Struct QueryDenyList 

pub struct QueryDenyList { /* private fields */ }

Owns the Postgres-backed rule store and the compiled, in-memory snapshot every query is checked against. One instance is owned by LakehouseContext, mirroring AudienceIndex.

ctx is a bare SessionContext::new() – no lakehouse tables or catalog registered against it, just DataFusion’s parser and name resolution – held only so compile_match_expr can be called against it. Both refresh and deny_queries’s call_with_args compile through this same context, so rule compilation produces the same result regardless of whose session triggered it.

Implementations

impl QueryDenyList

pub fn new(pool: Pool<Postgres>) -> QueryDenyList

pub fn with_snapshot( pool: Pool<Postgres>, snapshot: Arc<[Arc<QueryDenyRule>]>, ) -> QueryDenyList

Builds a QueryDenyList around an already-compiled snapshot, bypassing Postgres entirely – for tests exercising Self::check’s in-memory semantics without a live DB (pool is unused by check; a connect_lazy pool that never touches the network is enough). Production code should use Self::new plus Self::refresh.

pub fn compile_ctx(&self) -> &SessionContext

A bare SessionContext with no lakehouse tables or catalog registered, for compiling a match_expr outside this QueryDenyList (e.g. from deny_queries’s call_with_args, which is handed the caller’s own session and needs a SQL-expression parser instead).

pub fn rule_count(&self) -> usize

The number of rules currently compiled into the snapshot – what deny_queries checks against max_rules before inserting one more.

pub fn check(&self, q: &QueryAttribution<'_>) -> Option<Arc<QueryDenyRule>>

Checks q against every compiled rule, in order, returning the first (oldest) match. Returns immediately on an empty snapshot – the steady state of a deployment that is not mid-incident – before building the one-row batch every non-empty check needs.

pub async fn list(&self) -> Result<Vec<QueryDenyRow>, Error>

Every rule currently in force, read fresh from Postgres (not the in-memory snapshot) – what list_query_denials() returns.

pub async fn insert( &self, match_expr: &str, compiled: Arc<dyn PhysicalExpr>, reason: &str, created_by: &str, ) -> Result<QueryDenyRow, Error>

Inserts a new rule: compiled must already be the result of a successful compile_match_expr call against match_expr (typically the same call deny_queries’s call_with_args just made to validate it) – insert stores match_expr verbatim and does not re-validate it. Refreshes the local snapshot synchronously before returning, so the admin who created the rule sees it in their own list_query_denials() immediately; other replicas pick it up within one refresh tick.

pub async fn delete(&self, rule_id: Uuid) -> Result<bool, Error>

Deletes a rule by id, refreshing the local snapshot synchronously. Returns true if a row was actually deleted – false lets the caller (remove_query_denial) return a clear “no such rule” message rather than a silent no-op.

pub async fn refresh(&self) -> Result<(), Error>

Flushes each rule’s accumulated last_hit, then reloads the table and recompiles every match_expr. A rule that fails to compile is skipped, never fatal – dropped from the snapshot with a warn! and a query_deny_compile_error_count metric, so an older replica that cannot compile a newer rule declines to enforce it rather than denying everything or crashing. Fail-open on a failed reload: the previous snapshot is kept, with a warn! and a query_deny_refresh_error_count metric – the deny list is an availability valve, not a security control, and failing closed would deny every query on a Postgres blip.

pub fn spawn_refresh_task( self: Arc<QueryDenyList>, shutdown: impl Future<Output = ()> + Send + 'static, )

Spawns the background task that calls Self::refresh once immediately and then on every MICROMEGAS_QUERY_DENY_REFRESH_SECONDS tick, until shutdown resolves. Only the FlightSQL server builder spawns this; other LakehouseContext holders (maintenance daemon, tests) keep an empty snapshot and never deny anything.

Trait Implementations

impl Debug for QueryDenyList

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.