queryaccess

package
v0.380.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 12, 2026 License: Apache-2.0 Imports: 6 Imported by: 0

README

Application Query Access Module

Application-level contracts for query access analysis, defining the schema resolver interface, request/result types, dialect-specific extraction adapters, and metadata-backed resolution.

Files

File Responsibility
doc.go Declares the queryaccess application package boundary
contracts.go Defines SchemaResolver interface, RelationSchema, ColumnSchema, QueryAccessRequest, and QueryAccessResult
extract_tidb.go Bridges TiDB infrastructure query access facts to domain types with admission computation
extract_tidb_test.go Verifies TiDB extraction bridging: classification, admission, CTE permissions, mode normalization, and column usages
extract_postgresql.go Bridges PostgreSQL infrastructure query access facts to domain types with admission computation
extract_postgresql_stub.go Returns ErrPostgreSQLNotAvailable when built without the postgresql tag
service.go Orchestrates query access analysis: extraction by dialect, optional metadata resolution, requirement generation, sorting, and validation
resolve.go Implements metadata-backed resolution: request-scoped caching, wildcard expansion, alias resolution, column disambiguation, view detection, and output lineage enrichment
resolve_test.go Verifies resolution logic with a fake resolver: schema defaulting, cache deduplication, qualified/unqualified columns, missing metadata, cancellation, star expansion, views, CTEs, derived tables, aliases, output lineage
requirements.go Generates access requirements based on mode: strict requires all columns, projection-only requires only output-contributing columns with inference risk warning
requirements_test.go Verifies requirement generation: salary threshold, blacklist JOIN, GROUP/HAVING, ORDER BY, hashed output, subquery correlation, mode equality, stable warnings, invalid mode, unresolved references
service_test.go Verifies service integration: offline mode, metadata mode, mode normalization, classification preservation, wildcard expansion

Exports

  • SchemaResolver
  • RelationSchema
  • ColumnSchema
  • QueryAccessRequest
  • QueryAccessResult
  • Service
  • ExtractTiDBQueryAccess()
  • AnalyzePostgreSQL()
  • ResolveMetadata() (testing)
  • BuildRequirements() (testing)

Notes

  • SchemaResolver is an optional interface; callers may pass nil when schema metadata is unavailable.
  • QueryAccessResult wraps the domain Result for application-layer consumption.
  • QueryAccessRequest.Mode is a string that the domain layer normalizes via NormalizeMode.
  • ExtractTiDBQueryAccess computes admission from read classification: read_only → admissible, not_read_only → rejected, indeterminate → indeterminate.
  • AnalyzePostgreSQL follows the same admission computation pattern as TiDB.
  • CTE relations are marked with PermissionRequired: false; base tables and derived tables require permission.
  • Service.Analyze routes by dialect, applies optional metadata resolution, generates requirements based on mode, sorts output, and validates the result.
  • buildRequirements generates access requirements based on mode: strict requires all resolved columns, projection-only requires only output-contributing columns and emits inference_risk warning.
  • Both modes require every permission-bearing relation (PermissionRequired: true).
  • Required unresolved references produce indeterminate requirements.
  • Resolution caches relation schemas per request (key: schema.name). CTEs and derived tables bypass resolution.
  • Views are detected from metadata and marked as RelationView kind without definition expansion.
  • Unqualified columns resolve only when exactly ONE source relation has the column.
  • Wildcards expand in deterministic ordinal order when metadata is available.

Dependencies

  • Upstream: internal/interfaces/*
  • Downstream: internal/domain/queryaccess, internal/infrastructure/parser/tidb, internal/infrastructure/parser/postgresql, internal/infrastructure/metadata/mysql, internal/infrastructure/metadata/postgresql

Update Rule

  • If members/interfaces/dependencies change, update this file in same change.

Documentation

Overview

Package queryaccess defines application-level contracts for query access analysis. input: SQL text, dialect, mode, and optional schema resolver output: domain-typed query access results for transport adapters pos: application contract layer for the query access analysis foundation note: if this file changes, update this header and module README.md.

Package queryaccess defines application-level contracts for query access analysis. input: SQL text, dialect, mode, and optional schema resolver output: domain-typed query access results for transport adapters pos: application contract layer for the query access analysis foundation note: if this file changes, update this header and module README.md.

Package queryaccess provides the PostgreSQL query access stub when built without the postgresql tag. input: none (stub only) output: ErrPostgreSQLNotAvailable for all calls pos: application stub for non-PostgreSQL builds note: if this file changes, update this header and module README.md.

Package queryaccess provides TiDB query access extraction bridging infrastructure facts to domain types. input: SQL text, dialect, mode, default schema, and optional schema resolver output: domain-typed query access results for transport adapters pos: application adapter bridging TiDB infrastructure query access facts to domain query access types note: if this file changes, update this header and module README.md.

Package queryaccess implements requirement generation for query access analysis. input: resolved query access facts (relations, columns, outputs, unresolved) and mode output: access requirements, warnings, and reason codes pos: application requirement layer bridging resolved facts to permission requirements note: if this file changes, update this header and module README.md.

Package queryaccess implements metadata-backed resolution for query access analysis. input: domain Result with extracted facts, SchemaResolver for metadata lookup output: enriched Result with resolved wildcards, columns, aliases, and lineage pos: application resolution layer bridging extracted facts to metadata-resolved results note: if this file changes, update this header and module README.md.

Package queryaccess provides the application service for query access analysis. input: SQL text, dialect, mode, default schema, and optional schema resolver output: domain-typed query access results with optional metadata resolution pos: application orchestration layer for query access analysis note: if this file changes, update this header and module README.md.

Index

Constants

View Source 
const (
	ReasonMissingMetadata    domain.ReasonCode = "missing_metadata"
	ReasonRelationNotFound   domain.ReasonCode = "relation_not_found"
	ReasonColumnNotFound     domain.ReasonCode = "column_not_found"
	ReasonAmbiguousColumn    domain.ReasonCode = "ambiguous_column"
	ReasonRelationAmbiguous  domain.ReasonCode = "relation_ambiguous"
	ReasonUnresolvedWildcard domain.ReasonCode = "unresolved_wildcard"
	ReasonUnresolvedAlias    domain.ReasonCode = "unresolved_alias"
)

UnresolvedReason constants for bounded unresolved tracking.

Variables

View Source 
var ErrExtractionFailed = errors.New("query access extraction failed")

ErrExtractionFailed indicates query access extraction failed without exposing SQL text.

View Source 
var ErrPostgreSQLNotAvailable = errors.New("postgresql support requires build tag: go build -tags postgresql")

ErrPostgreSQLNotAvailable indicates PostgreSQL support was not compiled in.

Functions

func BuildRequirements 

func BuildRequirements(
	mode domain.Mode,
	relations []domain.RelationReference,
	columns []domain.ColumnReference,
	outputs []domain.OutputColumn,
	unresolved []domain.Unresolved,
) ([]domain.Requirement, []domain.WarningCode, []domain.ReasonCode, error)

BuildRequirements exposes requirement generation for testing.

func FormatRelationSchemaKey 

func FormatRelationSchemaKey(schema, name string) string

FormatRelationSchemaKey returns a cache key for a relation schema lookup.

func NewResolutionState 

func NewResolutionState(ctx context.Context, resolver SchemaResolver, dialect, defaultSchema string, relations []domain.RelationReference) *resolutionState

NewResolutionState creates a resolution state for testing.

func ResolveMetadata 

func ResolveMetadata(ctx context.Context, resolver SchemaResolver, dialect, defaultSchema string, result domain.Result) domain.Result

ResolveMetadata exposes the metadata resolution for testing.

Types

type ColumnSchema 

type ColumnSchema struct {
	Name    string
	Ordinal int
}

ColumnSchema contains metadata about a column.

type QueryAccessRequest 

type QueryAccessRequest struct {
	SQL            string
	Dialect        string
	Mode           string
	DefaultSchema  string
	SchemaResolver SchemaResolver // optional
}

QueryAccessRequest is the input for query access analysis.

type QueryAccessResult 

type QueryAccessResult struct {
	DomainResult domain.Result
}

QueryAccessResult wraps the domain result for application-layer consumption.

func AnalyzePostgreSQL 

func AnalyzePostgreSQL(_ context.Context, _ QueryAccessRequest) (QueryAccessResult, error)

AnalyzePostgreSQL returns ErrPostgreSQLNotAvailable when built without the postgresql tag.

func ExtractTiDBQueryAccess 

func ExtractTiDBQueryAccess(ctx context.Context, req QueryAccessRequest) (QueryAccessResult, error)

ExtractTiDBQueryAccess extracts query access facts from TiDB SQL and converts to domain types.

type RelationSchema 

type RelationSchema struct {
	Schema  string
	Name    string
	Kind    string // "table" or "view"
	Columns []ColumnSchema
	IsView  bool
}

RelationSchema contains metadata about a relation for resolution.

type SchemaResolver 

type SchemaResolver interface {
	ResolveRelation(ctx context.Context, dialect string, schema, name string) (RelationSchema, error)
}

SchemaResolver resolves relation metadata for name resolution.

type Service 

type Service struct{}

Service orchestrates query access analysis.

func (*Service) Analyze 

func (s *Service) Analyze(ctx context.Context, req QueryAccessRequest) (QueryAccessResult, error)

Analyze performs query access analysis with optional metadata resolution. When SchemaResolver is nil, wildcards and unqualified columns remain unresolved.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.