uqa-sql 0.4.0

PostgreSQL-compatible SQL compiler built on libpg_query
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85

//
// Unified Query Algebra
//
// Copyright (c) 2023-2026 Cognica, Inc.
//

//! Revocation resolves every recipient against the original target graph before publishing changes.

use super::{
    super::{clear_membership_admin, revoke_membership},
    BTreeMap, MembershipTarget, MembershipUpdate, RoleBinding, RoleDefinition, RoleMembership,
    RoleMembershipKey, RoleMembershipOptions, SQLError,
};

pub struct MembershipRevocation<'a> {
    target: &'a MembershipTarget,
    before: BTreeMap<RoleMembershipKey, RoleMembership>,
    after: BTreeMap<RoleMembershipKey, RoleMembership>,
}

impl<'a> MembershipRevocation<'a> {
    pub fn new(
        target: &'a MembershipTarget,
        memberships: &BTreeMap<RoleMembershipKey, RoleMembership>,
    ) -> Self {
        let before = memberships
            .iter()
            .filter(|(key, _)| key.role == target.role.identity())
            .map(|(key, value)| (*key, value.clone()))
            .collect::<BTreeMap<_, _>>();
        Self {
            target,
            after: before.clone(),
            before,
        }
    }

    /// Returns a warning only when the original graph lacks the recipient, including duplicate or already cascaded requests.
    pub fn member(
        &mut self,
        roles: &BTreeMap<String, RoleDefinition>,
        member: &RoleBinding,
    ) -> Result<Option<String>, SQLError> {
        let key = RoleMembershipKey {
            role: self.target.role.identity(),
            member: member.identity(),
            grantor: self.target.grantor.identity(),
        };
        if !self.before.contains_key(&key) {
            return self
                .target
                .membership_notice(roles, member, "has not been granted")
                .map(Some);
        }
        let options = self.target.options;
        if options == RoleMembershipOptions::default() {
            revoke_membership(&mut self.after, &key, self.target.cascade, true)?;
        } else {
            if options.admin == Some(false)
                && self.after.get(&key).is_some_and(|row| row.admin_option)
            {
                clear_membership_admin(&mut self.after, &key, self.target.cascade)?;
            }
            if let Some(row) = self.after.get_mut(&key) {
                if options.inherit == Some(false) {
                    row.inherit_option = false;
                }
                if options.set == Some(false) {
                    row.set_option = false;
                }
            }
        }
        Ok(None)
    }

    pub fn into_updates(self) -> Vec<MembershipUpdate> {
        self.before
            .into_iter()
            .filter_map(|(key, before)| {
                let after = self.after.get(&key).cloned();
                (after.as_ref() != Some(&before)).then_some(MembershipUpdate { before, after })
            })
            .collect()
    }
}