Function mz_sql::rbac::generate_read_privileges

fn generate_read_privileges(
    catalog: &impl SessionCatalog,
    ids: impl Iterator<Item = CatalogItemId>,
    role_id: RoleId,
) -> Vec<(SystemObjectId, AclMode, RoleId)>

Generates all the privileges required to execute a read that includes the objects in ids.

Not only do we need to validate that role_id has read privileges on all relations in ids, but if any object is a view or materialized view then we need to validate that the owner of that view has all of the privileges required to execute the query within the view.

For more details see: https://www.postgresql.org/docs/15/rules-privileges.html