uqa-sql 0.3.0

PostgreSQL-compatible SQL compiler built on libpg_query
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89

//
// Unified Query Algebra
//
// Copyright (c) 2023-2026 Cognica, Inc.
//

//! Decode and validate durable view definitions and migrated public metadata.
use super::StoredView;
use crate::{catalog::roles::guards::RoleCatalogGuards, plan::QueryPlan, RowSchema};
use std::collections::{BTreeMap, BTreeSet};
use uqa_core::RelationIdentity;

#[derive(serde::Deserialize)]
#[serde(untagged)]
pub enum RestoredView {
    Current(StoredView),
    Legacy(QueryPlan),
}

pub fn validate_restored_view_object_ids(
    views: &BTreeMap<RelationIdentity, StoredView>,
) -> Result<(), String> {
    let mut object_ids = BTreeSet::new();
    for (relation, view) in views {
        if !object_ids.insert(view.object_id) {
            return Err(format!(
                "view `{}` has a duplicate object identity",
                relation.qualified_name()
            ));
        }
    }
    Ok(())
}

pub fn validate_restored_view_security(
    roles: &dyn RoleCatalogGuards,
    view_name: &str,
    view: &StoredView,
) -> Result<(), String> {
    if !roles.role_definitions().contains_key(&view.role_owner) {
        return Err(format!(
            "view `{view_name}` is owned by missing role `{}`",
            view.role_owner
        ));
    }
    crate::catalog::security::table::validate_table_security_invariants(
        &view.security(),
        view.output_columns.as_deref(),
        &roles.role_definitions(),
    )
    .map_err(|error| format!("view `{view_name}` has invalid privilege metadata: {error}"))?;
    Ok(())
}
pub fn validate_migrated_view_security(
    roles: &dyn RoleCatalogGuards,
    views: &BTreeMap<RelationIdentity, StoredView>,
) -> Result<(), String> {
    for (relation, view) in views {
        let output_columns = view.output_columns.as_deref().ok_or_else(|| {
            format!(
                "view `{}` has no public column metadata after catalog migration",
                relation.qualified_name()
            )
        })?;
        crate::catalog::security::table::validate_table_security_invariants(
            &view.security(),
            Some(output_columns),
            &roles.role_definitions(),
        )
        .map_err(|error| {
            format!(
                "view `{}` has invalid privilege metadata after migration: {error}",
                relation.qualified_name()
            )
        })?;
    }
    Ok(())
}
pub fn restored_view_output_columns(schema: &RowSchema) -> Vec<String> {
    schema
        .columns()
        .iter()
        .enumerate()
        .map(|(position, column)| schema.public_name(position).unwrap_or(column).to_string())
        .collect()
}

#[cfg(test)]
mod tests;