Method resolveWriteTargets

backend/api/v1/sql_service.go:1917–1988

resolveWriteTargets returns the tables a DML/DDL statement writes/changes, using the same extractor plan-check trusts. Returns (nil, nil) when the engine has no extractor, the statement can't be parsed, or no targets are found — callers must then fall back to the database-level check (never fail ope

(
	ctx context.Context,
	instance *store.InstanceMessage,
	database *store.DatabaseMessage,
	statement string,
	requestSchema string,
)

// records nothing and falls back to the request-database check. Object DDL the extractor does
// not model still resolves to zero targets → request-database fallback.
func (s *SQLService) resolveWriteTargets(
	ctx context.Context,
	instance *store.InstanceMessage,
	database *store.DatabaseMessage,
	statement string,
	requestSchema string,
) ([]writeTargetResource, error) {
	engine := instance.Metadata.GetEngine()

	stmts, err := parserbase.ParseStatements(engine, statement)
	if err != nil {
		//nolint:nilerr // unparseable here → fall back to database-level check (already parsed once for the span)
		return nil, nil
	}
	asts := parserbase.ExtractASTs(stmts)
	if len(asts) == 0 {
		return nil, nil
	}

	// Cache-first: GetQuerySpan already fetched and cached this database's metadata earlier in
	// the same request, so reuse it instead of issuing a second store query on the write path.
	dbMeta, err := s.store.GetDBSchemaSnapshot(ctx, common.GetWorkspaceIDFromContext(ctx), database.InstanceID, database.DatabaseName)
	if err != nil {
		return nil, err
	}
	if dbMeta == nil {
		return nil, nil
	}

	changeSummary, err := parserbase.ExtractChangedResources(
		engine, database.DatabaseName, schemaForWriteTargetResolution(engine, database.DatabaseName, requestSchema), dbMeta, asts, statement,
	)
	if err != nil || changeSummary == nil || changeSummary.ChangedResources == nil {
		//nolint:nilerr // unsupported engine / no result → fall back to database-level check
		return nil, nil
	}

	var targets []writeTargetResource
	databasesWithTableTarget := map[string]bool{}
	for _, db := range changeSummary.ChangedResources.Build().GetDatabases() {
		for _, sc := range db.GetSchemas() {
			schema := sc.GetName()
			// An unqualified target whose executed schema can't be determined here resolves
			// to the sentinel; treat it as unknown ("") so the schema_name attribute is
			// omitted (fail-closed for schema-scoped grants, still matches table-only ones).
			if schema == unresolvedSchemaSentinel {
				schema = ""
			}
			for _, tbl := range sc.GetTables() {
				databasesWithTableTarget[db.GetName()] = true
				targets = append(targets, writeTargetResource{
					database: db.GetName(),
					schema:   schema,
					table:    tbl.GetName(),
				})
			}
		}
	}