Function rbac_check_preamble

src/sql/src/rbac.rs:41–75

Common checks that need to be performed before we can start checking a role's privileges.

(
    catalog: &impl SessionCatalog,
    session_meta: &dyn SessionMetadata,
)

/// Common checks that need to be performed before we can start checking a role's privileges.
fn rbac_check_preamble(
    catalog: &impl SessionCatalog,
    session_meta: &dyn SessionMetadata,
) -> Result<(), UnauthorizedError> {
    // PostgreSQL allows users that have their role dropped to perform some actions,
    // such as `SET ROLE` and certain `SELECT` queries. We haven't implemented
    // `SET ROLE` and feel it's safer to force to user to re-authenticate if their
    // role is dropped.
    if catalog
        .try_get_role(&session_meta.role_metadata().current_role)
        .is_none()
    {
        return Err(UnauthorizedError::ConcurrentRoleDrop(
            session_meta.role_metadata().current_role.clone(),
        ));
    };
    if catalog
        .try_get_role(&session_meta.role_metadata().session_role)
        .is_none()
    {
        return Err(UnauthorizedError::ConcurrentRoleDrop(
            session_meta.role_metadata().session_role.clone(),
        ));
    };
    if catalog
        .try_get_role(&session_meta.role_metadata().authenticated_role)
        .is_none()
    {
        return Err(UnauthorizedError::ConcurrentRoleDrop(
            session_meta.role_metadata().authenticated_role.clone(),
        ));
    };

    Ok(())
}

/// Filters `RbacRequirements` based on the session role metadata and RBAC related feature flags.
fn filter_requirements(