| 1 |
# The C1 resource-in-community invariant is sealed by the type system, with one |
| 2 |
# lint-guarded escape hatch. `src/routes/scope.rs` is the canonical account of |
| 3 |
# why the seal exists and what it replaced; this file only says what the lint |
| 4 |
# entry below is for. |
| 5 |
# |
| 6 |
# `Unscoped::into_inner_unchecked` unwraps with no community check, for callers |
| 7 |
# that have no slug to scope against (the trusted internal server-to-server API). |
| 8 |
# It is disallowed below so a `/p/{slug}/…` handler cannot reach for it by |
| 9 |
# accident; the one sanctioned site, in `src/routes/internal.rs`, carries a local |
| 10 |
# `#[allow]`. It is the only lint entry because it is the only unchecked-unwrap |
| 11 |
# primitive: everything else is enforced by the type. |
| 12 |
disallowed-methods = [ |
| 13 |
{ path = "mt_db::queries::Unscoped::into_inner_unchecked", reason = "unwraps a community resource without the C1 scope check; a slug-scoped handler must use Unscoped::in_community via routes::scope::CommunityScope instead" }, |
| 14 |
] |
| 15 |
|