Module read_scope 

Authorization seam input: ReadScope and the CallerContext bundle threaded into make_session_context. Consumed by the row-level filter (ownership_rewrite::OwnershipRewrite) and the call-level guard (audience_guard::AudienceGuard). The analytics-side half of the authorization seam.

ReadScope is the query planner’s authorization input – what a ReadPolicy (micromegas-auth) resolves down to. micromegas-analytics does not depend on micromegas-auth: that edge would pull in the whole OIDC/JWT dependency tree behind one enum, so ReadScope carries resolved audiences only – no group vocabulary, no policy trait, nothing that requires a store. The rust/public bridge is the only place a ReadableAudiences (from micromegas-auth) becomes a ReadScope.

Enforcement has two layers. crate::lakehouse::ownership_rewrite::OwnershipRewrite (the row-level filter) reads ReadScope out of crate::lakehouse::read_scope::CallerContext inside query.rs::make_session_context and injects an audience predicate into every MaterializedView-backed scan. The call-level guard is the UDTF/UDF guards (crate::lakehouse::audience_guard::AudienceGuard) for the span/metadata functions the row-level filter structurally cannot reach, plus CallerContext.is_admin’s mutating-function registration gate. view_instance(...) is also guarded by the call-level guard, closing a cost/availability residual for the six view sets carrying a physical audience column, where the row-level filter already filters view_instance scans row-by-row, same as the named-table form; for the other five view sets, reachable only through a guarded view_instance(...), the call-level guard is the sole enforcement – the row-level filter injects no predicate there at all.

Structs

CallerContext

Bundles the orthogonal authorization inputs make_session_context and friends need – audience scope (read_scope) and the is_admin mutating-function-registration capability – into one struct instead of adjacent, transposable positional parameters.

IsolationConfig

Deployment config for the data-isolation seam: super::ownership_rewrite::OwnershipRewrite (the row-level filter). Resolved once at server startup from environment variables – see IsolationConfig::from_env.

Enums

ReadScope

The authorization scope a query planner may read under.