Struct mz_sql::rbac::RbacRequirements

struct RbacRequirements {
    role_membership: BTreeSet<RoleId>,
    ownership: Vec<ObjectId>,
    privileges: Vec<(SystemObjectId, AclMode, RoleId)>,
    item_usage: &'static BTreeSet<CatalogItemType>,
    superuser_action: Option<String>,
}

RBAC requirements for executing a given plan.

Fields

role_membership: BTreeSet<RoleId>

The role memberships required.

ownership: Vec<ObjectId>

The object ownerships required.

privileges: Vec<(SystemObjectId, AclMode, RoleId)>

The privileges required. The tuples are of the form: (What object the privilege is on, What privilege is required, Who must possess the privilege).

item_usage: &'static BTreeSet<CatalogItemType>

The types of catalog items that this plan requires USAGE privileges on.

Most plans will require USAGE on secrets and connections but some plans, like SHOW CREATE, can reference an item without requiring any privileges on that item.

superuser_action: Option<String>

Some action if superuser is required to perform that action, None otherwise.

Implementations

impl RbacRequirements

fn empty() -> RbacRequirements

fn validate( self, catalog: &impl SessionCatalog, session: &dyn SessionMetadata, resolved_ids: &ResolvedIds, ) -> Result<(), UnauthorizedError>

fn filter_to_mandatory_requirements(self) -> RbacRequirements

Trait Implementations

impl Debug for RbacRequirements

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RbacRequirements

fn default() -> Self

Returns the “default value” for a type.