Module deny_queries_table_function 

Admin UDTF that validates and inserts a query-deny-list rule deny_queries(match_expr, reason) – admin UDTF that validates and inserts a new query-deny- list rule. call_with_args runs every validation synchronously and fail-loud with plan_err!: expression compilation (compile_match_expr, against the bare SessionContext QueryDenyList holds for exactly this, not the caller’s own session – rule compilation must produce the same result on every replica regardless of whose session triggered it), the empty-reason check, the caller-identity check (CallerContext::identity must be Some), and the rule-count check against the current snapshot. Only the DB write and the local snapshot refresh happen in the async body, behind LogStreamTableProvider/TaskLogExecPlan – QueryDenyList::insert takes the already-compiled expression and cannot itself fail on a bad expression.

Structs

DenyQueriesTableFunction

A DataFusion TableFunctionImpl for deny_queries(match_expr, reason).