Function assert_visible

nodedb/src/control/server/pgwire/ddl/explain_ddl.rs:158–207

`SELECT nodedb_assert_visible(' ', ' ', ' ')` Test helper: returns true/false whether a row is visible to a user under RLS.

(
    state: &SharedState,
    _identity: &AuthenticatedIdentity,
    parts: &[&str],
)

///
/// Test helper: returns true/false whether a row is visible to a user under RLS.
pub fn assert_visible(
    state: &SharedState,
    _identity: &AuthenticatedIdentity,
    parts: &[&str],
) -> PgWireResult<Vec<Response>> {
    // Parse: nodedb_assert_visible('collection', 'row_id', 'user_id')
    if parts.len() < 4 {
        return Err(sqlstate_error(
            "42601",
            "syntax: SELECT nodedb_assert_visible('<collection>', '<row_id>', '<user_id>')",
        ));
    }

    let collection = parts[1].trim_matches('\'').trim_end_matches(',');
    let _row_id = parts[2].trim_matches('\'').trim_end_matches(',');
    let user_id = parts[3].trim_matches('\'').trim_end_matches(')');

    // Build AuthContext for the target user.
    let target_identity = crate::control::security::identity::AuthenticatedIdentity {
        user_id: user_id.parse().unwrap_or(0),
        username: user_id.to_string(),
        tenant_id: crate::types::TenantId::new(1),
        auth_method: crate::control::security::identity::AuthMethod::Trust,
        roles: vec![crate::control::security::identity::Role::ReadWrite],
        is_superuser: false,
        default_database: None,
        accessible_databases: crate::control::security::identity::DatabaseSet::Some(
            smallvec::smallvec![nodedb_types::id::DatabaseId::DEFAULT],
        ),
    };
    let auth_ctx = crate::control::server::session_auth::build_auth_context(&target_identity);

    // Check if RLS policies would filter this user.
    let rls_bytes = state.rls.combined_read_predicate_with_auth(
        target_identity.tenant_id.as_u64(),
        collection,
        &auth_ctx,
    );

    let visible = rls_bytes.is_some_and(|b| b.is_empty()); // No filters = visible.

    let schema = Arc::new(vec![text_field("visible")]);
    let mut enc = DataRowEncoder::new(schema.clone());
    let _ = enc.encode_field(&visible.to_string());

    Ok(vec![Response::Query(QueryResponse::new(
        schema,
        stream::iter(vec![Ok(enc.take_row())]),
    ))])
}