Documentation
¶
Overview ¶
Package sqlast parses the read statements an agent may run (SELECT, WITH ... SELECT and EXPLAIN SELECT) into a syntax tree, per dialect, and analyses it: it resolves every column to the base columns it comes from (through aliases, functions, expressions, subqueries, CTEs, set operations and joins), checks functions against an allowlist and decides how PII columns may be used.
The grammar is a deliberately small subset of SQL. Anything outside it is refused: a statement the parser cannot read with certainty never runs.
Index ¶
- type Analysis
- type Between
- type Binary
- type Body
- type CTE
- type Case
- type Cast
- type Catalog
- type Collate
- type ColumnRef
- type Derived
- type Env
- type Exists
- type Expr
- type FuncCall
- type In
- type IsTest
- type Join
- type KCheck
- type Kind
- type Like
- type Limit
- type LitKind
- type Literal
- type OrderItem
- type Output
- type Paren
- type Prov
- type Query
- type Replacement
- type Select
- type SelectItem
- type SetOp
- type Source
- type Span
- type Statement
- type Subquery
- type Table
- type TableExpr
- type TableName
- type Tuple
- type Unary
- type Use
- type When
- type Window
- type With
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Analysis ¶
type Analysis struct {
Outputs []Output
// Relations are the base relations read, "db.table".
Relations []string
// Uses are the PII columns the statement touches.
Uses []Use
// KChecks must all pass (k rows or more) before the statement runs.
KChecks []KCheck
// PIIFilter is set when a PII column is compared with a constant: row
// estimates must not reach the agent.
PIIFilter bool
Replacements []Replacement
}
Analysis is what Analyze finds.
func Analyze ¶
Analyze resolves the provenance of every output column of st, checks the functions against the allowlist and, when env.Masking is set, applies the PII usage rules. Errors are *sqlclass.Refusal values.
type Body ¶
type Body interface {
// contains filtered or unexported methods
}
Body is a *Select, a *SetOp or a parenthesised *Query.
type Catalog ¶
type Catalog interface {
// Lookup returns the relations a table name (folded parts, as written)
// may denote: none when it is unknown, several when it is ambiguous.
Lookup(parts []string) ([]Table, error)
}
Catalog resolves table names.
type Env ¶
type Env struct {
Catalog Catalog
// Rule returns the mask mode of a base column, and whether a rule
// covers it.
Rule func(Source) (mode string, masked bool)
// Masking is false for an unmask plan: provenance and functions are
// still checked, but not the PII usage rules.
Masking bool
// Token resolves a string literal (without quotes) that looks like a
// token issued by the console. isToken reports the token format; ok
// whether the console knows it.
Token func(lit string) (value string, isToken, ok bool)
}
Env is what Analyze needs besides the statement.
type FuncCall ¶
type FuncCall struct {
// Name is the folded, dot-joined function name.
Name string
Args []Expr
Star bool // COUNT(*)
Distinct bool
// OrderBy is an ordered-set argument: string_agg(x, ',' ORDER BY y),
// GROUP_CONCAT(x ORDER BY y).
OrderBy []*OrderItem
Filter Expr
Over *Window
Sp Span
}
FuncCall is a function call, aggregate or window function.
type IsTest ¶
type IsTest struct {
X Expr
Not bool
What string // NULL, TRUE, FALSE, UNKNOWN, DISTINCT
Y Expr // DISTINCT FROM y
Sp Span
}
IsTest is x IS [NOT] NULL|TRUE|FALSE|UNKNOWN or IS [NOT] DISTINCT FROM y.
type Join ¶
type Join struct {
Kind string // INNER, LEFT, RIGHT, FULL, CROSS
Natural bool
Left, Right TableExpr
On Expr
Using []string
Sp Span
}
Join joins two table expressions.
type KCheck ¶
type KCheck struct {
SQL string
// Grouped checks the smallest group (its result may be NULL when no
// group remains); otherwise it counts the rows.
Grouped bool
}
KCheck is a row-count query the console runs before the statement, to check that a PII filter, grouping or aggregate covers at least k rows.
type Kind ¶
type Kind int
Kind says how a value derives from its sources.
const ( // KindConst involves no column. KindConst Kind = iota // KindCount is a row count (COUNT): it reveals no value of its sources. KindCount // KindIdentity is a value of one of its sources: a plain reference, // through aliases, subqueries, CTEs and set operations, or MIN/MAX. KindIdentity // KindAggregate is another aggregate of its sources (SUM, AVG, ...). KindAggregate // KindExpr is any other expression of its sources. KindExpr )
Kinds, from the least to the most transformed.
type Limit ¶
type Limit struct {
Count, Offset int64
}
Limit is a LIMIT/OFFSET or FETCH FIRST clause; both are literal integers.
type Literal ¶
type Literal struct {
Kind LitKind
// Text is the source text of the literal (with its quotes).
Text string
Sp Span
}
Literal is a constant.
type Output ¶
type Output struct {
// Label is the column label the engine must report (an alias or a
// plain column name), "" when the engine chooses it.
Label string
Prov Prov
// Mask is the mask mode of the column, "" for none.
Mask string
}
Output is one result column.
type Prov ¶
type Prov struct {
Sources []Source
Kind Kind
// Sensitive is set when a source is under a mask rule and the value
// reveals source values (Kind Identity, Aggregate or Expr).
Sensitive bool
// Modes are the mask modes of the sensitive sources.
Modes []string
// Lit is set when some values may be literals of the statement (a
// UNION of a column and a constant, for instance).
Lit bool
}
Prov is the provenance of a value.
type Query ¶
Query is a full query expression: an optional WITH, a body and the ORDER BY and LIMIT that apply to the whole body.
type Replacement ¶
Replacement substitutes a token literal with the value it stands for in the statement that runs.
type Select ¶
type Select struct {
Distinct bool
DistinctOn []Expr
Items []*SelectItem
From []TableExpr
Where Expr
GroupBy []Expr
Having Expr
Sp Span
// Spans of the FROM list, the WHERE condition, the GROUP BY list and
// the HAVING condition (without their keywords); zero when absent.
FromSp, WhereSp, GroupSp, HavingSp Span
}
Select is one SELECT core.
type SelectItem ¶
SelectItem is one select-list entry: an expression with an optional alias, or a star (optionally qualified: t.*).
type Source ¶
type Source struct {
DB, Table, Column string
// View marks a column of a view (or of a relation whose base columns
// are unknown): rules match it by column name.
View bool
}
Source is a base column, as the catalog names it. For PostgreSQL DB is the schema.
type Statement ¶
type Statement struct {
// Explain is set for EXPLAIN SELECT: the console runs the EXPLAIN
// itself, without ANALYZE.
Explain bool
Query *Query
// SQL is the statement text the spans refer to.
SQL string
Dialect sqlclass.Dialect
}
Statement is one parsed read statement.
type TableExpr ¶
type TableExpr interface {
// contains filtered or unexported methods
}
TableExpr is a *TableName, a *Derived or a *Join.
type TableName ¶
type TableName struct {
// Parts are the folded name parts: [table], [db, table] or
// [catalog, schema, table].
Parts []string
Alias string
ColAliases []string
Sp Span
}
TableName is a named relation: a table, a view or a CTE.