Make rawdatastore API safer for writing filters.

impl/memory/raw_datastore_query.go

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 package memory
 
 import (
         "bytes"
         "errors"
         "fmt"
@@ skipping 220 matching lines @@
         offset              int32
 
         start queryCursor
         end   queryCursor
 
         err error
 }
 
 var _ rds.Query = (*queryImpl)(nil)
 
-type queryIterImpl struct {
-        idx *queryImpl
-}
-
-var _ rds.Iterator = (*queryIterImpl)(nil)
-
-func (q *queryIterImpl) Cursor() (rds.Cursor, error) {
-        if q.idx.err != nil {
-                return nil, q.idx.err
-        }
-        return nil, nil
-}
-
-func (q *queryIterImpl) Next(dst rds.PropertyLoadSaver) (rds.Key, error) {
-        if q.idx.err != nil {
-                return nil, q.idx.err
-        }
-        return nil, nil
-}
-
 func (q *queryImpl) normalize() (ret *queryImpl) {
         // ported from GAE SDK datastore_index.py;Normalize()
         ret = q.clone()
 
         bs := newMemStore()
 
         eqProperties := bs.MakePrivateCollection(nil)
 
         ineqProperties := bs.MakePrivateCollection(nil)
 
@@ skipping 114 matching lines @@
 
         ineqPropName := ""
         for _, f := range ret.filter {
                 if f.field == "__key__" {
                         k, ok := f.value.(rds.Key)
                         if !ok {
                                 ret.err = errors.New(
                                         "gae/memory: __key__ filter value must be a Key")
                                 return
                         }
-                        if !rds.KeyValid(k, ret.ns, false) {
+                        if !rds.KeyValid(k, false, globalAppID, q.ns) {
                                 // See the comment in queryImpl.Ancestor; basically this check
                                 // never happens in the real env because the SDK silently swallows
                                 // this condition :/
                                 ret.err = rds.ErrInvalidKey
                                 return
                         }
+                        if k.Namespace() != ns {
+                                ret.err = fmt.Errorf("bad namespace: %q (expected %q)", k.Namespace(), ns)
+                                return
+                        }
                         // __key__ filter app is X but query app is X
                         // __key__ filter namespace is X but query namespace is X
                 }
                 // if f.op == qEqual and f.field in ret.project_fields
                 //   "cannot use projection on a proprety with an equality filter"
 
                 if f.op.isINEQOp() {
                         if ineqPropName == "" {
                                 ineqPropName = f.field
                         } else if f.field != ineqPropName {
@@ skipping 61 matching lines @@
         ret.project = append([]string(nil), q.project...)
         return &ret
 }
 
 func (q *queryImpl) Ancestor(k rds.Key) rds.Query {
         q = q.clone()
         q.ancestor = k
         if k == nil {
                 // SDK has an explicit nil-check
                 q.err = errors.New("datastore: nil query ancestor")
-        } else if !rds.KeyValid(k, q.ns, false) {
+        } else if !rds.KeyValid(k, false, globalAppID, q.ns) {
                 // technically the SDK implementation does a Weird Thing (tm) if both the
                 // stringID and intID are set on a key; it only serializes the stringID in
                 // the proto. This means that if you set the Ancestor to an invalid key,
                 // you'll never actually hear about it. Instead of doing that insanity, we
                 // just swap to an error here.
                 q.err = rds.ErrInvalidKey
+        } else if k.Namespace() != q.ns {
+                q.err = fmt.Errorf("bad namespace: %q (expected %q)", k.Namespace(), q.ns)
         }
         return q
 }
 
 func (q *queryImpl) Distinct() rds.Query {
         q = q.clone()
         q.distinct = true
         return q
 }
 
@@ skipping 83 matching lines @@
         }
         q.end = curs
         return q
 }
 
 func (q *queryImpl) EventualConsistency() rds.Query {
         q = q.clone()
         q.eventualConsistency = true
         return q
 }