Function filter_requirements

src/sql/src/rbac.rs:78–95

Filters `RbacRequirements` based on the session role metadata and RBAC related feature flags.

(
    catalog: &impl SessionCatalog,
    session_meta: &dyn SessionMetadata,
    rbac_requirements: RbacRequirements,
)

/// Filters `RbacRequirements` based on the session role metadata and RBAC related feature flags.
fn filter_requirements(
    catalog: &impl SessionCatalog,
    session_meta: &dyn SessionMetadata,
    rbac_requirements: RbacRequirements,
) -> RbacRequirements {
    // Skip RBAC non-mandatory checks if RBAC is disabled. However, we never skip RBAC checks for
    // system roles. This allows us to limit access of system users even when RBAC is off.
    let is_rbac_disabled = !is_rbac_enabled_for_session(catalog.system_vars(), session_meta)
        && !session_meta.role_metadata().current_role.is_system()
        && !session_meta.role_metadata().session_role.is_system();
    // Skip RBAC checks on user items if the session is a superuser.
    let is_superuser = session_meta.is_superuser();
    if is_rbac_disabled || is_superuser {
        return rbac_requirements.filter_to_mandatory_requirements();
    }

    rbac_requirements
}

// The default item types that most statements require USAGE privileges for.
static DEFAULT_ITEM_USAGE: LazyLock<BTreeSet<CatalogItemType>> = LazyLock::new(|| {