pub fn diff_grants(
target: &[Grant],
source: &[Grant],
managed_roles: &BTreeSet<Identifier>,
) -> (Vec<Grant>, Vec<Grant>, Vec<Grant>)Expand description
Compute additions and removals between target (catalog) and source (desired).
managed_roles: the set of role names mentioned anywhere in the source
catalog. Grants whose grantee is not in this set are considered unmanaged
and excluded from the revoke side (lenient policy). PUBLIC is always
considered managed.
Returns (to_add, to_revoke, unmanaged_observed).