uqa-sql 0.4.0

PostgreSQL-compatible SQL compiler built on libpg_query
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104

//
// Unified Query Algebra
//
// Copyright (c) 2023-2026 Cognica, Inc.
//

//! Explicit relation-lock authorization and stored-view target scope.

use crate::catalog::roles::RoleReference;
use crate::{
    ast::{LockTableTarget, TableLockMode},
    catalog::{
        roles::guards::RoleCatalogGuards,
        security::{
            table::{role_has_table_privilege, TableAclPrivilege},
            BoundTableSecurity,
        },
    },
    plan::QueryPlan,
    SQLError,
};

pub fn ensure_lock_privilege(
    roles: &dyn RoleCatalogGuards,
    security: &BoundTableSecurity,
    subject: &RoleReference,
    mode: TableLockMode,
    name: &str,
    kind: &str,
) -> Result<(), SQLError> {
    let definitions = roles.role_definitions();
    let memberships = roles.role_memberships();
    let security = security.resolve(&definitions).map_err(SQLError::Internal)?;
    let system = crate::catalog::SystemRelation::from_qualified_name(name);
    if TableAclPrivilege::ALL.into_iter().any(|privilege| {
        lock_privilege_permits(privilege, mode)
            && system.map_or_else(
                || {
                    role_has_table_privilege(
                        &security,
                        subject,
                        privilege,
                        &definitions,
                        &memberships,
                    )
                },
                |relation| {
                    crate::catalog::security::system_relations::has_table_privilege(
                        relation,
                        &security,
                        subject,
                        crate::catalog::security::table::TablePrivilegeCheck {
                            privilege,
                            grant_option: false,
                        },
                        &definitions,
                        &memberships,
                    )
                },
            )
    }) {
        return Ok(());
    }
    let (_, local) =
        uqa_core::RelationIdentity::parse_reference(name).map_err(SQLError::Internal)?;
    Err(SQLError::Routine {
        sqlstate: "42501".into(),
        message: format!("permission denied for {kind} {local}"),
    })
}

pub fn lock_privilege_permits(privilege: TableAclPrivilege, mode: TableLockMode) -> bool {
    match privilege {
        TableAclPrivilege::Maintain
        | TableAclPrivilege::Update
        | TableAclPrivilege::Delete
        | TableAclPrivilege::Truncate => true,
        TableAclPrivilege::Select => mode == TableLockMode::AccessShare,
        TableAclPrivilege::Insert => matches!(
            mode,
            TableLockMode::AccessShare | TableLockMode::RowShare | TableLockMode::RowExclusive
        ),
        TableAclPrivilege::References | TableAclPrivilege::Trigger => false,
    }
}

pub fn view_lock_targets(query: &QueryPlan) -> Result<Vec<LockTableTarget>, SQLError> {
    let mut targets = Vec::new();
    crate::binding::view_dependencies::bind_query_plan_relation_targets(
        &mut query.clone(),
        &std::collections::BTreeSet::new(),
        &mut |name, include_descendants| {
            targets.push(LockTableTarget {
                name: name.into(),
                include_descendants,
            });
            Ok::<_, SQLError>(name.into())
        },
    )?;
    Ok(targets)
}

#[cfg(test)]
mod tests;