uqa-sql 0.4.0

PostgreSQL-compatible SQL compiler built on libpg_query
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109

//
// Unified Query Algebra
//
// Copyright (c) 2023-2026 Cognica, Inc.
//

//! Catalog fixtures execute the SQL mutation descriptions with deterministic test identities.

use super::{command::*, *};
use crate::{
    ast::{GrantRoleStmt, RoleMembershipOptions},
    catalog::roles::{RoleReference, RoleReferenceNames},
};

pub(crate) struct Names<'a>(pub &'a str);
impl RoleReferenceNames for Names<'_> {
    fn outer_role(&self) -> crate::catalog::roles::RoleReference {
        self.current_role()
    }
    fn current_role(&self) -> RoleReference {
        self.0.into()
    }
    fn session_role(&self) -> RoleReference {
        "uqa".into()
    }
}

fn oid(memberships: &BTreeMap<RoleMembershipKey, RoleMembership>) -> i64 {
    memberships
        .values()
        .map(|value| value.oid)
        .max()
        .unwrap_or(30_000)
        + 1
}

pub(crate) fn apply_change(
    memberships: &mut BTreeMap<RoleMembershipKey, RoleMembership>,
    change: MembershipChange,
) -> Result<(), SQLError> {
    match change {
        MembershipChange::Insert(insert) => {
            let row = insert.with_oid(oid(memberships))?;
            memberships.insert(row.key(), row);
        }
        MembershipChange::Update(updates) => {
            for update in updates {
                update.apply(memberships)?;
            }
        }
        MembershipChange::Notice { .. } => {}
    }
    Ok(())
}

pub(crate) fn apply_grant_role_statement(
    roles: &BTreeMap<String, RoleDefinition>,
    memberships: &mut BTreeMap<RoleMembershipKey, RoleMembership>,
    current: &str,
    statement: &GrantRoleStmt,
) -> Result<(), SQLError> {
    let recipients = MembershipRecipients::bind(&Names(current), roles, statement)?;
    for target in &statement.granted_roles {
        let bound = MembershipTarget::authorize(
            roles,
            memberships,
            current,
            &target.clone().into(),
            &recipients,
            statement,
        )?;
        bound.validate_graph(memberships)?;
        if bound.is_grant {
            for member in &bound.members {
                let change = bound.change_for_member(roles, memberships, member)?;
                apply_change(memberships, change)?;
            }
        } else {
            let mut plan = MembershipRevocation::new(&bound, memberships);
            for member in &bound.members {
                plan.member(roles, member)?;
            }
            for update in plan.into_updates() {
                update.apply(memberships)?;
            }
        }
    }
    Ok(())
}

pub(crate) fn insert_membership(
    memberships: &mut BTreeMap<RoleMembershipKey, RoleMembership>,
    role: &str,
    member: &str,
    grantor: &str,
    options: RoleMembershipOptions,
    roles: &BTreeMap<String, RoleDefinition>,
) -> Result<(), SQLError> {
    let target = MembershipTarget {
        role: RoleBinding::from_definition(&roles[role])?,
        grantor: RoleBinding::from_definition(&roles[grantor])?,
        members: vec![RoleBinding::from_definition(&roles[member])?],
        is_grant: true,
        options,
        cascade: false,
    };
    let change = target.change_for_member(roles, memberships, &target.members[0])?;
    apply_change(memberships, change)
}