buildCELVariablesForAccessGrant builds CEL variables for ACCESS_GRANT issues. Emits one CEL variable map per (target database, schema, table) referenced by the grant's query — mirroring how EXPORT_DATA expands its rule evaluation across the per-statement schema/table set. This lets REQUEST_ACCESS r
(ctx context.Context, stores *store.Store, issue *store.IssueMessage)
| 788 | // schema/table info — rules keyed on db_engine / database_name / env |
| 789 | // still evaluate. |
| 790 | func buildCELVariablesForAccessGrant(ctx context.Context, stores *store.Store, issue *store.IssueMessage) ([]map[string]any, bool, error) { |
| 791 | payload := issue.Payload |
| 792 | if payload.AccessGrantId == "" { |
| 793 | return nil, false, errors.New("access grant id not found in issue payload") |
| 794 | } |
| 795 | |
| 796 | accessGrantID := payload.AccessGrantId |
| 797 | accessGrant, err := stores.GetAccessGrant(ctx, &store.FindAccessGrantMessage{ID: &accessGrantID}) |
| 798 | if err != nil { |
| 799 | return nil, false, errors.Wrapf(err, "failed to get access grant %s", accessGrantID) |
| 800 | } |
| 801 | if accessGrant == nil { |
| 802 | return nil, false, errors.Errorf("access grant %s not found", accessGrantID) |
| 803 | } |
| 804 | |
| 805 | baseVars := map[string]any{ |
| 806 | common.CELAttributeResourceProjectID: issue.ProjectID, |
| 807 | common.CELAttributeRequestUnmask: accessGrant.Payload.Unmask, |
| 808 | common.CELAttributeRequestExport: accessGrant.Payload.Export, |
| 809 | } |
| 810 | |
| 811 | targets := accessGrant.Payload.Targets |
| 812 | if len(targets) == 0 { |
| 813 | return []map[string]any{baseVars}, true, nil |
| 814 | } |
| 815 | |
| 816 | statement := accessGrant.Payload.Query |
| 817 | var celVarsList []map[string]any |
| 818 | |
| 819 | for _, target := range targets { |
| 820 | instanceID, databaseName, err := common.GetInstanceDatabaseID(target) |
| 821 | if err != nil { |
| 822 | return nil, false, errors.Wrapf(err, "failed to parse target %q", target) |
| 823 | } |
| 824 | |
| 825 | databases, err := stores.ListDatabases(ctx, &store.FindDatabaseMessage{ |
| 826 | InstanceID: &instanceID, |
| 827 | DatabaseName: &databaseName, |
| 828 | }) |
| 829 | if err != nil { |
| 830 | return nil, false, errors.Wrapf(err, "failed to get database %q", target) |
| 831 | } |
| 832 | if len(databases) == 0 { |
| 833 | continue |
| 834 | } |
| 835 | database := databases[0] |
| 836 | |
| 837 | instance, err := stores.GetInstance(ctx, &store.FindInstanceMessage{ResourceID: &database.InstanceID}) |
| 838 | if err != nil { |
| 839 | return nil, false, errors.Wrapf(err, "failed to get instance %q", database.InstanceID) |
| 840 | } |
| 841 | if instance == nil { |
| 842 | continue |
| 843 | } |
| 844 | engine := instance.Metadata.GetEngine() |
| 845 | |
| 846 | targetVars := maps.Clone(baseVars) |
| 847 | targetVars[common.CELAttributeResourceInstanceID] = database.InstanceID |
no test coverage detected