cratestack-sqlx 0.3.7

Rust-native schema-first framework for typed HTTP APIs, generated clients, and backend services.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122

//! Per-`ReadPredicate` SQL emission. Most predicates are evaluated
//! at render time against `ctx` and collapse to `TRUE`/`FALSE` SQL
//! constants; the field-comparison predicates emit one bind slot.

use std::fmt::Write;

use cratestack_core::CoolContext;
use cratestack_policy::{context_has_role, context_in_tenant};

use crate::ReadPredicate;
use crate::query::{auth_value_to_sql, value_matches_auth_literal};

use super::policy::render_relation_policy_sql;

pub(super) fn render_policy_predicate(
    predicate: ReadPredicate,
    ctx: &CoolContext,
    sql: &mut String,
    bind_index: &mut usize,
) {
    match predicate {
        ReadPredicate::AuthNotNull => {
            sql.push_str(if ctx.is_authenticated() {
                "TRUE"
            } else {
                "FALSE"
            });
        }
        ReadPredicate::AuthIsNull => {
            sql.push_str(if ctx.is_authenticated() {
                "FALSE"
            } else {
                "TRUE"
            });
        }
        ReadPredicate::HasRole { role } => {
            sql.push_str(if context_has_role(ctx, role) {
                "TRUE"
            } else {
                "FALSE"
            });
        }
        ReadPredicate::InTenant { tenant_id } => {
            sql.push_str(if context_in_tenant(ctx, tenant_id) {
                "TRUE"
            } else {
                "FALSE"
            });
        }
        ReadPredicate::AuthFieldEqLiteral { auth_field, value } => {
            sql.push_str(
                if ctx
                    .auth_field(auth_field)
                    .is_some_and(|c| value_matches_auth_literal(c, value))
                {
                    "TRUE"
                } else {
                    "FALSE"
                },
            );
        }
        ReadPredicate::AuthFieldNeLiteral { auth_field, value } => {
            sql.push_str(
                if ctx
                    .auth_field(auth_field)
                    .is_some_and(|c| !value_matches_auth_literal(c, value))
                {
                    "TRUE"
                } else {
                    "FALSE"
                },
            );
        }
        ReadPredicate::FieldIsTrue { column } => {
            let _ = write!(sql, "{column} = TRUE");
        }
        ReadPredicate::FieldEqLiteral { column, .. } => {
            let _ = write!(sql, "{column} = ${bind_index}");
            *bind_index += 1;
        }
        ReadPredicate::FieldNeLiteral { column, .. } => {
            let _ = write!(sql, "{column} != ${bind_index}");
            *bind_index += 1;
        }
        ReadPredicate::FieldEqAuth { column, auth_field } => {
            if auth_value_to_sql(ctx, auth_field).is_some() {
                let _ = write!(sql, "{column} = ${bind_index}");
                *bind_index += 1;
            } else {
                sql.push_str("FALSE");
            }
        }
        ReadPredicate::FieldNeAuth { column, auth_field } => {
            if auth_value_to_sql(ctx, auth_field).is_some() {
                let _ = write!(sql, "{column} != ${bind_index}");
                *bind_index += 1;
            } else {
                sql.push_str("FALSE");
            }
        }
        ReadPredicate::Relation {
            quantifier,
            parent_table,
            parent_column,
            related_table,
            related_column,
            expr,
        } => {
            render_relation_policy_sql(
                quantifier,
                parent_table,
                parent_column,
                related_table,
                related_column,
                expr,
                ctx,
                sql,
                bind_index,
            );
        }
    }
}