Function checkSensitivePredicates

backend/api/v1/document_masking.go:141–177

checkSensitivePredicates checks whether a span uses sensitive fields in predicates. Returns an error message if so, or "" if clean. This is used post-execution to blank individual statement results (matching SQL/CosmosDB behavior) rather than blocking the entire request.

(
	ctx context.Context,
	stores *store.Store,
	database *store.DatabaseMessage,
	span *parserbase.QuerySpan,
)

// post-execution to blank individual statement results (matching SQL/CosmosDB
// behavior) rather than blocking the entire request.
func checkSensitivePredicates(
	ctx context.Context,
	stores *store.Store,
	database *store.DatabaseMessage,
	span *parserbase.QuerySpan,
) (string, error) {
	if len(span.PredicatePaths) == 0 {
		return "", nil
	}

	var objectSchema *storepb.ObjectSchema
	var err error

	if analysis := span.MongoDBAnalysis; analysis != nil && analysis.Collection != "" {
		objectSchema, err = getTableObjectSchema(ctx, stores, database.InstanceID, database.DatabaseName, analysis.Collection)
		if err != nil {
			return "", errors.Wrapf(err, "failed to get object schema for collection %q", analysis.Collection)
		}
	} else if analysis := span.ElasticsearchAnalysis; analysis != nil && analysis.Index != "" {
		objectSchema, err = getTableObjectSchema(ctx, stores, database.InstanceID, database.DatabaseName, analysis.Index)
		if err != nil {
			return "", errors.Wrapf(err, "failed to get object schema for index %q", analysis.Index)
		}
	}

	if objectSchema == nil {
		return "", nil
	}

	for pathStr := range span.PredicatePaths {
		semanticType := lookupSemanticTypeByDotPath(pathStr, objectSchema)
		if semanticType != "" {
			return fmt.Sprintf("using field %q tagged by semantic type %q in query predicate is not allowed", pathStr, semanticType), nil
		}
	}
	return "", nil
}

func getFirstSemanticTypeInPath(ast *parserbase.PathAST, objectSchema *storepb.ObjectSchema) string {
	if ast == nil || ast.Root == nil || objectSchema == nil {