Function buildExportQueryContext

backend/api/v1/sql_service.go:172–186

buildExportQueryContext assembles the db.QueryContext for an export request. SkipMasking has to be set here (not only checked around the post-execution MaskResults pass) because some drivers mask at query time via SQL rewrites — by the time the second pass runs the rows would already be masked, and

(restriction *store.EffectiveQueryDataPolicy, userEmail string, schema *string, skipMasking bool)

// a JIT grant with unmask=true would silently export masked data. See PR
// #20487 review (RainbowDashy).
func buildExportQueryContext(restriction *store.EffectiveQueryDataPolicy, userEmail string, schema *string, skipMasking bool) db.QueryContext {
	qc := db.QueryContext{
		Limit:                int(restriction.MaximumResultRows),
		OperatorEmail:        userEmail,
		MaximumSQLResultSize: restriction.MaximumResultSize,
		SkipMasking:          skipMasking,
	}
	if restriction.MaxQueryTimeoutInSeconds > 0 {
		qc.Timeout = &durationpb.Duration{Seconds: restriction.MaxQueryTimeoutInSeconds}
	}
	if schema != nil {
		qc.Schema = *schema
	}
	return qc
}

// preCheckAccess returns the user's most capable active access grant matching
// the given query, or nil if none. When `requireExport` is true the CEL