osquery_rust/plugin/table/query_constraint.rs
1use crate::plugin::table::ColumnType;
2use std::collections::HashMap;
3
4// QueryConstraints contains the constraints from the WHERE clause of the query,
5// that can optionally be used to optimize the table generation. Note that the
6// _osquery SQLite engine will perform the filtering with these constraints, so
7// it is not mandatory that they be used in table generation.
8// QueryConstraints is a map from column name to the details of the
9// constraints on that column.
10pub type QueryConstraints = HashMap<String, ConstraintList>;
11
12// ConstraintList contains the details of the constraints for the given column.
13#[allow(dead_code)]
14pub struct ConstraintList {
15 affinity: ColumnType,
16 constraints: Vec<Constraint>,
17}
18
19// Constraint contains both an operator and an expression that are applied as
20// constraints in the query.
21#[allow(dead_code)]
22struct Constraint {
23 op: Operator,
24 expr: String,
25}
26
27#[allow(dead_code)]
28enum Operator {
29 // 1
30 Unique,
31 // 2
32 Equals,
33 // 4
34 GreaterThan,
35 // 8
36 LessThanOrEquals,
37 // 16
38 LessThan,
39 // 32
40 GreaterThanOrEquals,
41 // 64
42 Match,
43 // 65
44 Like,
45 // 66
46 Glob,
47 // 67
48 Regexp,
49}