uqa-execution 0.3.0

Volcano physical operators with row-batch pipelines
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113

//
// Unified Query Algebra
//
// Copyright (c) 2023-2026 Cognica, Inc.
//

//! Foreign-table authority and durable security persistence.
use crate::schema::foreign_table_alteration::{
    bound_foreign_table_security, ForeignTableAlterCatalog,
};
use uqa_core::RelationIdentity;
use uqa_sql::{
    catalog::{
        roles::{guards::RoleCatalogGuards, role_inherits, RoleReferenceNames},
        security::{
            ownership::RelationOwnerSchemas,
            table::{role_has_table_privilege, TableAclPrivilege},
            TableSecurity,
        },
    },
    SQLError,
};
use uqa_storage::CatalogFacade;
pub struct ForeignAuthorizationContext<'a> {
    pub names: &'a dyn RoleReferenceNames,
    pub roles: &'a dyn RoleCatalogGuards,
    pub schemas: &'a dyn RelationOwnerSchemas,
    pub catalog: &'a dyn ForeignTableAlterCatalog,
}
impl ForeignAuthorizationContext<'_> {
    pub fn ensure_foreign_table_owner(&self, name: &str) -> Result<String, SQLError> {
        let (relation, security) = bound_foreign_table_security(self.catalog, name)?;
        if self.current_user_has_role_privileges(&security.role_owner) {
            return Ok(security.role_owner);
        }
        Err(SQLError::Routine {
            sqlstate: "42501".into(),
            message: format!("must be owner of foreign table {}", relation.name),
        })
    }
    pub fn ensure_foreign_table_privilege(
        &self,
        name: &str,
        privilege: TableAclPrivilege,
    ) -> Result<(), SQLError> {
        let (relation, security) = bound_foreign_table_security(self.catalog, name)?;
        let roles = self.roles.role_definitions();
        let memberships = self.roles.role_memberships();
        if role_has_table_privilege(
            &security,
            &self.names.current_user_name(),
            privilege,
            &roles,
            &memberships,
        ) {
            return Ok(());
        }
        Err(SQLError::Routine {
            sqlstate: "42501".into(),
            message: format!("permission denied for foreign table {}", relation.name),
        })
    }
    pub fn ensure_foreign_table_drop_authority(&self, name: &str) -> Result<(), SQLError> {
        let (relation, security) = bound_foreign_table_security(self.catalog, name)?;
        if self.current_user_has_role_privileges(&security.role_owner)
            || self
                .schemas
                .schema_security(&relation.schema)
                .is_some_and(|schema| self.current_user_has_role_privileges(&schema.role_owner))
        {
            return Ok(());
        }
        Err(SQLError::Routine {
            sqlstate: "42501".into(),
            message: format!("must be owner of foreign table {}", relation.name),
        })
    }
    fn current_user_has_role_privileges(&self, target: &str) -> bool {
        let current = self.names.current_user_name();
        let roles = self.roles.role_definitions();
        let memberships = self.roles.role_memberships();
        role_inherits(&roles, &memberships, &current, target)
    }
}
pub fn persist_foreign_table_security(
    catalog: Option<&dyn CatalogFacade>,
    relation: &RelationIdentity,
    security: &TableSecurity,
) -> Result<(), SQLError> {
    let Some(catalog) = catalog else {
        return Ok(());
    };
    let updated = catalog
        .update_foreign_table_security(
            relation,
            &security.role_owner,
            security.acl.as_deref(),
            &security.column_acls,
        )
        .map_err(|error| {
            SQLError::Internal(format!(
                "persist foreign table security for `{}`: {error}",
                relation.qualified_name()
            ))
        })?;
    if !updated {
        return Err(SQLError::Internal(format!(
            "foreign table `{}` disappeared from durable catalog before security update",
            relation.qualified_name()
        )));
    }
    Ok(())
}