Struct AudienceGuard 

pub struct AudienceGuard { /* private fields */ }

The whole guard: pure decision (is_readable) plus async resolution (AudienceIndex), fail-closed throughout. One instance is built per request (in query.rs’s register_lakehouse_functions) and shared, via Arc, across every arg-addressed UDTF/UDF the request’s session registers.

Implementations

impl AudienceGuard

pub fn new( read_scope: ReadScope, lakehouse_admin: bool, public_view_sets: Vec<String>, index: Arc<AudienceIndex>, ) -> AudienceGuard

pub fn read_scope(&self) -> &ReadScope

The caller’s scope. Exposed so callers with their own row-level filtering (list_partitions) can decide up front whether to even attempt an optimization (e.g. LIMIT pushdown) that’s only valid under ReadScope::All.

pub async fn authorize( &self, id: Uuid, kind: IdKind, fname: &str, ) -> Result<Authorized, DataFusionError>

ReadScope::All ⇒ Ok with no I/O at all. Otherwise resolves id’s owning process’s audience and denies with a uniform, existence-oracle-proof message ({fname}: '{id}' not found or not accessible) on anything but a readable verdict – a resolution error included, never a pass. The real reason (resolved OwnerAudience, the caller’s scope) is logged at debug!, for operators only.

pub async fn readable_ids( &self, ids: &[Uuid], kind: IdKind, ) -> Result<HashSet<Uuid>, DataFusionError>

Batch form of the same rule, for the callers that row-filter (list_partitions) or need an all-or-nothing verdict over a batch (get_payload) rather than a single witness. ReadScope::All ⇒ every id is readable, with no I/O.

pub fn is_public_view_set(&self, view_set_name: &str) -> bool

Whether view_set_name is on the MICROMEGAS_PUBLIC_VIEW_SETS allowlist – an operator declaring every row of a view set readable by any authenticated caller. Shared by Self::global_rows_visible and Self::authorize_view_instance’s rule (2) so the two read the same allowlist through one accessor.

pub fn global_rows_visible(&self, view_set_name: &str) -> bool

list_partitions’ 'global'-row rule: a global partition is a multi-audience file – it has no single owning audience to check against the caller’s scope. Visible under ReadScope::All, when view_set_name is on the public allowlist, or when the caller passes the lakehouse admin gate (the same boolean that already governs the mutating UDTFs/UDFs: a caller who can retire_partitions/regenerate_partitions a global file can see it – no new authority, no new knob).

pub async fn authorize_view_instance( &self, view_set_name: &str, view_instance_id: &str, ) -> Result<(), DataFusionError>

The view_instance(view_set_name, view_instance_id) scan-time check, run by MaterializedView::scan before jit_update – so a caller scoped to one audience cannot trigger JIT materialization of an instance it cannot read.

Rules, in order:

1. ReadScope::All -> Ok(()), no I/O. Internal, maintenance, --disable-auth, and every inner session built from an Authorized::internal_caller() take this arm.
2. view_set_name on public_view_sets -> Ok(()). Matches the row-level filter: an operator who declared a view set public has said every row of it is readable, so denying materialization of one of its instances would be incoherent. Confidentiality-only: this leaves the cost/availability residual this method exists to close fully open for any view set an operator puts on the allowlist – any authenticated caller can still force jit_update for arbitrary process/stream ids of a public view set. Deliberate.
3. view_instance_id == "global" -> Ok(()). Global instances are row-filtered, not call-guarded: jit_update is a no-op for every 'global' instance today (LogView/MetricsView, the only two view sets that accept 'global'), so there is no materialization to protect against, and denying the call would break the legal view_instance('log_entries', 'global') spelling of SELECT * FROM log_entries for no security gain – the row-level filter already filters its rows one at a time. This is a different rule from list_partitions’ global_rows_visible, which gates visibility of partition metadata about a 'global' file with no per-row filter available; reusing it here would deny the log_entries/measures 'global' instances to every non-admin scoped caller, a regression. The invariant that makes this rule sound – 'global' never triggers JIT – lives in each view set’s jit_update impl; a future view set whose 'global' instance does materialize would need to revisit this rule.
4. view_instance_id parses as a Uuid -> Self::authorize under IdKind::ProcessOrStream, discarding the returned Authorized. The witness exists to gate construction of an inner unscoped session; this call site builds none – jit_update’s CallerContext::internal() is unchanged and stays where it is.
5. anything else -> the same uniform denial as (4). Fail-closed, matching list_partitions’s “anything else is dropped” rule. Unreachable for today’s view sets (every make_view either accepts 'global' or Uuid::parse_strs, failing at plan time otherwise), so this is a safety net against a future view set with a different id vocabulary.

Trait Implementations

impl Debug for AudienceGuard

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.