Authorization check for nested queries in database systems
Implementations of the present disclosure include receiving, by a database system, a query, providing, by the database system, a set of checker objects including one or more inner checker objects and an outer checker object, each checker object corresponding to a nested sub-query of the query, providing, by the database system, an authorization list associated with the outer checker object, and executing an authorization check on the query at least partially by: adding collected objects of each inner checker object to the authorization list, adding collected objects of the outer checker object to the authorization list, and determining authorization of an entity based on the authorization list.
1. A computer-implemented method for authorization checks of queries in database systems, the method being executed by one or more processors and comprising:
receiving, by a database system, a query;
providing, by the database system, a set of checker objects comprising one or more inner checker objects and an outer checker object, each checker object corresponding to a nested sub-query of the query, each checker object comprising transient data object that stores database catalog objects and respective authorization types that are collected for subsequent authorization;
providing, by the database system, an authorization list associated with the outer checker object; and
executing an authorization check on the query at least partially by:
adding collected objects of each inner checker object to the authorization list,
adding collected objects of the outer checker object to the authorization list, and
determining authorization of an entity based on the authorization list.
2. The method of claim 1 , wherein executing the authorization check is performed during a semantics check of the query.
3. The method of claim 1 , wherein determining authorization of an entity based on the authorization list is executed in response to determining that each nested sub-query is semantically correct.
4. The method of claim 1 , wherein each checker object collects objects from a system catalog of the database system.
5. The method of claim 1 , wherein collected objects correspond to database objects implicated by the query.
6. The method of claim 1 , wherein determining authorization of an entity based on the authorization list comprises calling a security application programming interface (API) using the authorization list as a parameter, the security API providing a response indicating authorization of the entity.
7. The method of claim 1 , further comprising executing a semantics check on the query in response to determining that the query has passed a syntax check.
8. A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for authorization checks of queries in database systems, the operations comprising:
receiving, by a database system, a query;
providing, by the database system, a set of checker objects comprising one or more inner checker objects and an outer checker object, each checker object corresponding to a nested sub-query of the query, each checker object comprising transient data object that stores database catalog objects and respective authorization types that are collected for subsequent authorization;
providing, by the database system, an authorization list associated with the outer checker object; and
executing an authorization check on the query at least partially by:
adding collected objects of each inner checker object to the authorization list,
adding collected objects of the outer checker object to the authorization list, and
determining authorization of an entity based on the authorization list.
9. The non-transitory computer-readable storage medium of claim 8 , wherein executing the authorization check is performed during a semantics check of the query.
10. The non-transitory computer-readable storage medium of claim 8 , wherein determining authorization of an entity based on the authorization list is executed in response to determining that each nested sub-query is semantically correct.
11. The non-transitory computer-readable storage medium of claim 8 , wherein each checker object collects objects from a system catalog of the database system.
12. The non-transitory computer-readable storage medium of claim 8 , wherein collected objects correspond to database objects implicated by the query.
13. The non-transitory computer-readable storage medium of claim 8 , wherein determining authorization of an entity based on the authorization list comprises calling a security application programming interface (API) using the authorization list as a parameter, the security API providing a response indicating authorization of the entity.
14. The non-transitory computer-readable storage medium of claim 8 , wherein operations further comprise executing a semantics check on the query in response to determining that the query has passed a syntax check.
15. A system, comprising:
a computing device; and
a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations for natural language explanations for authorization checks of queries in database systems, the operations comprising:
receiving, by a database system, a query;
providing, by the database system, a set of checker objects comprising one or more inner checker objects and an outer checker object, each checker object corresponding to a nested sub-query of the query, each checker object comprising transient data object that stores database catalog objects and respective authorization types that are collected for subsequent authorization;
providing, by the database system, an authorization list associated with the outer checker object; and
executing an authorization check on the query at least partially by:
adding collected objects of each inner checker object to the authorization list,
adding collected objects of the outer checker object to the authorization list, and
determining authorization of an entity based on the authorization list.
16. The system of claim 15 , wherein executing the authorization check is performed during a semantics check of the query.
17. The system of claim 15 , wherein determining authorization of an entity based on the authorization list is executed in response to determining that each nested sub-query is semantically correct.
18. The system of claim 15 , wherein each checker object collects objects from a system catalog of the database system.
19. The system of claim 15 , wherein collected objects correspond to database objects implicated by the query.
20. The system of claim 15 , wherein determining authorization of an entity based on the authorization list comprises calling a security application programming interface (API) using the authorization list as a parameter, the security API providing a response indicating authorization of the entity.