(
unheld_ownership: Vec<ObjectId>,
catalog: &impl SessionCatalog,
)
| 1648 | } |
| 1649 | |
| 1650 | fn ownership_err( |
| 1651 | unheld_ownership: Vec<ObjectId>, |
| 1652 | catalog: &impl SessionCatalog, |
| 1653 | ) -> Result<(), UnauthorizedError> { |
| 1654 | if !unheld_ownership.is_empty() { |
| 1655 | let objects = unheld_ownership |
| 1656 | .into_iter() |
| 1657 | .map(|ownership| match ownership { |
| 1658 | ObjectId::Cluster(id) => ( |
| 1659 | ObjectType::Cluster, |
| 1660 | catalog.get_cluster(id).name().to_string(), |
| 1661 | ), |
| 1662 | ObjectId::ClusterReplica((cluster_id, replica_id)) => { |
| 1663 | let cluster = catalog.get_cluster(cluster_id); |
| 1664 | let replica = catalog.get_cluster_replica(cluster_id, replica_id); |
| 1665 | // Note: using unchecked here is okay because the values are coming from an |
| 1666 | // already existing name. |
| 1667 | let name = QualifiedReplica { |
| 1668 | cluster: Ident::new_unchecked(cluster.name()), |
| 1669 | replica: Ident::new_unchecked(replica.name()), |
| 1670 | }; |
| 1671 | (ObjectType::ClusterReplica, name.to_string()) |
| 1672 | } |
| 1673 | ObjectId::Database(id) => ( |
| 1674 | ObjectType::Database, |
| 1675 | catalog.get_database(&id).name().to_string(), |
| 1676 | ), |
| 1677 | ObjectId::Schema((database_spec, schema_spec)) => { |
| 1678 | let schema = catalog.get_schema(&database_spec, &schema_spec); |
| 1679 | let name = catalog.resolve_full_schema_name(schema.name()); |
| 1680 | (ObjectType::Schema, name.to_string()) |
| 1681 | } |
| 1682 | ObjectId::Item(id) => { |
| 1683 | let item = catalog.get_item(&id); |
| 1684 | let name = catalog.resolve_full_name(item.name()); |
| 1685 | (item.item_type().into(), name.to_string()) |
| 1686 | } |
| 1687 | ObjectId::NetworkPolicy(id) => ( |
| 1688 | ObjectType::NetworkPolicy, |
| 1689 | catalog.get_network_policy(&id).name().to_string(), |
| 1690 | ), |
| 1691 | ObjectId::Role(_) => unreachable!("roles have no owner"), |
| 1692 | }) |
| 1693 | .collect(); |
| 1694 | Err(UnauthorizedError::Ownership { objects }) |
| 1695 | } else { |
| 1696 | Ok(()) |
| 1697 | } |
| 1698 | } |
| 1699 | |
| 1700 | fn generate_required_source_privileges( |
| 1701 | name: &QualifiedItemName, |
no test coverage detected