Method validate

src/sql/src/rbac.rs:225–275

(
        self,
        catalog: &impl SessionCatalog,
        session: &dyn SessionMetadata,
        resolved_ids: &ResolvedIds,
    )

    }

    fn validate(
        self,
        catalog: &impl SessionCatalog,
        session: &dyn SessionMetadata,
        resolved_ids: &ResolvedIds,
    ) -> Result<(), UnauthorizedError> {
        // Obtain all roles that the current session is a member of.
        let role_membership =
            catalog.collect_role_membership(&session.role_metadata().current_role);

        check_usage(catalog, session, resolved_ids, self.item_usage)?;

        // Validate that the current session has the required role membership to execute the provided
        // plan.
        let unheld_membership: Vec<_> = self.role_membership.difference(&role_membership).collect();
        if !unheld_membership.is_empty() {
            let role_names = unheld_membership
                .into_iter()
                .map(|role_id| {
                    // Some role references may no longer exist due to concurrent drops.
                    catalog
                        .try_get_role(role_id)
                        .map(|role| role.name().to_string())
                        .unwrap_or_else(|| role_id.to_string())
                })
                .collect();
            return Err(UnauthorizedError::RoleMembership { role_names });
        }

        // Validate that the current session has the required object ownership to execute the provided
        // plan.
        let unheld_ownership = self
            .ownership
            .into_iter()
            .filter(|ownership| !check_owner_roles(ownership, &role_membership, catalog))
            .collect();
        ownership_err(unheld_ownership, catalog)?;

        check_object_privileges(
            catalog,
            self.privileges,
            role_membership,
            session.role_metadata().current_role,
        )?;

        if let Some(action) = self.superuser_action {
            return Err(UnauthorizedError::Superuser { action });
        }

        Ok(())
    }

    fn filter_to_mandatory_requirements(self) -> RbacRequirements {
        let RbacRequirements {