Method preCheckAccess

backend/api/v1/sql_service.go:196–261

preCheckAccess returns the user's most capable active access grant matching the given query, or nil if none. When `requireExport` is true the CEL filter is narrowed to grants with `export == true`, so an unmask-only grant on the same statement can't shadow a separately-active export grant via slice-

(ctx context.Context, statement string, instance *store.InstanceMessage, database *store.DatabaseMessage, requireExport bool)

// The returned grant has a non-nil Payload — callers may deref
// `Payload.Unmask` / `Payload.Export` without an additional check.
func (s *SQLService) preCheckAccess(ctx context.Context, statement string, instance *store.InstanceMessage, database *store.DatabaseMessage, requireExport bool) *store.AccessGrantMessage {
	project, err := s.store.GetProject(ctx, &store.FindProjectMessage{
		Workspace:  common.GetWorkspaceIDFromContext(ctx),
		ResourceID: &database.ProjectID,
	})
	if err != nil {
		slog.Warn("failed to find project", slog.String("project_id", database.ProjectID), log.BBError(err))
		return nil
	}
	if project == nil {
		slog.Warn("project not found", slog.String("project_id", database.ProjectID))
		return nil
	}
	if !project.Setting.AllowJustInTimeAccess {
		slog.Debug("JIT is not enabled in the project", slog.String("project_id", database.ProjectID))
		return nil
	}

	user, ok := GetUserFromContext(ctx)
	if !ok || user == nil {
		return nil
	}

	databaseFullName := common.FormatDatabase(database.InstanceID, database.DatabaseName)
	now := time.Now().UTC().Format(time.RFC3339)

	filter := fmt.Sprintf(
		`status == "ACTIVE" && target == %q && expire_time > %q && query == %q`,
		databaseFullName,
		now,
		strings.TrimSpace(statement),
	)
	if requireExport {
		filter += ` && export == true`
	}
	filterQ, err := store.GetListAccessGrantFilter(filter)
	if err != nil {
		slog.Warn("failed to build access grant filter", log.BBError(err))
		return nil
	}

	grants, err := s.store.ListAccessGrants(ctx, &store.FindAccessGrantMessage{
		Workspace: common.GetWorkspaceIDFromContext(ctx),
		ProjectID: &database.ProjectID,
		Creator:   &user.Email,
		FilterQ:   filterQ,
	})
	if err != nil {
		slog.Warn("failed to list access grants", log.BBError(err))
		return nil
	}

	if len(grants) == 0 {
		return nil
	}
	readOnly, err := isReadOnlyStatementForAccessGrant(ctx, instance.Metadata.GetEngine(), statement)
	if err != nil {
		slog.Warn("failed to validate access grant query", log.BBError(err))