Module query_deny_list 

Admin-managed query deny list: fingerprinting, the match context, and the Postgres-backed, TTL-refreshed cache execute_query checks every query against. Admin-managed query deny list: a small set of admin-authored rules, stored in Postgres, cached in every flight-sql-srv replica, and evaluated at the front of execute_query – before the session context is built and before planning – so a matching query is rejected for a few microseconds of work instead of a memory-pool reservation and a wave of object-store reads.

A rule is a boolean SQL expression over a fixed, documented match context (crate::lakehouse::query_deny_list::match_schema) – parsed and evaluated by DataFusion itself, so there is no grammar of our own to specify or keep in sync, and no evaluator of our own to get subtly wrong. Rules stand until an admin removes them explicitly; there is no expiry.

Structs

QueryAttribution

Borrowed view of what execute_query has already resolved, in the same column order as match_schema. service_account/session/notebook/cell are Option because the corresponding header may be absent; every other field always has a value (falling back to "unknown" upstream when nothing better is available).

QueryDenyList

Owns the Postgres-backed rule store and the compiled, in-memory snapshot every query is checked against. One instance is owned by LakehouseContext, mirroring AudienceIndex.

QueryDenyRow

The DB row, exactly as list_query_denials() returns it and as insert echoes back. No compiled expression or in-process timestamp here – those exist only for a rule that has been compiled into a DenySnapshot, and a freshly inserted or listed row has not necessarily been through that yet on every replica.

QueryDenyRule

A row compiled into one snapshot: the row, its planned expression, and the one piece of in-process state a rule accumulates. Lives only inside a DenySnapshot.

Constants

DEFAULT_MAX_RULES

Default value of MICROMEGAS_QUERY_DENY_MAX_RULES.

DEFAULT_REFRESH_SECONDS

Default value of MICROMEGAS_QUERY_DENY_REFRESH_SECONDS.

MICROMEGAS_QUERY_DENY_MAX_RULES

Env var: cap on the number of rules in force at once (bounds per-query evaluation cost).

MICROMEGAS_QUERY_DENY_REFRESH_SECONDS

{prefix}-less env var: snapshot refresh / last_hit_at flush interval, and the bound on cross-replica propagation of a newly inserted or removed rule.

Functions

compile_match_expr

Parses, validates, and plans match_expr into an Arc<dyn PhysicalExpr> – the whole evaluator, correct by construction because DataFusion does the parsing and the evaluation.

fingerprint_of

Literal-stripped fingerprint of a statement: the first 16 hex chars of the SHA-256 of the normalized token stream. Tokenizes internally; the token stream is an implementation detail and does not appear in the signature.

match_schema

max_rules

The cap on rules in force at once, from MICROMEGAS_QUERY_DENY_MAX_RULES (default DEFAULT_MAX_RULES).

skip_for_admin_recovery

The primary escape hatch: the deny-list check is skipped when the caller can reach the admin functions at all – the same predicate register_lakehouse_functions gates deny_queries/remove_query_denial on – and the statement mentions one of deny_queries / remove_query_denial / list_query_denials: three contains checks over the lowercased SQL text, nothing more. No call-position or token analysis: this only ever runs for a query that is already being denied, and the gate it sits behind means any caller it opens for could call those three functions directly anyway.

sorted_snapshot

Sorts rules by (created_at, rule_id), oldest first, and wraps them into a DenySnapshot – pub so tests can build one directly, matching the invariant QueryDenyList::refresh and QueryDenyList::insert maintain internally.

Type Aliases

DenySnapshot

The compiled rules, ordered by (created_at, rule_id), oldest first – so the first match is always the oldest matching rule, on every replica. An alias, not a newtype: nothing hangs behind it. Arc<[_]> rather than Arc<Vec<_>>: the snapshot is immutable once built, and this drops a pointer hop off the per-query path.