Resolve the effective identity for a trigger execution. - INVOKER (default): uses the caller's identity (passthrough). - DEFINER: creates a synthetic identity from the trigger's owner. The tenant is always the trigger's tenant — DEFINER cannot cross tenants.
(
trigger: &StoredTrigger,
caller: &AuthenticatedIdentity,
tenant_id: TenantId,
)
| 107 | /// - DEFINER: creates a synthetic identity from the trigger's owner. |
| 108 | /// The tenant is always the trigger's tenant — DEFINER cannot cross tenants. |
| 109 | pub(crate) fn resolve_trigger_identity( |
| 110 | trigger: &StoredTrigger, |
| 111 | caller: &AuthenticatedIdentity, |
| 112 | tenant_id: TenantId, |
| 113 | ) -> AuthenticatedIdentity { |
| 114 | match trigger.security { |
| 115 | TriggerSecurity::Invoker => caller.clone(), |
| 116 | TriggerSecurity::Definer => { |
| 117 | // Create a synthetic identity for the trigger owner. |
| 118 | // The owner is a superuser within the trigger's tenant scope. |
| 119 | AuthenticatedIdentity { |
| 120 | user_id: 0, // System-generated; not a real user ID |
| 121 | username: trigger.owner.clone(), |
| 122 | tenant_id, |
| 123 | auth_method: AuthMethod::Trust, |
| 124 | roles: vec![Role::TenantAdmin], |
| 125 | is_superuser: true, |
| 126 | default_database: None, |
| 127 | accessible_databases: crate::control::security::identity::DatabaseSet::All, |
| 128 | } |
| 129 | } |
| 130 | } |
| 131 | } |
| 132 | |
| 133 | /// Execute BEFORE triggers that may mutate the NEW row. |
| 134 | /// |
no test coverage detected