queryaccess

const (
	// Admissible indicates the statement is eligible for authorization checks.
	Admissible Admission = "admissible"
	// Rejected indicates the statement is not eligible for authorization checks.
	Rejected Admission = "rejected"
	// IndeterminateAdmission indicates the admission status could not be determined.
	IndeterminateAdmission Admission = "indeterminate"
)

const (
	// IdentityFailureUnavailable means no identity resolver was configured.
	IdentityFailureUnavailable IdentityFailure = "unavailable"
	// IdentityFailureUnknown means the resolver returned unknown / no rows.
	IdentityFailureUnknown IdentityFailure = "unknown"
	// IdentityFailureError means the resolver hit a transport or catalog error.
	IdentityFailureError IdentityFailure = "error"
	// IdentityFailureAmbiguous means multi-match non-unique identity.
	IdentityFailureAmbiguous IdentityFailure = "ambiguous"
	// IdentityFailureCoercionGap means required coercion is unsupported.
	IdentityFailureCoercionGap IdentityFailure = "coercion_gap"
)

const (
	// IdentityStatusResolved means a unique catalog identity was established.
	// Facts may be present; this is NOT a trust claim.
	IdentityStatusResolved IdentityStatus = "resolved"
	// IdentityStatusUnknown means no matching catalog row / no unique identity.
	IdentityStatusUnknown IdentityStatus = "unknown"
	// IdentityStatusAmbiguous means multi-match non-unique identity.
	IdentityStatusAmbiguous IdentityStatus = "ambiguous"
	// IdentityStatusCoercionGap means required coercion is outside the bounded graph.
	IdentityStatusCoercionGap IdentityStatus = "coercion_gap"
	// IdentityStatusLookupFailed means transport/catalog error during lookup.
	IdentityStatusLookupFailed IdentityStatus = "lookup_failed"
	// IdentityStatusUnavailable means no identity resolver was configured or usable.
	IdentityStatusUnavailable IdentityStatus = "unavailable"
)

const (
	// ModeStrict requires all referenced columns to be authorized.
	ModeStrict Mode = "strict"
	// ModeProjectionOnly requires only projected (SELECT-list) columns to be authorized.
	ModeProjectionOnly Mode = "projection_only"
)

const (
	// ReadOnly indicates the statement contains no write operations.
	ReadOnly ReadClassification = "read_only"
	// NotReadOnly indicates the statement contains at least one write operation.
	NotReadOnly ReadClassification = "not_read_only"
	// Indeterminate indicates the read-only status could not be determined.
	Indeterminate ReadClassification = "indeterminate"
)

const (
	// ReasonParseFailure indicates the statement could not be parsed.
	ReasonParseFailure ReasonCode = "parse_failure"
	// ReasonUnsupportedDialect indicates the dialect is not supported.
	ReasonUnsupportedDialect ReasonCode = "unsupported_dialect"
	// ReasonWriteOperation indicates a write operation was detected.
	ReasonWriteOperation ReasonCode = "write_operation"
	// ReasonMultiStatement indicates multiple statements were provided.
	ReasonMultiStatement ReasonCode = "multi_statement"
	// ReasonSchemaUnavailable indicates schema metadata was not available.
	ReasonSchemaUnavailable ReasonCode = "schema_unavailable"
	// ReasonAmbiguousReference indicates a reference could not be uniquely resolved.
	ReasonAmbiguousReference ReasonCode = "ambiguous_reference"
	// ReasonFunctionEffect indicates a function call with unknown side effects.
	// Used by MySQL/TiDB empty-allowlist path (legacy name).
	ReasonFunctionEffect ReasonCode = "unknown_function_effect"

	// ReasonUnprovenOperatorEffect indicates an operator expression was present
	// but its catalog identity was not proven trusted for pure-read admission.
	ReasonUnprovenOperatorEffect ReasonCode = "unproven_operator_effect"
	// ReasonUnprovenFunctionEffect indicates a function or aggregate call was
	// present but its catalog identity was not proven trusted.
	ReasonUnprovenFunctionEffect ReasonCode = "unproven_function_effect"
	// ReasonUnprovenCastEffect indicates a cast expression was present but its
	// cast path identity was not proven trusted.
	ReasonUnprovenCastEffect ReasonCode = "unproven_cast_effect"

	// ReasonIdentityResolverUnavailable indicates effect-identity resolution was
	// required but no identity resolver was configured.
	ReasonIdentityResolverUnavailable ReasonCode = "identity_resolver_unavailable"
	// ReasonIdentityUnknown indicates the resolver returned an unknown / no-match identity.
	ReasonIdentityUnknown ReasonCode = "identity_unknown"
	// ReasonIdentityLookupFailed indicates the resolver failed with a transport or catalog error.
	// Public results must never embed the underlying error text.
	ReasonIdentityLookupFailed ReasonCode = "identity_lookup_failed"
	// ReasonIdentityAmbiguous indicates multi-match identity resolution (non-unique).
	ReasonIdentityAmbiguous ReasonCode = "identity_ambiguous"
	// ReasonIdentityCoercionGap indicates type coercion required for unique identity
	// is outside the supported bounded resolution graph.
	ReasonIdentityCoercionGap ReasonCode = "identity_coercion_gap"

	// ReasonUnqualifiedRelationBlocked indicates that an unqualified relation
	// was present in a PostgreSQL query with a trusted bundle, which blocks
	// promotion to admissible due to search_path ambiguity.
	ReasonUnqualifiedRelationBlocked ReasonCode = "unqualified_relation_blocked"

	// ReasonViewExpansionRequired indicates that a query involves a view
	// whose definition must be expanded to determine base-table requirements.
	// Without view expansion, the query cannot be promoted to admissible
	// because hidden reads may exist that requirements cannot cover.
	ReasonViewExpansionRequired ReasonCode = "view_expansion_required"

	// ReasonUnsupportedTraversal indicates that a SQL clause could not be fully
	// traversed. Emitted for JOIN USING clauses where column names require
	// catalog resolution, and for unhandled AST node types that may contain
	// hidden expression subnodes with operators/functions/casts.
	ReasonUnsupportedTraversal ReasonCode = "unsupported_traversal"
)

const (
	// RelationTable indicates a base table reference.
	RelationTable RelationKind = "table"
	// RelationView indicates a view reference.
	RelationView RelationKind = "view"
	// RelationCTE indicates a common table expression reference.
	RelationCTE RelationKind = "cte"
	// RelationDerived indicates a derived table (subquery) reference.
	RelationDerived RelationKind = "derived"
)

const (
	// UsageProjection indicates the column appears in the SELECT list.
	UsageProjection UsageContext = "projection"
	// UsageFilter indicates the column appears in a WHERE clause or aggregate FILTER clause.
	UsageFilter UsageContext = "filter"
	// UsageJoin indicates the column appears in a JOIN condition.
	UsageJoin UsageContext = "join"
	// UsageGrouping indicates the column appears in a GROUP BY clause.
	UsageGrouping UsageContext = "grouping"
	// UsageHaving indicates the column appears in a HAVING clause.
	UsageHaving UsageContext = "having"
	// UsageOrdering indicates the column appears in an ORDER BY clause.
	UsageOrdering UsageContext = "ordering"
	// UsageWindow indicates the column appears in a window PARTITION BY or frame bound.
	UsageWindow UsageContext = "window"
	// UsageDistinctOn indicates the column appears in a DISTINCT ON clause.
	UsageDistinctOn UsageContext = "distinct_on"
	// UsageLimit indicates the column appears in a LIMIT or OFFSET expression.
	UsageLimit UsageContext = "limit"
)

const (
	// WarningAmbiguousColumn indicates a column reference matched multiple relations.
	WarningAmbiguousColumn WarningCode = "ambiguous_column"
	// WarningMissingSchema indicates the default schema was not specified.
	WarningMissingSchema WarningCode = "missing_schema"
	// WarningDeprecatedSyntax indicates deprecated SQL syntax was encountered.
	WarningDeprecatedSyntax WarningCode = "deprecated_syntax"
	// WarningInferenceRisk indicates projection-only mode may leak data via non-projected columns.
	WarningInferenceRisk WarningCode = "projection_only_inference_risk"
)