Method Export

backend/api/v1/sql_service.go:960–1030

Export exports the SQL query result.

(ctx context.Context, req *connect.Request[v1pb.ExportRequest])

// Export exports the SQL query result.
func (s *SQLService) Export(ctx context.Context, req *connect.Request[v1pb.ExportRequest]) (*connect.Response[v1pb.ExportResponse], error) {
	request := req.Msg
	// Prehandle export from issue.
	if strings.HasPrefix(request.Name, common.ProjectNamePrefix) {
		response, err := s.doExportFromIssue(ctx, request.Name)
		if err != nil {
			return nil, err
		}
		return connect.NewResponse(response), nil
	}

	// Prepare related message.
	user, instance, database, err := s.prepareRelatedMessage(ctx, request.Name)
	if err != nil {
		return nil, err
	}

	statement := request.Statement
	// In Redshift datashare, Rewrite query used for parser.
	if database.Metadata.GetDatashare() {
		statement = strings.ReplaceAll(statement, fmt.Sprintf("%s.", database.DatabaseName), "")
	}

	// requireExport=true narrows the CEL filter to grants with export=true,
	// so a tied unmask-only grant can't shadow a separately-active export
	// grant via slice order (PR #20491 bot review).
	accessGrant := s.preCheckAccess(ctx, request.Statement, instance, database, true /* requireExport */)

	// Validate the request.
	// New query ACL experience.
	if instance.Metadata.GetEngine() != storepb.Engine_MYSQL {
		if err := validateQueryRequest(instance, statement); err != nil {
			return nil, err
		}
	}

	resolvedDataSourceID, err := resolveDataSourceID(ctx, instance, request.DataSourceId, statement, false)
	if err != nil {
		return nil, err
	}

	dataSource, err := checkAndGetDataSourceQueriable(ctx, s.store, s.licenseService, database, resolvedDataSourceID)
	if err != nil {
		return nil, err
	}

	// Same cross-database guardrail as Query: the JIT grant authorizes only
	// its target databases, so span-level ACL still runs and only the
	// granted targets are exempted from IAM. See PR #20487 review.
	optionalAccessCheck := s.accessCheckWithGrant(accessGrant)
	skipMasking := false
	if accessGrant != nil {
		skipMasking = accessGrant.Payload.Unmask
	}
	bytes, duration, exportErr := doExport(ctx, s.store, s.dbFactory, s.licenseService, request, user, instance, database, optionalAccessCheck, s.schemaSyncer, dataSource, skipMasking)

	s.createQueryHistory(database, store.QueryHistoryTypeExport, statement, user.Email, duration, exportErr)