uqa-sql 0.4.0

PostgreSQL-compatible SQL compiler built on libpg_query
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128

//
// Unified Query Algebra
//
// Copyright (c) 2023-2026 Cognica, Inc.
//

//! Sequence owners, grantees and grantors retain their original role incarnations.

use super::{role_bindings, SequenceSecurity};
use crate::catalog::roles::{identity::RoleBinding, RoleDefinition, RoleIdentity, RoleReference};
use std::collections::BTreeMap;
use uqa_core::{
    catalog_acl::AclGrantee,
    catalog_role::BoundAclEntry,
    catalog_sequence::{SequenceAclEntry, SequencePrivileges},
};

pub type BoundSequenceAclEntry = BoundAclEntry<SequencePrivileges>;

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct BoundSequenceSecurity {
    pub role_owner: RoleIdentity,
    pub acl: Option<Vec<BoundSequenceAclEntry>>,
}

#[cfg(test)]
mod tests;

impl BoundSequenceSecurity {
    pub fn from_row(row: uqa_core::catalog_sequence::BoundSequenceSecurity) -> Self {
        Self {
            role_owner: row.role_owner,
            acl: row.acl,
        }
    }

    pub fn row(&self) -> uqa_core::catalog_sequence::BoundSequenceSecurity {
        uqa_core::catalog_sequence::BoundSequenceSecurity {
            role_owner: self.role_owner,
            acl: self.acl.clone(),
        }
    }

    pub fn owner(role_owner: RoleIdentity) -> Self {
        Self {
            role_owner,
            acl: None,
        }
    }

    pub fn owner_reference(
        &self,
        roles: &BTreeMap<String, RoleDefinition>,
    ) -> Result<RoleReference, crate::SQLError> {
        let name = role_bindings::role_name(roles, self.role_owner, "sequence")
            .map_err(crate::SQLError::Internal)?;
        Ok(RoleReference::Bound(std::sync::Arc::new(
            RoleBinding::from_definition(&roles[name])?,
        )))
    }

    pub fn bind(
        security: &SequenceSecurity,
        roles: &BTreeMap<String, RoleDefinition>,
    ) -> Result<Self, String> {
        let bind = |name: &str| role_bindings::bind_role(roles, name, "sequence");
        let entries = |entries: &[SequenceAclEntry]| {
            entries
                .iter()
                .map(|entry| {
                    Ok(BoundSequenceAclEntry {
                        role: entry.role.role_name().map(bind).transpose()?,
                        grantor: bind(entry.grantor.as_deref().unwrap_or(&security.role_owner))?,
                        privileges: entry.privileges,
                        grant_options: entry.grant_options,
                    })
                })
                .collect::<Result<Vec<_>, String>>()
        };
        Ok(Self {
            role_owner: bind(&security.role_owner)?,
            acl: security.acl.as_deref().map(entries).transpose()?,
        })
    }

    /// Resolve display names only through the role view accompanying this authority snapshot.
    pub fn resolve(
        &self,
        roles: &BTreeMap<String, RoleDefinition>,
    ) -> Result<SequenceSecurity, String> {
        let name =
            |identity| role_bindings::role_name(roles, identity, "sequence").map(str::to_owned);
        let entries = |entries: &[BoundSequenceAclEntry]| {
            entries
                .iter()
                .map(|entry| {
                    Ok(SequenceAclEntry {
                        role: entry
                            .role
                            .map(&name)
                            .transpose()?
                            .map_or(AclGrantee::Public, AclGrantee::Role),
                        grantor: Some(name(entry.grantor)?),
                        privileges: entry.privileges,
                        grant_options: entry.grant_options,
                    })
                })
                .collect::<Result<Vec<_>, String>>()
        };
        Ok(SequenceSecurity {
            role_owner: name(self.role_owner)?,
            acl: self.acl.as_deref().map(entries).transpose()?,
        })
    }

    pub fn validate(&self, roles: &BTreeMap<String, RoleDefinition>) -> Result<(), String> {
        super::sequence::validate_sequence_security_invariants(&self.resolve(roles)?, roles)
    }

    pub fn depends_on(&self, role: RoleIdentity) -> bool {
        self.role_owner == role
            || self
                .acl
                .iter()
                .flatten()
                .any(|entry| entry.role == Some(role) || entry.grantor == role)
    }
}