Struct QueryAttribution 

pub struct QueryAttribution<'a> {
    pub user_id: &'a str,
    pub email: &'a str,
    pub service_account: Option<&'a str>,
    pub client: &'a str,
    pub agent: &'a str,
    pub entrypoint: &'a str,
    pub session: Option<&'a str>,
    pub notebook: Option<&'a str>,
    pub cell: Option<&'a str>,
    pub client_ip: &'a str,
    pub sql: &'a str,
    pub sql_hash: &'a str,
}

Borrowed view of what execute_query has already resolved, in the same column order as match_schema. service_account/session/notebook/cell are Option because the corresponding header may be absent; every other field always has a value (falling back to "unknown" upstream when nothing better is available).

Fields

user_id: &'a str

email: &'a str

service_account: Option<&'a str>

client: &'a str

agent: &'a str

entrypoint: &'a str

session: Option<&'a str>

notebook: Option<&'a str>

cell: Option<&'a str>

client_ip: &'a str

sql: &'a str

sql_hash: &'a str

Implementations

impl QueryAttribution<'_>

pub fn to_batch(&self) -> RecordBatch

One-row RecordBatch over match_schema, in column order – the only thing QueryDenyList::check builds per query, and the only allocation on the deny-check path.