Struct CallerContext 

pub struct CallerContext {
    pub read_scope: ReadScope,
    pub is_admin: bool,
    pub isolation_config: Arc<IsolationConfig>,
    pub identity: Option<String>,
    pub grant_selectors: Arc<[String]>,
}

Bundles the orthogonal authorization inputs make_session_context and friends need – audience scope (read_scope) and the is_admin mutating-function-registration capability – into one struct instead of adjacent, transposable positional parameters.

Required (not Option/defaulted) at every call site by design: a defaulting parameter would let a future call site inherit ReadScope::All by omission, which is exactly the failure this seam exists to prevent. Every call site must state its scope explicitly, via one of the three constructors below or a resolved value from a ReadPolicy.

Fields

read_scope: ReadScope

The audience scope to plan queries under. Consumed by super::ownership_rewrite::OwnershipRewrite inside query.rs::make_session_context.

is_admin: bool

Whether the caller may use the five mutating lakehouse UDTFs/UDFs.

isolation_config: Arc<IsolationConfig>

Per-service data-isolation deployment config (MICROMEGAS_PUBLIC_VIEW_SETS) – resolved once at server startup, not per request, but bundled here rather than as a new make_session_context parameter: per-request resolved values ride the context, per-service objects live on the service, and this rides along with read_scope at every real call site anyway.

identity: Option<String>

The caller’s identity, as recorded in deny_queries’s created_by column. None on internal/maintenance paths – such a caller cannot call deny_queries, which requires Some. One string, not a struct: created_by is the only consumer, so a richer identity type would be written at every construction site and read nowhere.

grant_selectors: Arc<[String]>

The grant selectors this caller matches – "*", "user:<email>" when an email is present, and one "group:<g>" per claimed group – precomputed by rust/public from the AuthContext (micromegas_auth::policy::caller_selectors), so micromegas-analytics never needs the auth crate. Empty for internal and maintenance callers and for a request with no AuthContext at all (--disable-auth). Consumed by list_audience_grants() (list_audience_grants_table_function.rs); admins do not need it – they see every row.

Implementations

impl CallerContext

pub fn internal() -> CallerContext

For background/materialization callers that are not serving a user request at all (is_admin: false, ReadScope::All). Distinct from Self::maintenance only in is_admin – use this for internal call sites that must not register the mutating UDTFs/UDFs.

pub fn maintenance() -> CallerContext

For background/materialization callers performing maintenance work (is_admin: true, ReadScope::All) – never a user session.

Trait Implementations

impl Clone for CallerContext

fn clone(&self) -> CallerContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CallerContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.