Function getDatabasesForRoleGrant

backend/runner/approval/runner.go:908–939

getDatabasesForRoleGrant fetches database messages for the given database identifiers. Used exclusively by role grant approval flow to retrieve database information. Returns a deduplicated list of databases.

(ctx context.Context, stores *store.Store, projectID string, databaseIdentifiers []string)

// Used exclusively by role grant approval flow to retrieve database information.
// Returns a deduplicated list of databases.
func getDatabasesForRoleGrant(ctx context.Context, stores *store.Store, projectID string, databaseIdentifiers []string) ([]*store.DatabaseMessage, error) {
	// Parse and deduplicate database identifiers
	type dbKey struct {
		instanceID   string
		databaseName string
	}
	requestedDBs := make(map[dbKey]bool)
	for _, identifier := range databaseIdentifiers {
		instanceID, databaseName, err := common.GetInstanceDatabaseID(identifier)
		if err != nil {
			return nil, err
		}
		requestedDBs[dbKey{instanceID: instanceID, databaseName: databaseName}] = true
	}

	// Batch fetch all databases in the project
	allDatabases, err := stores.ListDatabases(ctx, &store.FindDatabaseMessage{ProjectID: &projectID})
	if err != nil {
		return nil, errors.Wrapf(err, "failed to list databases for project %q", projectID)
	}

	// Filter to only requested databases
	var result []*store.DatabaseMessage
	for _, db := range allDatabases {
		key := dbKey{instanceID: db.InstanceID, databaseName: db.DatabaseName}
		if requestedDBs[key] {
			result = append(result, db)
		}
	}

	return result, nil
}

// getApprovalSourceFromPlan determines the approval rule source enum from the plan config.
// This is used after the risk layer removal to directly filter approval rules by source.