Lotus.Preflight (Lotus v1.0.0)

Statement preflight authorization for Lotus.

Delegates to the adapter's extract_accessed_resources/2 callback to discover which tables/relations a statement will access, then checks those relations against visibility rules before execution.

This provides defense-in-depth by blocking queries that would access denied tables, even if they're accessed through views or complex subqueries.

When an adapter returns {:unrestricted, reason} the statement is allowed through only if the host application has opted in via config :lotus, :allow_unrestricted_resources; otherwise preflight returns an error.

Summary

Functions

authorize(adapter, statement, search_path \\ nil, scope \\ nil)

Authorizes a statement by checking all relations it would access.

Functions

authorize(adapter, statement, search_path \\ nil, scope \\ nil)

@spec authorize(
  Lotus.Source.Adapter.t(),
  Lotus.Query.Statement.t(),
  String.t() | nil,
  term()
) ::
  :ok | {:error, String.t()}

Authorizes a statement by checking all relations it would access.

Delegates resource extraction to the adapter, then validates each relation against the visibility rules.

scope is the opaque caller-supplied value handed to the visibility resolver, the same one Lotus.list_tables/2 and friends accept. Pass it and a per-scope deny blocks execution; omit it and only the unscoped rules apply. Without it a resolver that hides a table from one tenant would hide it in the explorer while the query still returned its rows.