selectBestAccessGrant picks the highest-ranked grant by capability count (Unmask + Export). A grant with both wins outright; otherwise the first single-capability grant in slice order wins (ties resolve to the input ordering). Nil-payload grants are skipped so callers can deref `Payload.Unmask` / `P
(grants []*store.AccessGrantMessage)
| 270 | // score — for deterministic selection callers should pass an explicit |
| 271 | // `access_grant` in the request (see `resolveExplicitAccessGrant`). |
| 272 | func selectBestAccessGrant(grants []*store.AccessGrantMessage) *store.AccessGrantMessage { |
| 273 | var best *store.AccessGrantMessage |
| 274 | bestScore := -1 |
| 275 | for _, grant := range grants { |
| 276 | if grant.Payload == nil { |
| 277 | continue |
| 278 | } |
| 279 | // Rank by Unmask only — Export plays no role in selection: |
| 280 | // |
| 281 | // - Export callers pass `requireExport=true`, which pushes |
| 282 | // `&& export == true` into the CEL filter, so every grant in |
| 283 | // this slice already has `Export=true` and a per-grant Export |
| 284 | // bump would just be a uniform constant. |
| 285 | // - Query callers don't read `Payload.Export` from the returned |
| 286 | // grant — they only consume `Payload.Unmask` for |
| 287 | // `SkipMasking`. |
| 288 | // |
| 289 | // So preferring Unmask=true is the only ranking signal that |
| 290 | // affects observable behavior, and matches PR #20491 bot review |
| 291 | // (#3349086819) requesting Unmask wins ties for Query. |
| 292 | score := 0 |
| 293 | if grant.Payload.Unmask { |
| 294 | score++ |
| 295 | } |
| 296 | if score > bestScore { |
| 297 | best = grant |
| 298 | bestScore = score |
| 299 | } |
| 300 | } |
| 301 | return best |
| 302 | } |
| 303 | |
| 304 | func (s *SQLService) Query(ctx context.Context, req *connect.Request[v1pb.QueryRequest]) (*connect.Response[v1pb.QueryResponse], error) { |
| 305 | request := req.Msg |
no outgoing calls