Module flight_sql_service_impl 

minimal FlightSQL protocol implementation

Structs

FlightSqlServiceImpl

Implementation of the Flight SQL service.

Constants

MAX_PLAN_CHARS

Cap on the physical-plan text appended to the server-side log line. The plan can render arbitrarily long file_groups= sections for wide scans, and this text is server-log-only, never returned to the client.

Functions

build_denial_warn_line

Builds the warn! line for a query-deny-list denial: the rule id, its reason, the query’s normalized fingerprint, the caller’s identity/client attribution, and the query_id. pub so a test can assert its content directly, the same way build_log_line’s content is asserted, rather than by capturing log output.

build_log_line

Builds the full server-side log line for a classified DataFusionError: desc, the error’s own Display (its outer Context chain intact, with backtrace if enabled – unlike find_root(), which is for classification only), the query_id, and – when there’s no diagnostic span to show the caller instead – the truncated physical plan text. pub so tests can assert its content, including the truncation marker, without capturing log output.

classify_datafusion_error

Classifies the root cause of a DataFusionError into the gRPC status code that best distinguishes “the caller’s SQL/input was bad” from “the server broke”: Execution/Configuration land under InvalidArgument since they signal bad input, while ArrowError stays Internal since it reflects a real server-side decode failure.

classify_flight_error

Recovers the DataFusionError from the per-batch FlightError re-wrap (FlightError::ExternalError(Box::new(e)), applied once the raw DataFusionError stream is wrapped for Arrow Flight) and classifies it via client_error. Every branch logs exactly once before returning, so this is a single, unconditional log point for the per-batch stream-error site regardless of which branch is taken. pub so step 9’s external integration tests can exercise this recovery path directly.

client_error

Classifies err, builds the client-facing Status – desc + root-error text (backtrace stripped) + an optional diagnostic span/notes/helps + query_id – and logs the full error server-side. The physical plan, when present and there’s no diagnostic span to show instead, only ever reaches the server log, never the returned Status: displayable can render object-store partition paths from Micromegas view scans, which would leak internal lakehouse details to every caller hitting an execution-time error.

error_class

Maps a gRPC status code to the QueryAuditRecord.error_class bucket used both by the audit log and to gate the query_failed/ query_duration_with_error metrics. This is the derived mapping used for every DataFusionError-rooted failure; the query-deny-list check stamps a fourth value, "denied", directly via QueryAuditState::fail_with_class rather than through this function, since a denial’s ResourceExhausted code would otherwise land in the "resource" bucket alongside a genuine resource-budget failure.