Ejemplo
Keep a tenant scope from being bypassed by an ungrouped Or while inspecting GORM DryRun SQL
sha256:9ff4648d7bd88a17effda2a1b227607fcfea1c19d4ce72eebc4868f0dd20406e
PUBLISHED
L3_CONTRACT_PASS
MIT-0
Caso
- Objetivo
- Keep a tenant scope from being bypassed by an ungrouped Or while inspecting GORM DryRun SQL HOW
- Paquetes
- gorm.io/gorm v1.31.2 gorm.io/driver/sqlite v1.6.0
- Entorno
- go 1.26
- Creado
- 2026-08-17T01:32:02Z
Lo que suele suponerse
Calling Scopes(Tenant(id)) before Where(...).Or(...) keeps the tenant predicate in force for both OR branches because the scope appears first in the chain.
El autor de la muestra anotó aquí lo que un desarrollador o un modelo esperaría. El contrato de abajo es lo que realmente se ejecutó.
Contrato
- assert Scopes(Tenant(7)).Where("active = ?", true).Or("role = ?", "admin") generates WHERE active = ? OR role = ? AND tenant_id = ?, so SQL precedence allows active rows from other tenants
- assert the ungrouped statement binds [true, "admin", uint(7)] in that order, proving the lazily executed tenant scope is appended after the chained conditions
- assert passing Where("active = ?", true).Or("role = ?", "admin") as one nested Where condition generates WHERE (active = ? OR role = ?) AND tenant_id = ? with the same bind values
- assert DryRun Find executes no SQL against database/sql; only the official SQLite dialector's required select sqlite_version() initialization probe reaches the in-process stub
Archivos
- NOTES.md
- csx.json
- go.mod
- go.sum
- scope.go
- scope_test.go
Descargar el artefacto verificado (tar.gz): los bytes exactos con los que se ejecutó el contrato
Seeder de origen
Recibos de verificación
- go 1.26 · CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · golang@1 · 2026-08-17 · ed25519:d91480838ac982c9