uqa-sql 0.5.0

PostgreSQL-compatible SQL compiler built on libpg_query
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145

//
// Unified Query Algebra
//
// Copyright (c) 2023-2026 Cognica, Inc.
//

//! Bind legacy routine names once and validate retained owner and ACL incarnations.

use super::bound_routine_owner;
use crate::catalog::security::object_acl;
use crate::{
    ast::{CreateFunction, RoutineAclEntry},
    catalog::roles::{identity::RoleSubject, RoleDefinition, RoleIdentity, RoleReference},
    SQLError,
};
use serde::Deserialize;
use std::collections::{BTreeMap, BTreeSet};
use uqa_core::catalog_acl::AclGrantee;

/// Only the initial catalog converter may interpret named routine authority.
#[derive(Deserialize)]
pub struct LegacyRoutineAclEntry {
    pub role: AclGrantee,
    #[serde(default)]
    pub grantor: Option<String>,
    pub grant_option: bool,
}

pub struct BoundRoutineAuthority {
    pub owner: RoleIdentity,
    pub execute_acl: Option<Vec<RoutineAclEntry>>,
}

pub fn bind_legacy_authority(
    owner: &str,
    acl: Option<Vec<LegacyRoutineAclEntry>>,
    roles: &BTreeMap<String, RoleDefinition>,
    implicit_owner_execute: bool,
) -> Result<BoundRoutineAuthority, SQLError> {
    let bind = |name: &str| {
        RoleReference::from(name)
            .bind(roles)
            .map(|role| role.identity())
    };
    let identity = bind(owner)?;
    let mut execute_acl = acl
        .map(|acl| {
            acl.into_iter()
                .map(|entry| {
                    Ok(RoutineAclEntry {
                        role: entry.role.role_name().map(bind).transpose()?,
                        grantor: bind(entry.grantor.as_deref().unwrap_or(owner))?,
                        grant_option: entry.grant_option,
                    })
                })
                .collect::<Result<Vec<_>, SQLError>>()
        })
        .transpose()?;
    if implicit_owner_execute {
        if let Some(acl) = execute_acl.as_mut() {
            if !acl.iter().any(|entry| entry.role == Some(identity)) {
                acl.push(RoutineAclEntry {
                    role: Some(identity),
                    grantor: identity,
                    grant_option: false,
                });
            }
        }
    }
    validate_acl(identity, execute_acl.as_deref())?;
    Ok(BoundRoutineAuthority {
        owner: identity,
        execute_acl,
    })
}

fn invalid(message: &str) -> SQLError {
    SQLError::Internal(format!("invalid routine authority: {message}"))
}

fn validate_acl(owner: RoleIdentity, acl: Option<&[RoutineAclEntry]>) -> Result<(), SQLError> {
    object_acl::validate_acl(owner, acl, "routine")
}

pub fn validate_routine_authority_identities(definition: &CreateFunction) -> Result<(), SQLError> {
    validate_acl(
        bound_routine_owner(definition)?,
        definition.execute_acl.as_deref(),
    )
}

fn authority_roles(definition: &CreateFunction) -> Result<BTreeSet<RoleIdentity>, SQLError> {
    Ok(object_acl::acl_roles(
        bound_routine_owner(definition)?,
        definition.execute_acl.as_deref(),
    ))
}

pub fn routine_role_dependencies(
    definition: &CreateFunction,
    roles: &BTreeMap<String, RoleDefinition>,
) -> Result<BTreeSet<String>, SQLError> {
    validate_routine_authority_identities(definition)?;
    authority_roles(definition)?
        .into_iter()
        .map(|identity| {
            identity
                .role_name(roles)
                .map(str::to_owned)
                .ok_or_else(|| invalid("missing role incarnation"))
        })
        .collect()
}

pub fn validate_routine_authority(
    definition: &CreateFunction,
    roles: &BTreeMap<String, RoleDefinition>,
) -> Result<(), SQLError> {
    routine_role_dependencies(definition, roles).map(|_| ())
}

pub fn bind_routine_grantees(
    grantees: &[AclGrantee],
    roles: &BTreeMap<String, RoleDefinition>,
) -> Result<Vec<Option<RoleIdentity>>, SQLError> {
    object_acl::bind_grantees(grantees, roles)
}

pub fn added_routine_acl_roles(
    before: &CreateFunction,
    after: &CreateFunction,
    roles: &BTreeMap<String, RoleDefinition>,
    added: &mut BTreeSet<String>,
) -> Result<(), SQLError> {
    object_acl::added_acl_roles(
        (bound_routine_owner(before)?, before.execute_acl.as_deref()),
        (bound_routine_owner(after)?, after.execute_acl.as_deref()),
        roles,
        "routine",
        added,
    )
}

#[cfg(test)]
mod tests;