uqa-execution 0.3.0

Volcano physical operators with row-batch pipelines
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

//
// Unified Query Algebra
//
// Copyright (c) 2023-2026 Cognica, Inc.
//

//! Persist every table-shaped ACL candidate before publishing any registry update.
use super::context::{TableGrantContext, TableGrantState};
use uqa_sql::{
    catalog::security::{
        table_grants::{
            ForeignTablePrivilegeUpdate, ResolvedTableGrantTarget, TableGrantApplication,
            ViewPrivilegeUpdate,
        },
        TableSecurity,
    },
    SQLError,
};
pub(super) type TablePrivilegeUpdate<'a> = (String, Box<dyn TableGrantState + 'a>, TableSecurity);
pub(super) fn table_privilege_updates<'a>(
    targets: Vec<(&ResolvedTableGrantTarget, Box<dyn TableGrantState + 'a>)>,
    application: &TableGrantApplication<'_>,
    notices: &mut Vec<(&'static str, String)>,
) -> Result<Vec<TablePrivilegeUpdate<'a>>, SQLError> {
    let mut updates = Vec::new();
    for (target, table) in targets {
        let current = table.security();
        let (next, grantable) = application.apply(&current)?;
        application.record_warning(grantable, &target.relation, notices);
        if next != current {
            updates.push((target.name.clone(), table, next));
        }
    }
    Ok(updates)
}
pub(super) fn persist_table_privilege_updates(
    context: &TableGrantContext<'_>,
    updates: &[TablePrivilegeUpdate<'_>],
    view_updates: &[ViewPrivilegeUpdate],
    foreign_updates: &[ForeignTablePrivilegeUpdate],
) -> Result<(), SQLError> {
    for (name, table, security) in updates {
        table
            .persist_security(name, security)
            .map_err(|error| SQLError::Internal(format!("persist table privileges: {error}")))?;
    }
    if let Some(catalog) = context.catalog {
        for (relation, view) in view_updates {
            if view.persistence == uqa_sql::ast::RelationPersistence::Temporary {
                continue;
            }
            let row = crate::catalog::view::catalog_view_row(relation, view).map_err(|error| {
                SQLError::Internal(format!(
                    "serialize view privileges for `{}`: {error}",
                    relation.qualified_name()
                ))
            })?;
            catalog.save_view(&row).map_err(|error| {
                SQLError::Internal(format!(
                    "persist view privileges for `{}`: {error}",
                    relation.qualified_name()
                ))
            })?;
        }
    }
    for (relation, security) in foreign_updates {
        context.foreign.persist_security(relation, security)?;
    }
    Ok(())
}