Function check_usage

src/sql/src/rbac.rs:356–397

Checks if a `session` is authorized to use `resolved_ids`. If not, an error is returned.

(
    catalog: &impl SessionCatalog,
    session: &dyn SessionMetadata,
    resolved_ids: &ResolvedIds,
    item_types: &BTreeSet<CatalogItemType>,
)

/// Checks if a `session` is authorized to use `resolved_ids`. If not, an error is returned.
pub fn check_usage(
    catalog: &impl SessionCatalog,
    session: &dyn SessionMetadata,
    resolved_ids: &ResolvedIds,
    item_types: &BTreeSet<CatalogItemType>,
) -> Result<(), UnauthorizedError> {
    rbac_check_preamble(catalog, session)?;

    // See: doc/developer/design/20260508_restrict_to_user_objects.md
    check_restrict_to_user_objects(catalog, session, resolved_ids)?;

    // Obtain all roles that the current session is a member of.
    let role_membership = catalog.collect_role_membership(&session.role_metadata().current_role);

    // Certain statements depend on objects that haven't been created yet, like sub-sources, so we
    // need to filter those out.
    let existing_resolved_ids =
        resolved_ids.retain_items(|item_id| catalog.try_get_item(item_id).is_some());

    let required_privileges = generate_usage_privileges(
        catalog,
        &existing_resolved_ids,
        session.role_metadata().current_role,
        item_types,
    )
    .into_iter()
    .collect();

    let mut rbac_requirements = RbacRequirements::empty();
    rbac_requirements.privileges = required_privileges;
    let rbac_requirements = filter_requirements(catalog, session, rbac_requirements);
    let required_privileges = rbac_requirements.privileges;

    check_object_privileges(
        catalog,
        required_privileges,
        role_membership,
        session.role_metadata().current_role,
    )?;

    Ok(())
}

/// Checks if a session is authorized to execute a plan. If not, an error is returned.
///