Method checkAccessImplHelper

src/Access/ContextAccess.cpp:665–843

template <bool throw_if_denied, bool grant_option, bool wildcard, typename... Args>
bool ContextAccess::checkAccessImplHelper(const ContextPtr & context, AccessFlags flags, const Args &... args) const
{
    if (user_was_dropped)
    {
        /// If the current user has been dropped we always throw an exception (even if `throw_if_denied` is false)
        /// because dropping of the current user is considered as a situation which is exceptional enough to stop
        /// query execution.
        throw Exception(ErrorCodes::UNKNOWN_USER, "{}: User has been dropped", getUserName());
    }

    if (params.full_access)
        return true;

    auto access_granted = [&]
    {
        /// Record every granted access, regardless of whether the caller is the throwing entry point
        /// (`checkAccess` / `checkGrantOption`) or the non-throwing one (`isGranted`, used internally by
        /// `checkAccessWithFilter`). Without this, an `isGranted`-driven success leaves no trace in
        /// system.query_log.used_privileges even though the privilege was effectively required by the query.
        context->addQueryPrivilegesInfo(AccessRightsElement{flags, args...}.toStringWithoutOptions(), true);
        return true;
    };

    auto access_denied = [&]<typename... FmtArgs>(int error_code [[maybe_unused]],
                                               FormatStringHelper<String, FmtArgs...> fmt_string [[maybe_unused]],
                                               FmtArgs && ...fmt_args [[maybe_unused]])
    {
        if constexpr (throw_if_denied)
        {
            context->addQueryPrivilegesInfo(AccessRightsElement{flags, args...}.toStringWithoutOptions(), false);
            throw Exception(error_code, std::move(fmt_string), getUserName(), std::forward<FmtArgs>(fmt_args)...);
        }
        return false;
    };

    if (flags & AccessType::CLUSTER && !access_control->doesOnClusterQueriesRequireClusterGrant())
        flags &= ~AccessType::CLUSTER;

    if (!flags)
        return true;

    const auto parameter_type = flags.getParameterType();
    if (parameter_type == AccessFlags::NONE)
    {
        /// Access to temporary tables is controlled in an unusual way, not like normal tables.
        /// Creating of temporary tables is controlled by AccessType::CREATE_TEMPORARY_TABLES grant,
        /// and other grants are considered as always given.
        /// The DatabaseCatalog class won't resolve StorageID for temporary tables
        /// which shouldn't be accessed.
        if (getDatabase(args...) == DatabaseCatalog::TEMPORARY_DATABASE)
            return access_granted();
    }

    auto acs = getAccessRightsWithImplicit();
    bool granted = false;
    if constexpr (wildcard)
    {
        if constexpr (grant_option)