uqa-execution 0.3.5

Volcano physical operators with row-batch pipelines
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

//
// Unified Query Algebra
//
// Copyright (c) 2023-2026 Cognica, Inc.
//

//! Select maintenance targets and release catalog guards before reporting skipped tables.
use super::table_authorization::TableAuthorizationContext;
use crate::catalog::notices::CatalogNotices;
use uqa_sql::{
    catalog::security::table::{role_has_privilege, TableAclPrivilege, TablePrivilegeCheck},
    SQLError,
};
pub struct TableMaintenanceContext<'a> {
    pub authorization: TableAuthorizationContext<'a>,
    pub notices: &'a dyn CatalogNotices,
}
impl TableMaintenanceContext<'_> {
    pub fn maintenance_table_names(&self, operation: &str) -> Result<Vec<String>, SQLError> {
        self.authorization
            .registry
            .refresh_tables()
            .map_err(|error| SQLError::Internal(format!("load tables for {operation}: {error}")))?;
        let tables = self
            .authorization
            .registry
            .tables()
            .security_entries()
            .collect::<Vec<_>>();
        let current_user = self.authorization.names.current_user_name();
        let roles = self.authorization.roles.role_definitions();
        let memberships = self.authorization.roles.role_memberships();
        let mut permitted = Vec::new();
        let mut denied = Vec::new();
        for (relation, security) in tables {
            if role_has_privilege(
                &security,
                &current_user,
                TablePrivilegeCheck {
                    privilege: TableAclPrivilege::Maintain,
                    grant_option: false,
                },
                &roles,
                &memberships,
            ) {
                permitted.push(relation.qualified_name());
            } else {
                denied.push(relation.name);
            }
        }
        drop(memberships);
        drop(roles);
        for name in denied {
            self.notices.notice(
                "WARNING",
                &format!("permission denied to {operation} \"{name}\", skipping it"),
            );
        }
        Ok(permitted)
    }
}