uqa-sql 0.4.0

PostgreSQL-compatible SQL compiler built on libpg_query
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125

//
// Unified Query Algebra
//
// Copyright (c) 2023-2026 Cognica, Inc.
//

//! Role references of session-local relations are catalog dependencies after commit.

use super::context::TemporaryRoleDependencyCatalog;
use crate::{
    ast::RelationPersistence,
    catalog::{
        roles::RoleDefinition,
        security::{dependencies::AclRoleReferences, BoundTableSecurity},
    },
    SQLError,
};
use std::collections::{BTreeMap, BTreeSet};

pub fn role_dependencies(
    catalog: &dyn TemporaryRoleDependencyCatalog,
    roles: &BTreeMap<String, RoleDefinition>,
    limit: usize,
) -> Result<BTreeSet<u32>, SQLError> {
    let mut referenced = BTreeSet::new();
    {
        let tables = catalog.tables();
        for (_, table) in tables.iter() {
            if table.persistence() == RelationPersistence::Temporary {
                table_dependencies(&table.security(), roles, limit, &mut referenced)?;
            }
        }
    }
    {
        let views = catalog.views();
        for view in views.values() {
            if view.persistence == RelationPersistence::Temporary {
                table_dependencies(&view.security(), roles, limit, &mut referenced)?;
            }
        }
    }
    {
        let sequences = catalog.sequences();
        let persistence = catalog.sequence_persistence();
        for (name, security) in sequences.iter() {
            if persistence.get(name) == Some(&RelationPersistence::Temporary) {
                let security = security.resolve(roles).map_err(SQLError::Internal)?;
                add_role(&security.role_owner, roles, limit, &mut referenced)?;
                acl_dependencies(
                    security.acl.as_deref().unwrap_or_default(),
                    roles,
                    limit,
                    &mut referenced,
                )?;
            }
        }
    }
    Ok(referenced)
}

fn table_dependencies(
    security: &BoundTableSecurity,
    roles: &BTreeMap<String, RoleDefinition>,
    limit: usize,
    referenced: &mut BTreeSet<u32>,
) -> Result<(), SQLError> {
    // Validate every captured endpoint before publishing native OID leases.
    let named = security.resolve(roles).map_err(SQLError::Internal)?;
    add_role(&named.role_owner, roles, limit, referenced)?;
    acl_dependencies(
        named.acl.as_deref().unwrap_or_default(),
        roles,
        limit,
        referenced,
    )?;
    for acl in named.column_acls.values() {
        acl_dependencies(acl, roles, limit, referenced)?;
    }
    Ok(())
}

fn acl_dependencies<T: AclRoleReferences>(
    acl: &[T],
    roles: &BTreeMap<String, RoleDefinition>,
    limit: usize,
    referenced: &mut BTreeSet<u32>,
) -> Result<(), SQLError> {
    for entry in acl {
        let (grantee, grantor) = entry.role_references();
        if let Some(grantee) = grantee {
            add_role(grantee, roles, limit, referenced)?;
        }
        if let Some(grantor) = grantor {
            add_role(grantor, roles, limit, referenced)?;
        }
    }
    Ok(())
}

fn add_role(
    name: &str,
    roles: &BTreeMap<String, RoleDefinition>,
    limit: usize,
    referenced: &mut BTreeSet<u32>,
) -> Result<(), SQLError> {
    let role = roles.get(name).ok_or_else(|| SQLError::Routine {
        sqlstate: "42704".into(),
        message: format!("role \"{name}\" does not exist"),
    })?;
    if role.oid <= 0 {
        return Err(SQLError::Internal("invalid role OID".into()));
    }
    if role.oid != 10 {
        referenced.insert(
            u32::try_from(role.oid).map_err(|_| SQLError::Internal("invalid role OID".into()))?,
        );
        if referenced.len() > limit {
            return Err(SQLError::Routine {
                sqlstate: "53200".into(),
                message: "temporary role dependency capacity exhausted".into(),
            });
        }
    }
    Ok(())
}