uqa-execution 0.4.5

Volcano physical operators with row-batch pipelines
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108

//
// Unified Query Algebra
//
// Copyright (c) 2023-2026 Cognica, Inc.
//

//! Persist every table-shaped ACL candidate before publishing any registry update.
use super::{
    super::system_relations::SystemPrivilegeUpdate,
    context::{TableGrantContext, TableGrantState},
};
use uqa_sql::{
    catalog::security::{
        table_grants::{ResolvedTableGrantTarget, TableGrantApplication},
        BoundTableSecurity,
    },
    SQLError,
};
pub(super) type TablePrivilegeUpdate<'a> =
    (String, Box<dyn TableGrantState + 'a>, BoundTableSecurity);

pub(super) fn system_privilege_updates(
    context: &TableGrantContext<'_>,
    targets: &[ResolvedTableGrantTarget],
    application: &TableGrantApplication<'_>,
    notices: &mut Vec<(&'static str, String)>,
    dependencies: &mut std::collections::BTreeSet<String>,
) -> Result<Vec<SystemPrivilegeUpdate>, SQLError> {
    let mut updates = Vec::new();
    for target in targets {
        let Some(relation) = super::targets::system_target(target) else {
            continue;
        };
        uqa_sql::catalog::security::table_grants::validate_requested_columns(
            &target.relation,
            &relation.column_names(),
            application.requested,
        )?;
        let current = context
            .system
            .system_relation_security(relation)
            .resolve(application.roles)
            .map_err(SQLError::Internal)?;
        let (next, grantable) = application.apply_to(target, &current)?;
        uqa_sql::catalog::security::dependencies::added_table_acl_roles(
            &current,
            &next,
            dependencies,
        );
        uqa_sql::catalog::security::system_relations::validate_security(
            relation,
            &next,
            application.roles,
        )
        .map_err(SQLError::Internal)?;
        application.record_warning(grantable, &target.relation, notices);
        let bound =
            BoundTableSecurity::bind(&next, application.roles).map_err(SQLError::Internal)?;
        for column in application
            .replaced_tuples(&current, &next)
            .into_iter()
            .filter(|column| target.includes_acl_tuple(column.as_deref()))
        {
            let acl = column.as_ref().map_or_else(
                || bound.acl.clone().unwrap_or_default(),
                |column| bound.column_acls.get(column).cloned().unwrap_or_default(),
            );
            updates.push(
                SystemPrivilegeUpdate::new(relation, column, acl)
                    .map_err(|error| SQLError::Internal(error.to_string()))?,
            );
        }
    }
    Ok(updates)
}
pub(super) fn table_privilege_updates<'a>(
    targets: Vec<(&ResolvedTableGrantTarget, Box<dyn TableGrantState + 'a>)>,
    application: &TableGrantApplication<'_>,
    notices: &mut Vec<(&'static str, String)>,
    dependencies: &mut std::collections::BTreeSet<String>,
) -> Result<Vec<TablePrivilegeUpdate<'a>>, SQLError> {
    let mut updates = Vec::new();
    for (target, table) in targets {
        let current = table
            .security()
            .resolve(application.roles)
            .map_err(SQLError::Internal)?;
        let (next, grantable) = application.apply_to(target, &current)?;
        uqa_sql::catalog::security::dependencies::added_table_acl_roles(
            &current,
            &next,
            dependencies,
        );
        application.record_warning(grantable, &target.relation, notices);
        if application
            .replaced_tuples(&current, &next)
            .iter()
            .any(|column| target.includes_acl_tuple(column.as_deref()))
        {
            updates.push((
                target.name.clone(),
                table,
                BoundTableSecurity::bind(&next, application.roles).map_err(SQLError::Internal)?,
            ));
        }
    }
    Ok(updates)
}