Function generate_required_source_privileges

src/sql/src/rbac.rs:1700–1725

(
    name: &QualifiedItemName,
    data_source: &DataSourceDesc,
    in_cluster: Option<ClusterId>,
    role_id: RoleId,
)

}

fn generate_required_source_privileges(
    name: &QualifiedItemName,
    data_source: &DataSourceDesc,
    in_cluster: Option<ClusterId>,
    role_id: RoleId,
) -> Vec<(SystemObjectId, AclMode, RoleId)> {
    let mut privileges = vec![(
        SystemObjectId::Object(name.qualifiers.clone().into()),
        AclMode::CREATE,
        role_id,
    )];
    match (data_source, in_cluster) {
        (_, Some(id)) => {
            privileges.push((SystemObjectId::Object(id.into()), AclMode::CREATE, role_id))
        }
        (DataSourceDesc::Ingestion(_), None) => {
            privileges.push((SystemObjectId::System, AclMode::CREATE_CLUSTER, role_id))
        }
        // Non-ingestion data-sources have meaningless cluster config's (for now...) and they need
        // to be ignored.
        // This feels very brittle, but there's not much we can do until the UNDEFINED cluster
        // config is removed.
        (_, None) => {}
    }
    privileges
}

/// Generates all the privileges required to execute a read that includes the objects in `ids`.
///