Function check_object_privileges

src/sql/src/rbac.rs:1827–1869

(
    catalog: &impl SessionCatalog,
    privileges: Vec<(SystemObjectId, AclMode, RoleId)>,
    role_membership: BTreeSet<RoleId>,
    current_role_id: RoleId,
)

}

fn check_object_privileges(
    catalog: &impl SessionCatalog,
    privileges: Vec<(SystemObjectId, AclMode, RoleId)>,
    role_membership: BTreeSet<RoleId>,
    current_role_id: RoleId,
) -> Result<(), UnauthorizedError> {
    let mut role_memberships: BTreeMap<RoleId, BTreeSet<RoleId>> = BTreeMap::new();
    role_memberships.insert(current_role_id, role_membership);
    for (object_id, acl_mode, role_id) in privileges {
        // Temporary schemas are owned by the connection that created them,
        // so users implicitly have all privileges on their own temp schema.
        // The schema may not exist yet (lazy creation), so we skip the check.
        if matches!(
            &object_id,
            SystemObjectId::Object(ObjectId::Schema((_, SchemaSpecifier::Temporary)))
        ) {
            continue;
        }

        let role_membership = role_memberships
            .entry(role_id)
            .or_insert_with_key(|role_id| catalog.collect_role_membership(role_id));
        let object_privileges = catalog
            .get_privileges(&object_id)
            .expect("only object types with privileges will generate required privileges");
        let role_privileges = role_membership
            .iter()
            .flat_map(|role_id| object_privileges.get_acl_items_for_grantee(role_id))
            .map(|mz_acl_item| mz_acl_item.acl_mode)
            .fold(AclMode::empty(), |accum, acl_mode| accum.union(acl_mode));
        if !role_privileges.contains(acl_mode) {
            let role_name = catalog.get_role(&role_id).name().to_string();
            let privileges = acl_mode.to_error_string();
            return Err(UnauthorizedError::Privilege {
                object_description: ErrorMessageObjectDescription::from_sys_id(&object_id, catalog),
                role_name,
                privileges,
            });
        }
    }

    Ok(())
}

pub const fn all_object_privileges(object_type: SystemObjectType) -> AclMode {
    const TABLE_ACL_MODE: AclMode = AclMode::INSERT