Function schemaForWriteTargetResolution

backend/api/v1/sql_service.go:2002–2034

schemaForWriteTargetResolution returns the default schema to resolve UNqualified write targets against, per engine — the schema the engine will actually write to, or the sentinel when that can't be determined here (so the schema_name attribute is omitted and schema-scoped grants fail closed). Qualif

(engine storepb.Engine, databaseName, requestSchema string)

// sentinel when that can't be determined here (so the schema_name attribute is omitted and
// schema-scoped grants fail closed). Qualified targets ignore this and keep their qualifier.
func schemaForWriteTargetResolution(engine storepb.Engine, databaseName, requestSchema string) string {
	switch engine {
	case storepb.Engine_POSTGRES:
		// Execution pins search_path to QueryRequest.schema when set; otherwise the
		// connection user's default ($user, public) is not knowable here.
		if requestSchema != "" {
			return requestSchema
		}
		return unresolvedSchemaSentinel
	case storepb.Engine_MSSQL:
		// No per-request schema pin; execution uses the login's default_schema, which is not
		// in synced metadata. Never trust a request schema for MSSQL.
		return unresolvedSchemaSentinel
	case storepb.Engine_ORACLE:
		// Execution pins CURRENT_SCHEMA to the connection database (= schema) once at pool Open
		// (oracle.go), and the SQL Editor opens a fresh pool per request, so an unqualified write
		// resolves to databaseName — knowable and execution-accurate. (A mid-batch ALTER SESSION
		// is covered by the multi-statement fallback.) This pin is the reason the schema is
		// auth-grade here; if the driver ever stops pinning per-connection, switch to the sentinel.
		return databaseName
	case storepb.Engine_MYSQL, storepb.Engine_TIDB:
		// No schema layer; the extractor emits an empty schema and resource.schema_name is omitted.
		return ""
	default:
		// Fail closed for any other engine. An engine that reaches here without an explicit,
		// execution-verified schema mapping must NOT have its unqualified writes resolved against
		// a guessed default — e.g. a pg-family extractor (COCKROACHDB, REDSHIFT) would fill in the
		// metadata search_path, a REAL schema name, which we'd then assert as resource.schema_name
		// and over-allow a schema-scoped grant. The sentinel maps to an omitted attribute, so
		// schema-scoped grants fail closed while table-only grants still match. SUP-222 / BYT-9698.
		return unresolvedSchemaSentinel
	}
}

// sanitizeResults sanitizes the strings in the results by replacing all the invalid UTF-8 characters with its hexadecimal representation.
func sanitizeResults(results []*v1pb.QueryResult) {