instead of asking the build

2026-08-04 09:27:45 -07:00

db_model_test.go

Use base

2025-02-10 11:58:49 -06:00

db_model.go

merge v0.23.0-rc changes

2024-09-29 21:09:46 +03:00

db_retry_test.go

a backup that cannot hold the database refuses, and a deadlock is retried

2026-08-13 13:09:18 -07:00

db_retry.go

a backup that cannot hold the database refuses, and a deadlock is retried

2026-08-13 13:09:18 -07:00

db_table_test.go

they are Bases, one per org — the word tenant is gone

2026-08-10 18:23:40 -07:00

db_table.go

a Base can say where it keeps its records, and reclaim what they no longer use

2026-08-21 11:53:27 -07:00

db_test.go

they are Bases, one per org — the word tenant is gone

2026-08-10 18:23:40 -07:00

db_tx_test.go

core: drop password field + reset-token + MFA/OTP/AuthAlert config

2026-05-15 03:19:02 -07:00

db_tx.go

a backup that cannot hold the database refuses, and a deadlock is retried

2026-08-13 13:09:18 -07:00

db.go

they are Bases, one per org — the word tenant is gone

2026-08-10 18:23:40 -07:00

event_request_batch_test.go

Use base

2025-02-10 11:58:49 -06:00

event_request_batch.go

Use base

2025-02-10 11:58:49 -06:00

event_request_test.go

A saved user's org authority is refused with any modifier, and hidden from its export

2026-10-18 22:33:37 -07:00

event_request.go

this repo is public, so its documentation states contracts

2026-08-13 11:42:43 -07:00

events_nats.go

logger: switch attr-helpers to variadic positional pairs

2026-05-15 03:50:49 -07:00

events.go

Declare operations on the group that serves them

2026-09-17 05:50:27 -07:00

export_test.go

finish removing the Bases twin, and stop asserting on machine speed

2026-08-10 22:37:20 -07:00

field_actor.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_address.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_autodate_test.go

Use base

2025-02-10 11:58:49 -06:00

field_autodate.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_bool_test.go

merge newui branch

2026-04-18 16:50:39 +03:00

field_bool.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_composite_test.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_composite.go

An aggregate reads no private email, and history no removed field

2026-10-19 09:24:43 -07:00

field_currency.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_date_test.go

merge newui branch

2026-04-18 16:50:39 +03:00

field_date.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_editor_test.go

merge newui branch

2026-04-18 16:50:39 +03:00

field_editor.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_email_test.go

merge newui branch

2026-04-18 16:50:39 +03:00

field_email.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_emails.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_file_test.go

merge newui branch

2026-04-18 16:50:39 +03:00

field_file.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_full_name.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_geo_point_test.go

merge newui branch

2026-04-18 16:50:39 +03:00

field_geo_point.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_json_test.go

merge newui branch

2026-04-18 16:50:39 +03:00

field_json.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_links.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_meta.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_number_test.go

merge newui branch

2026-04-18 16:50:39 +03:00

field_number.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_phones.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_rating.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_relation_test.go

merge newui branch

2026-04-18 16:50:39 +03:00

field_relation.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_select_test.go

merge newui branch

2026-04-18 16:50:39 +03:00

field_select.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_test.go

merge newui branch

2026-04-18 16:50:39 +03:00

field_text_test.go

merge newui branch

2026-04-18 16:50:39 +03:00

field_text.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field_url_test.go

merge newui branch

2026-04-18 16:50:39 +03:00

field_url.go

Field types for people and money, and the caller's org authority in rules

2026-10-18 20:41:15 -07:00

field.go

An aggregate reads no private email, and history no removed field

2026-10-19 09:24:43 -07:00

fields_list_test.go

merge newui branch

2026-04-18 16:50:39 +03:00

fields_list.go

applied lint typo fixes

2026-03-04 22:31:27 +02:00

log_model.go

feat: Base platform — CRDT privacy, React admin, on-chain anchor SDK

2026-03-01 18:00:00 -08:00

log_printer_test.go

they are Bases, one per org — the word tenant is gone

2026-08-10 18:23:40 -07:00

log_printer.go

Use base

2025-02-10 11:58:49 -06:00

log_query_test.go

they are Bases, one per org — the word tenant is gone

2026-08-10 18:23:40 -07:00

log_query.go

the storage tier can address the backend it selects

2026-08-11 10:39:19 -07:00

migrations_list_test.go

Use base

2025-02-10 11:58:49 -06:00

migrations_list.go

[#5618] added support to conditionally reapply migrations

2024-10-08 16:25:05 +03:00

migrations_runner_test.go

they are Bases, one per org — the word tenant is gone

2026-08-10 18:23:40 -07:00

migrations_runner.go

the storage tier can address the backend it selects

2026-08-11 10:39:19 -07:00

network_middleware_test.go

peers authenticate by reachability, so the peer list is the whole trust set

2026-08-13 17:25:01 -07:00

network_middleware.go

peers authenticate by reachability, so the peer list is the whole trust set

2026-08-13 17:25:01 -07:00

notify_watcher_test.go

the storage tier can address the backend it selects

2026-08-11 10:39:19 -07:00

notify_watcher.go

finish removing the Bases twin, and stop asserting on machine speed

2026-08-10 22:37:20 -07:00

record_field_resolver_negation_test.go

what cannot be built is refused where it is built, not rendered

2026-08-13 15:46:02 -07:00

record_field_resolver_replace_expr.go

what cannot be built is refused where it is built, not rendered

2026-08-13 15:46:02 -07:00

record_field_resolver_runner.go

An aggregate reads no private email, and history no removed field

2026-10-19 09:24:43 -07:00

record_field_resolver_test.go

the storage tier can address the backend it selects

2026-08-11 10:39:19 -07:00

record_field_resolver.go

the storage tier can address the backend it selects

2026-08-11 10:39:19 -07:00

record_history_test.go

A record's history, written in the record's own transaction

2026-10-18 21:25:32 -07:00

record_history.go

A record's history, written in the record's own transaction

2026-10-18 21:25:32 -07:00

record_model_auth_test.go

core: drop password field + reset-token + MFA/OTP/AuthAlert config

2026-05-15 03:19:02 -07:00

record_model_auth.go

core: drop password field + reset-token + MFA/OTP/AuthAlert config

2026-05-15 03:19:02 -07:00

record_model_functions.go

a function is a record, and it reads as whoever invoked it

2026-08-13 19:56:34 -07:00

record_model_superusers_test.go

Use base

2025-02-10 11:58:49 -06:00

record_model_superusers.go

a Base is addressed at /v1/bases, and Base stops running a second auth

2026-08-10 19:18:08 -07:00

record_model_test.go

the storage tier can address the backend it selects

2026-08-11 10:39:19 -07:00

record_model.go

the storage tier can address the backend it selects

2026-08-11 10:39:19 -07:00

record_proxy_test.go

Use base

2025-02-10 11:58:49 -06:00

record_proxy.go

merge v0.23.0-rc changes

2024-09-29 21:09:46 +03:00

record_query_expand_test.go

skip duplicated records ids from the IN expand

2026-05-01 19:16:53 +03:00

record_query_expand.go

the storage tier can address the backend it selects

2026-08-11 10:39:19 -07:00

record_query_test.go

Declare operations on the group that serves them

2026-09-17 05:50:27 -07:00

record_query.go

they are Bases, one per org — the word tenant is gone

2026-08-10 18:23:40 -07:00

record_tokens_test.go

core: drop password field + reset-token + MFA/OTP/AuthAlert config

2026-05-15 03:19:02 -07:00

record_tokens.go

core: drop password field + reset-token + MFA/OTP/AuthAlert config

2026-05-15 03:19:02 -07:00

settings_model_test.go

[#6410] added rate limit option to exclude IPs/CIDR subnets

2026-05-05 17:29:25 +03:00

settings_model.go

settings encrypt on Postgres, and the write pool is not pinned to one

2026-08-13 12:26:38 -07:00

settings_query_test.go

Use base

2025-02-10 11:58:49 -06:00

settings_query.go

settings encrypt on Postgres, and the write pool is not pinned to one

2026-08-13 12:26:38 -07:00

sqlite_math_test.go

Ask the SQLite engine for its math functions instead of asking the build

2026-08-04 09:27:45 -07:00

sqlite_math.go

Ask the SQLite engine for its math functions instead of asking the build

2026-08-04 09:27:45 -07:00

syscall_wasm.go

Rebrand PocketBase imports to Hanzo Base across all Go files

2026-02-27 09:43:39 -08:00

syscall.go

renamed to execve to make it more clear

2025-08-22 20:47:58 +03:00

system_alert_test.go

Name Base's own history and data dirs only

2026-09-11 00:13:34 -07:00

system_alert.go

base: complete pocketbase→base rename; Base = pure IAM client

2026-06-10 21:29:14 -07:00

tasks_embed_test.go

tasks: the embedded engine listens on a socket, not a port

2026-07-28 23:03:48 -07:00

view_test.go

they are Bases, one per org — the word tenant is gone

2026-08-10 18:23:40 -07:00

view.go

the storage tier can address the backend it selects

2026-08-11 10:39:19 -07:00

where_test.go

Filters written as data, and the figures a list shows

2026-10-18 21:18:59 -07:00

where.go

Filters written as data, and the figures a list shows

2026-10-18 21:18:59 -07:00