Field-Level Policies

caller request
    |
    v
query.ApplyPolicy(ctx)     the only entry point; returns a guarded handle
    |
    v
sanitize                   drop or refuse denied fields, restrict operators,
                           enforce caps, inject aliases and forced predicates
    |
    v
existing DynamicWhere      untouched
    |
    v
transform                  mask, mutate, default, generalize, truncate, format
    |
    v
PolicyTrace                what the policy did: always on LastTrace, and on
                           result.Policy as IncludeTraceInResult decides
                           (off under the strict tier by default)

// Once, at startup. A second call is refused: the tier is read by every
// request thread, and a posture that can change mid-flight can be relaxed.
DwPolicy.Configure(new DwPolicyOptions
{
    Tier = DwTier.Convenience,
    HashSalt = secret,
});

// Once per request, never once per query. A context that skipped this is
// refused: ApplyPolicy throws PolicyContextNotPrepared, store or no store.
var caller = await DwPolicy.PrepareAsync(
    new DwPolicyContext()
        .WithSubject(DwSubjectKind.User, userId)
        .WithSubject(DwSubjectKind.Role, "Support")
        .WithSubject(DwSubjectKind.Tenant, tenantId)
        .WithValue("TenantId", tenantId));

// Then query through the guarded handle instead of the raw IQueryable.
var result = await db.Employees.ApplyPolicy(caller).ToListAsync(filter);

[DwEntity(RequirePolicy = true)]        // an unguarded DynamicWhere read throws
public class Employee
{
    [DwMask(MaskStrategy.Email), DwNoOrder]
    public string Email { get; set; }    // s*************@c******.com on the way out

    [DwForceWhere(Operator.Equal, Value = "true")]
    public bool IsActive { get; set; }   // ANDed into every guarded query

    [DwGeneralize(GeneralizeMode.Round, Step = 5000,
                  AllowAggregate = true, MinGroupSize = 5)]
    [DwNoOrder, DwAudit, DwCost(10)]
    public decimal Salary { get; set; }  // rounded; aggregatable over groups of 5+

    [DwDenied]
    public JsonDocument? WorkSchedule { get; set; }
}

// PolicyQueryable<T>: new in 3.2.0, beside the overloads without a token
Task<FilterResult<T>>       ToListAsync(Filter filter, CancellationToken cancellationToken)
Task<FilterResult<T>>       ToListAsync(Filter filter, bool getQueryString, CancellationToken cancellationToken)
Task<FilterResult<dynamic>> ToListAsyncDynamic(Filter filter, CancellationToken cancellationToken)
Task<FilterResult<dynamic>> ToListAsyncDynamic(Filter filter, bool getQueryString, CancellationToken cancellationToken)
Task<SummaryResult>         ToListAsync(Summary summary, CancellationToken cancellationToken)
Task<SummaryResult>         ToListAsync(Summary summary, bool getQueryString, CancellationToken cancellationToken)
Task<SegmentResult<T>>      ToListAsync(Segment segment, CancellationToken cancellationToken)

// In a minimal API, a CancellationToken parameter is the request's own:
// a client that disconnects cancels the count or the read.
var result = await db.Employees.ApplyPolicy(caller).ToListAsync(filter, cancellationToken);