uqa_sql/catalog/roles/
inquiry.rs

1//
2// Unified Query Algebra
3//
4// Copyright (c) 2023-2026 Cognica, Inc.
5//
6
7//! Role privilege inquiry with ordered session and retained catalog reads.
8
9use super::{
10    guards::RoleCatalogGuards,
11    memberships::{
12        parse_pg_has_role_privileges, pg_has_role_privilege, resolve_pg_has_role_identifier,
13        role_privilege_text,
14    },
15    RoleReferenceNames,
16};
17use crate::SQLError;
18use uqa_core::Value;
19
20pub fn pg_has_role_value(
21    names: &dyn RoleReferenceNames,
22    catalog: &dyn RoleCatalogGuards,
23    arguments: &[Value],
24) -> Result<Value, SQLError> {
25    if arguments.iter().any(|argument| argument == &Value::Null) {
26        return Ok(Value::Null);
27    }
28    let (subject_value, target_value, privilege_value) = match arguments {
29        [target, privilege] => (None, target, privilege),
30        [subject, target, privilege] => (Some(subject), target, privilege),
31        _ => {
32            return Err(SQLError::BadArity {
33                name: "pg_has_role".into(),
34                expected: "2 or 3".into(),
35                actual: arguments.len(),
36            });
37        }
38    };
39    let current_user = subject_value.is_none().then(|| names.current_user_name());
40    let roles = catalog.role_definitions();
41    let subject = subject_value.map_or_else(
42        || Ok(current_user),
43        |value| resolve_pg_has_role_identifier(value, &roles),
44    )?;
45    let target = resolve_pg_has_role_identifier(target_value, &roles)?;
46    let privileges = parse_pg_has_role_privileges(role_privilege_text(privilege_value)?)?;
47    let memberships = catalog.role_memberships();
48    let allowed = privileges.into_iter().any(|privilege| {
49        pg_has_role_privilege(
50            &roles,
51            &memberships,
52            subject.as_deref(),
53            target.as_deref(),
54            privilege,
55        )
56    });
57    Ok(Value::Bool(allowed))
58}
uqa_sql/catalog/roles/inquiry.rs

uqa_sql/catalog/roles/
inquiry.rs
