uqa-execution 0.3.0

Volcano physical operators with row-batch pipelines
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119

//
// Unified Query Algebra
//
// Copyright (c) 2023-2026 Cognica, Inc.
//

//! Publish sequence role ownership while retaining the authorization catalog guards.
use super::alteration::SequenceDefinitionCatalog;
use crate::catalog::security::{roles::RoleCatalogGuards, SequenceSecurity};
use crate::schema::publication::dependencies::CatalogPublicationChanges;
use std::{
    collections::BTreeMap,
    ops::{Deref, DerefMut},
};
use uqa_core::RelationIdentity;
use uqa_sql::{
    catalog::roles::{self, RoleReferenceNames},
    schema::sequences::{lifecycle::SequenceLifecycleCatalog, ownership},
    SQLError,
};

pub trait SequenceRoleAccess {
    fn ensure_sequence_owner(
        &self,
        name: &str,
        relation: &RelationIdentity,
    ) -> Result<String, SQLError>;
    fn current_user_is_superuser(&self) -> bool;
}
pub trait SequenceSecurityPublication {
    fn security(&self, relation: &RelationIdentity) -> Option<SequenceSecurity>;
    fn persist_security(
        &self,
        name: &str,
        relation: &RelationIdentity,
        security: &SequenceSecurity,
    ) -> Result<(), SQLError>;
    fn publish_security(&self, relation: &RelationIdentity, security: SequenceSecurity);
}
pub struct SequenceRoleOwnershipContext<'a> {
    pub roles: &'a dyn RoleCatalogGuards,
    pub session: &'a dyn RoleReferenceNames,
    pub access: &'a dyn SequenceRoleAccess,
    pub schemas: &'a dyn SequenceLifecycleCatalog,
    pub metadata: &'a dyn SequenceDefinitionCatalog,
    pub security: &'a dyn SequenceSecurityPublication,
    pub changes: &'a dyn CatalogPublicationChanges,
}
pub fn alter_sequence_role_owner(
    context: &SequenceRoleOwnershipContext<'_>,
    name: &str,
    relation: &RelationIdentity,
    requested_owner: &str,
) -> Result<(), SQLError> {
    let current_owner = context.access.ensure_sequence_owner(name, relation)?;
    let new_owner = roles::resolve_role_reference(context.session, requested_owner);
    let roles = context.roles.role_definitions();
    roles::require_role_exists(&roles, &new_owner)?;
    let memberships = context.roles.role_memberships();
    let current_user = context.session.current_user_name();
    roles::require_set_role(&roles, &memberships, &current_user, &new_owner)?;
    let state = context
        .metadata
        .state(relation)
        .ok_or_else(|| SQLError::Internal(format!("sequence `{name}` disappeared")))?;
    ownership::reject_owned_sequence_role_change(&relation.name, state.owner.is_some())?;
    if current_owner == new_owner {
        return Ok(());
    }
    if !context.access.current_user_is_superuser() {
        context
            .schemas
            .require_schema_create(&relation.schema, &new_owner)?;
    }
    let mut security = context
        .security
        .security(relation)
        .ok_or_else(|| SQLError::Internal(format!("sequence `{name}` has no security metadata")))?;
    crate::catalog::security::sequence::rewrite_acl_owner(&mut security, &new_owner);
    context
        .security
        .persist_security(name, relation, &security)?;
    context.security.publish_security(relation, security);
    drop(memberships);
    drop(roles);
    context.changes.catalog_registry_changed();
    Ok(())
}

pub type OwnedSequenceSecurityRead<'a> =
    Box<dyn Deref<Target = BTreeMap<RelationIdentity, SequenceSecurity>> + 'a>;
pub type OwnedSequenceSecurityWrite<'a> =
    Box<dyn DerefMut<Target = BTreeMap<RelationIdentity, SequenceSecurity>> + 'a>;

pub trait OwnedSequenceSecurityCatalog {
    fn owned_sequences(&self, table_object_id: [u8; 16]) -> Vec<RelationIdentity>;
    fn security_registry(&self) -> OwnedSequenceSecurityRead<'_>;
}

pub fn table_owned_sequence_owner_updates(
    catalog: &dyn OwnedSequenceSecurityCatalog,
    table_object_id: [u8; 16],
    new_owner: &str,
) -> Result<Vec<(RelationIdentity, SequenceSecurity)>, SQLError> {
    let owned = catalog.owned_sequences(table_object_id);
    let registry = catalog.security_registry();
    let mut updates = Vec::with_capacity(owned.len());
    for relation in owned {
        let mut security = registry.get(&relation).cloned().ok_or_else(|| {
            SQLError::Internal(format!(
                "sequence `{}` has no security metadata",
                relation.qualified_name()
            ))
        })?;
        crate::catalog::security::sequence::rewrite_acl_owner(&mut security, new_owner);
        updates.push((relation, security));
    }
    Ok(updates)
}