diesel/sqlite/connection/

authorizer.rs

//! Types for the SQLite authorizer callback.
//!
//! See [`sqlite3_set_authorizer`](https://sqlite.org/c3ref/set_authorizer.html)
//! and the [action code constants](https://sqlite.org/c3ref/c_alter_table.html).
//!
//! The authorizer callback receives an [`AuthorizerContext`]. It is an enum
//! with one variant per SQLite action code, and every variant carries the
//! arguments for that action under descriptive field names, so there is no
//! need to consult a table of what each positional argument means.
//!
//! Two fields recur across variants. `database` is the name of the database
//! (`"main"`, `"temp"`, or an `ATTACH` alias) an object lives in, when SQLite
//! reports it. `accessor` is the name of the inner-most trigger or view
//! responsible for the access, or `None` when the access is directly from
//! top-level SQL. A string argument is `None` when SQLite passes `NULL` or a
//! value that is not valid UTF-8.

#[cfg(not(all(target_family = "wasm", target_os = "unknown")))]
extern crate libsqlite3_sys as ffi;

#[cfg(all(target_family = "wasm", target_os = "unknown"))]
use sqlite_wasm_rs as ffi;

use super::SqliteConnection;

/// Authorizing a `CREATE INDEX` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct CreateIndex<'a> {
    /// Name of the index being created.
    pub index: Option<&'a str>,
    /// Name of the table the index is created on.
    pub table: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `CREATE TABLE` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct CreateTable<'a> {
    /// Name of the table being created.
    pub table: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `CREATE TEMP INDEX` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct CreateTempIndex<'a> {
    /// Name of the index being created.
    pub index: Option<&'a str>,
    /// Name of the table the index is created on.
    pub table: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `CREATE TEMP TABLE` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct CreateTempTable<'a> {
    /// Name of the table being created.
    pub table: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `CREATE TEMP TRIGGER` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct CreateTempTrigger<'a> {
    /// Name of the trigger being created.
    pub trigger: Option<&'a str>,
    /// Name of the table the trigger is attached to.
    pub table: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `CREATE TEMP VIEW` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct CreateTempView<'a> {
    /// Name of the view being created.
    pub view: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `CREATE TRIGGER` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct CreateTrigger<'a> {
    /// Name of the trigger being created.
    pub trigger: Option<&'a str>,
    /// Name of the table the trigger is attached to.
    pub table: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `CREATE VIEW` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct CreateView<'a> {
    /// Name of the view being created.
    pub view: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `DELETE` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct Delete<'a> {
    /// Name of the table rows are deleted from.
    pub table: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `DROP INDEX` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct DropIndex<'a> {
    /// Name of the index being dropped.
    pub index: Option<&'a str>,
    /// Name of the table the index belongs to.
    pub table: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `DROP TABLE` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct DropTable<'a> {
    /// Name of the table being dropped.
    pub table: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `DROP TEMP INDEX` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct DropTempIndex<'a> {
    /// Name of the index being dropped.
    pub index: Option<&'a str>,
    /// Name of the table the index belongs to.
    pub table: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `DROP TEMP TABLE` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct DropTempTable<'a> {
    /// Name of the table being dropped.
    pub table: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `DROP TEMP TRIGGER` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct DropTempTrigger<'a> {
    /// Name of the trigger being dropped.
    pub trigger: Option<&'a str>,
    /// Name of the table the trigger is attached to.
    pub table: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `DROP TEMP VIEW` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct DropTempView<'a> {
    /// Name of the view being dropped.
    pub view: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `DROP TRIGGER` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct DropTrigger<'a> {
    /// Name of the trigger being dropped.
    pub trigger: Option<&'a str>,
    /// Name of the table the trigger is attached to.
    pub table: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `DROP VIEW` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct DropView<'a> {
    /// Name of the view being dropped.
    pub view: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing an `INSERT` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct Insert<'a> {
    /// Name of the table rows are inserted into.
    pub table: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `PRAGMA` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct Pragma<'a> {
    /// Name of the pragma.
    pub name: Option<&'a str>,
    /// Argument to the pragma, or `None` when it is queried without one.
    pub argument: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a column read.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct Read<'a> {
    /// Name of the table being read.
    pub table: Option<&'a str>,
    /// Name of the column being read.
    pub column: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `SELECT` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct Select<'a> {
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a transaction control operation (`BEGIN`, `COMMIT`, `ROLLBACK`).
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct Transaction<'a> {
    /// The operation, for example `"BEGIN"`, `"COMMIT"`, or `"ROLLBACK"`.
    pub operation: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing an `UPDATE` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct Update<'a> {
    /// Name of the table being updated.
    pub table: Option<&'a str>,
    /// Name of the column being updated.
    pub column: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing an `ATTACH DATABASE` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct Attach<'a> {
    /// Filename of the database being attached.
    pub filename: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `DETACH DATABASE` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct Detach<'a> {
    /// Name of the database being detached.
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing an `ALTER TABLE` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct AlterTable<'a> {
    /// Database the table lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Name of the table being altered.
    pub table: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `REINDEX` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct Reindex<'a> {
    /// Name of the index being rebuilt.
    pub index: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing an `ANALYZE` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct Analyze<'a> {
    /// Name of the table being analyzed.
    pub table: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `CREATE VIRTUAL TABLE` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct CreateVTable<'a> {
    /// Name of the virtual table being created.
    pub table: Option<&'a str>,
    /// Name of the module implementing the virtual table.
    pub module: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `DROP VIRTUAL TABLE` statement.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct DropVTable<'a> {
    /// Name of the virtual table being dropped.
    pub table: Option<&'a str>,
    /// Name of the module implementing the virtual table.
    pub module: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a SQL function call.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct Function<'a> {
    /// Name of the function being called.
    pub function: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a `SAVEPOINT` operation.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct Savepoint<'a> {
    /// The operation, for example `"BEGIN"`, `"RELEASE"`, or `"ROLLBACK"`.
    pub operation: Option<&'a str>,
    /// Name of the savepoint.
    pub name: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Authorizing a recursive `SELECT`.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct Recursive<'a> {
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// An action code SQLite reported that this version of diesel does not model.
///
/// The raw arguments are exposed unchanged for forward compatibility.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub struct Unknown<'a> {
    /// The raw SQLite action code.
    pub code: i32,
    /// The third argument to the authorizer callback, if any.
    pub arg1: Option<&'a str>,
    /// The fourth argument to the authorizer callback, if any.
    pub arg2: Option<&'a str>,
    /// Database the object lives in (`"main"`, `"temp"`, or an `ATTACH` alias).
    pub database: Option<&'a str>,
    /// Inner-most trigger or view responsible for the access, if any.
    pub accessor: Option<&'a str>,
}

/// Context information passed to the authorizer callback.
///
/// One variant per SQLite action code. Each variant carries the arguments for
/// that action under descriptive field names, so there is no need to consult a
/// table of what each positional argument means. The callback is invoked
/// during SQL statement compilation (not during execution).
///
/// Added in SQLite 3.0.0 (June 2004).
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub enum AuthorizerContext<'a> {
    /// `CREATE INDEX`
    CreateIndex(CreateIndex<'a>),
    /// `CREATE TABLE`
    CreateTable(CreateTable<'a>),
    /// `CREATE TEMP INDEX`
    CreateTempIndex(CreateTempIndex<'a>),
    /// `CREATE TEMP TABLE`
    CreateTempTable(CreateTempTable<'a>),
    /// `CREATE TEMP TRIGGER`
    CreateTempTrigger(CreateTempTrigger<'a>),
    /// `CREATE TEMP VIEW`
    CreateTempView(CreateTempView<'a>),
    /// `CREATE TRIGGER`
    CreateTrigger(CreateTrigger<'a>),
    /// `CREATE VIEW`
    CreateView(CreateView<'a>),
    /// `DELETE`
    Delete(Delete<'a>),
    /// `DROP INDEX`
    DropIndex(DropIndex<'a>),
    /// `DROP TABLE`
    DropTable(DropTable<'a>),
    /// `DROP TEMP INDEX`
    DropTempIndex(DropTempIndex<'a>),
    /// `DROP TEMP TABLE`
    DropTempTable(DropTempTable<'a>),
    /// `DROP TEMP TRIGGER`
    DropTempTrigger(DropTempTrigger<'a>),
    /// `DROP TEMP VIEW`
    DropTempView(DropTempView<'a>),
    /// `DROP TRIGGER`
    DropTrigger(DropTrigger<'a>),
    /// `DROP VIEW`
    DropView(DropView<'a>),
    /// `INSERT`
    Insert(Insert<'a>),
    /// `PRAGMA`
    Pragma(Pragma<'a>),
    /// Reading a column value.
    Read(Read<'a>),
    /// `SELECT`
    Select(Select<'a>),
    /// Transaction control (`BEGIN`, `COMMIT`, `ROLLBACK`).
    Transaction(Transaction<'a>),
    /// `UPDATE`
    Update(Update<'a>),
    /// `ATTACH DATABASE`
    Attach(Attach<'a>),
    /// `DETACH DATABASE`
    Detach(Detach<'a>),
    /// `ALTER TABLE`
    AlterTable(AlterTable<'a>),
    /// `REINDEX`
    Reindex(Reindex<'a>),
    /// `ANALYZE`
    Analyze(Analyze<'a>),
    /// `CREATE VIRTUAL TABLE`
    CreateVTable(CreateVTable<'a>),
    /// `DROP VIRTUAL TABLE`
    DropVTable(DropVTable<'a>),
    /// A SQL function call.
    Function(Function<'a>),
    /// `SAVEPOINT`
    Savepoint(Savepoint<'a>),
    /// A recursive `SELECT`.
    Recursive(Recursive<'a>),
    /// An action code this version of diesel does not model.
    Unknown(Unknown<'a>),
}

impl<'a> AuthorizerContext<'a> {
    /// Returns `true` if this action modifies the database schema.
    ///
    /// Schema-modifying actions include creating, dropping, or altering
    /// tables, indexes, triggers, views, and virtual tables, writing to the
    /// schema table or `sqlite_dbpage`, and assigning the `writable_schema` or
    /// `schema_version` pragma. Writes to virtual-table shadow tables are not
    /// recognised, so use [`set_defensive`](SqliteConnection::set_defensive)
    /// to stop ordinary SQL from corrupting the schema.
    ///
    /// # Example
    ///
    /// ```rust
    /// # use diesel::prelude::*;
    /// use diesel::sqlite::{SqliteConnection, AuthorizerContext, AuthorizerDecision};
    ///
    /// # let conn = &mut SqliteConnection::establish(":memory:").unwrap();
    /// conn.on_authorize(|ctx| {
    ///     if ctx.is_schema_modifying() {
    ///         AuthorizerDecision::Deny
    ///     } else {
    ///         AuthorizerDecision::Allow
    ///     }
    /// });
    /// ```
    pub fn is_schema_modifying(&self) -> bool {
        matches!(
            self,
            Self::CreateIndex(_)
                | Self::CreateTable(_)
                | Self::CreateTempIndex(_)
                | Self::CreateTempTable(_)
                | Self::CreateTempTrigger(_)
                | Self::CreateTempView(_)
                | Self::CreateTrigger(_)
                | Self::CreateView(_)
                | Self::CreateVTable(_)
                | Self::DropIndex(_)
                | Self::DropTable(_)
                | Self::DropTempIndex(_)
                | Self::DropTempTable(_)
                | Self::DropTempTrigger(_)
                | Self::DropTempView(_)
                | Self::DropTrigger(_)
                | Self::DropView(_)
                | Self::DropVTable(_)
                | Self::AlterTable(_)
        ) || self.writes_schema_storage()
    }

    /// Returns `true` for a write to the schema table or `sqlite_dbpage`, or an assignment of `writable_schema` or `schema_version`.
    fn writes_schema_storage(&self) -> bool {
        const SCHEMA_TABLES: [&str; 5] = [
            "sqlite_schema",
            "sqlite_master",
            "sqlite_temp_schema",
            "sqlite_temp_master",
            "sqlite_dbpage",
        ];
        match self {
            Self::Insert(Insert { table, .. })
            | Self::Delete(Delete { table, .. })
            | Self::Update(Update { table, .. }) => table.is_some_and(|table| {
                SCHEMA_TABLES
                    .iter()
                    .any(|schema_table| table.eq_ignore_ascii_case(schema_table))
            }),
            Self::Pragma(Pragma {
                name: Some(name),
                argument: Some(_),
                ..
            }) => {
                name.eq_ignore_ascii_case("writable_schema")
                    || name.eq_ignore_ascii_case("schema_version")
            }
            _ => false,
        }
    }

    /// Builds the context from the raw authorizer callback arguments.
    ///
    /// `database` is the 5th callback argument (the database name) and
    /// `accessor` is the 6th (the trigger or view responsible). The `arg1` and
    /// `arg2` values are the 3rd and 4th arguments, whose meaning depends on
    /// the action code per the SQLite documentation.
    pub(crate) fn from_ffi(
        code: i32,
        arg1: Option<&'a str>,
        arg2: Option<&'a str>,
        database: Option<&'a str>,
        accessor: Option<&'a str>,
    ) -> Self {
        match code {
            ffi::SQLITE_CREATE_INDEX => Self::CreateIndex(CreateIndex {
                index: arg1,
                table: arg2,
                database,
                accessor,
            }),
            ffi::SQLITE_CREATE_TABLE => Self::CreateTable(CreateTable {
                table: arg1,
                database,
                accessor,
            }),
            ffi::SQLITE_CREATE_TEMP_INDEX => Self::CreateTempIndex(CreateTempIndex {
                index: arg1,
                table: arg2,
                database,
                accessor,
            }),
            ffi::SQLITE_CREATE_TEMP_TABLE => Self::CreateTempTable(CreateTempTable {
                table: arg1,
                database,
                accessor,
            }),
            ffi::SQLITE_CREATE_TEMP_TRIGGER => Self::CreateTempTrigger(CreateTempTrigger {
                trigger: arg1,
                table: arg2,
                database,
                accessor,
            }),
            ffi::SQLITE_CREATE_TEMP_VIEW => Self::CreateTempView(CreateTempView {
                view: arg1,
                database,
                accessor,
            }),
            ffi::SQLITE_CREATE_TRIGGER => Self::CreateTrigger(CreateTrigger {
                trigger: arg1,
                table: arg2,
                database,
                accessor,
            }),
            ffi::SQLITE_CREATE_VIEW => Self::CreateView(CreateView {
                view: arg1,
                database,
                accessor,
            }),
            ffi::SQLITE_DELETE => Self::Delete(Delete {
                table: arg1,
                database,
                accessor,
            }),
            ffi::SQLITE_DROP_INDEX => Self::DropIndex(DropIndex {
                index: arg1,
                table: arg2,
                database,
                accessor,
            }),
            ffi::SQLITE_DROP_TABLE => Self::DropTable(DropTable {
                table: arg1,
                database,
                accessor,
            }),
            ffi::SQLITE_DROP_TEMP_INDEX => Self::DropTempIndex(DropTempIndex {
                index: arg1,
                table: arg2,
                database,
                accessor,
            }),
            ffi::SQLITE_DROP_TEMP_TABLE => Self::DropTempTable(DropTempTable {
                table: arg1,
                database,
                accessor,
            }),
            ffi::SQLITE_DROP_TEMP_TRIGGER => Self::DropTempTrigger(DropTempTrigger {
                trigger: arg1,
                table: arg2,
                database,
                accessor,
            }),
            ffi::SQLITE_DROP_TEMP_VIEW => Self::DropTempView(DropTempView {
                view: arg1,
                database,
                accessor,
            }),
            ffi::SQLITE_DROP_TRIGGER => Self::DropTrigger(DropTrigger {
                trigger: arg1,
                table: arg2,
                database,
                accessor,
            }),
            ffi::SQLITE_DROP_VIEW => Self::DropView(DropView {
                view: arg1,
                database,
                accessor,
            }),
            ffi::SQLITE_INSERT => Self::Insert(Insert {
                table: arg1,
                database,
                accessor,
            }),
            ffi::SQLITE_PRAGMA => Self::Pragma(Pragma {
                name: arg1,
                argument: arg2,
                database,
                accessor,
            }),
            ffi::SQLITE_READ => Self::Read(Read {
                table: arg1,
                column: arg2,
                database,
                accessor,
            }),
            ffi::SQLITE_SELECT => Self::Select(Select { accessor }),
            ffi::SQLITE_TRANSACTION => Self::Transaction(Transaction {
                operation: arg1,
                accessor,
            }),
            ffi::SQLITE_UPDATE => Self::Update(Update {
                table: arg1,
                column: arg2,
                database,
                accessor,
            }),
            ffi::SQLITE_ATTACH => Self::Attach(Attach {
                filename: arg1,
                accessor,
            }),
            ffi::SQLITE_DETACH => Self::Detach(Detach {
                database: arg1,
                accessor,
            }),
            ffi::SQLITE_ALTER_TABLE => Self::AlterTable(AlterTable {
                database: arg1,
                table: arg2,
                accessor,
            }),
            ffi::SQLITE_REINDEX => Self::Reindex(Reindex {
                index: arg1,
                database,
                accessor,
            }),
            ffi::SQLITE_ANALYZE => Self::Analyze(Analyze {
                table: arg1,
                database,
                accessor,
            }),
            ffi::SQLITE_CREATE_VTABLE => Self::CreateVTable(CreateVTable {
                table: arg1,
                module: arg2,
                database,
                accessor,
            }),
            ffi::SQLITE_DROP_VTABLE => Self::DropVTable(DropVTable {
                table: arg1,
                module: arg2,
                database,
                accessor,
            }),
            ffi::SQLITE_FUNCTION => Self::Function(Function {
                function: arg2,
                accessor,
            }),
            ffi::SQLITE_SAVEPOINT => Self::Savepoint(Savepoint {
                operation: arg1,
                name: arg2,
                accessor,
            }),
            ffi::SQLITE_RECURSIVE => Self::Recursive(Recursive { accessor }),
            other => Self::Unknown(Unknown {
                code: other,
                arg1,
                arg2,
                database,
                accessor,
            }),
        }
    }
}

/// Authorizer callback decision.
///
/// Returned by the authorizer callback to indicate whether to allow,
/// ignore, or deny the requested operation.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum AuthorizerDecision {
    /// Allow the operation to proceed (`SQLITE_OK`).
    Allow,
    /// Ignore the operation (`SQLITE_IGNORE`).
    ///
    /// For `Read` actions, returns `NULL` instead of the column value.
    /// For other actions, treats the operation as a no-op.
    Ignore,
    /// Deny the operation (`SQLITE_DENY`).
    ///
    /// Causes the entire SQL statement to fail with an authorization error.
    Deny,
}

impl AuthorizerDecision {
    /// Converts the decision to the FFI return code.
    pub(crate) fn to_ffi(self) -> i32 {
        match self {
            Self::Allow => ffi::SQLITE_OK,
            Self::Ignore => ffi::SQLITE_IGNORE,
            Self::Deny => ffi::SQLITE_DENY,
        }
    }
}

impl SqliteConnection {
    /// Registers an authorizer callback for SQL compilation access control.
    /// Added in SQLite 3.0.0 (June 2004).
    ///
    /// The callback is invoked during `sqlite3_prepare()` (statement
    /// compilation) to control access to database objects. It receives
    /// an [`AuthorizerContext`] describing the operation and returns an
    /// [`AuthorizerDecision`].
    ///
    /// The authorizer is consulted only at statement preparation, so treat it
    /// as defense-in-depth rather than a complete sandbox. SQLite re-checks
    /// already-prepared statements when an authorizer is installed. Removing the
    /// authorizer clears diesel's statement cache so statements prepared while
    /// it was active are re-prepared without it.
    ///
    /// The authorizer may be re-invoked during `sqlite3_step()` if a schema
    /// change triggers statement recompilation.
    ///
    /// The callback must not modify the database connection. It is invoked
    /// synchronously on the thread driving the connection, so it is never
    /// called concurrently.
    ///
    /// Only one authorizer can be active at a time per connection.
    /// Registering a new one replaces the previous. Panics in the callback
    /// abort the process.
    ///
    /// See: [`sqlite3_set_authorizer`](https://sqlite.org/c3ref/set_authorizer.html)
    ///
    /// # Example
    ///
    /// ```rust
    /// # use diesel::prelude::*;
    /// use diesel::sqlite::{SqliteConnection, AuthorizerContext, AuthorizerDecision};
    ///
    /// # let conn = &mut SqliteConnection::establish(":memory:").unwrap();
    /// conn.on_authorize(|ctx| match ctx {
    ///     AuthorizerContext::Delete(_) => AuthorizerDecision::Deny,
    ///     AuthorizerContext::DropTable(_) | AuthorizerContext::DropIndex(_) => {
    ///         AuthorizerDecision::Deny
    ///     }
    ///     _ => AuthorizerDecision::Allow,
    /// });
    ///
    /// // Later: remove the authorizer
    /// conn.remove_authorizer();
    /// ```
    pub fn on_authorize<F>(&mut self, hook: F)
    where
        F: FnMut(AuthorizerContext<'_>) -> AuthorizerDecision + Send + 'static,
    {
        // No cache clear is needed here. Installing a non-null authorizer makes
        // SQLite expire every prepared statement on the connection, and because
        // diesel prepares with `sqlite3_prepare_v3` those statements are
        // transparently re-prepared under the new authorizer on their next step.
        self.raw_connection.set_authorizer(hook);
        // The public documentation doesn't explicitly state what happens with existing
        // prepared statements, so rather be safe and nuke them. We don't
        // expect that people change the authorizer all the time, so this should be fine
        self.statement_cache.clear();
    }

    /// Removes the authorizer callback.
    ///
    /// See [`on_authorize`](Self::on_authorize) for usage example.
    pub fn remove_authorizer(&mut self) {
        self.raw_connection.remove_authorizer();
        // Removing an authorizer does not expire prepared statements: SQLite
        // expires them only when a non-null authorizer is installed. A statement
        // prepared while the authorizer was active can have its decisions
        // compiled in (an `Ignore` on a column read, for example, bakes a `NULL`
        // into the statement), and nothing invalidates that cached statement on
        // removal, so it keeps returning the old result. Clear the cache to force
        // the next query to re-prepare without the authorizer.
        self.statement_cache.clear();
    }
}

// miri doesn't support callbacks yet
#[cfg(all(test, not(miri)))]
mod tests {
    use super::*;
    use crate::connection::Connection;
    use crate::query_dsl::RunQueryDsl;
    use std::sync::Arc;
    use std::sync::atomic::{AtomicU32, Ordering};

    fn connection() -> SqliteConnection {
        SqliteConnection::establish(":memory:").unwrap()
    }

    #[diesel_test_helper::test]
    fn on_authorize_deny_rejects_statement() {
        let conn = &mut connection();
        crate::sql_query("CREATE TABLE auth_basic (id INTEGER PRIMARY KEY)")
            .execute(conn)
            .unwrap();

        let calls = Arc::new(AtomicU32::new(0));
        let calls2 = calls.clone();

        conn.on_authorize(move |_ctx| {
            calls2.fetch_add(1, Ordering::Relaxed);
            AuthorizerDecision::Deny
        });

        // The authorizer is consulted while the statement is prepared, denies
        // it, and the statement is rejected.
        let denied = crate::sql_query("SELECT id FROM auth_basic").execute(conn);
        assert!(denied.is_err(), "a denied statement should fail to prepare");
        assert!(
            calls.load(Ordering::Relaxed) > 0,
            "the authorizer callback should have been invoked"
        );

        // Removing the authorizer restores access.
        conn.remove_authorizer();
        crate::sql_query("SELECT id FROM auth_basic")
            .execute(conn)
            .unwrap();
    }

    #[diesel_test_helper::test]
    fn remove_authorizer_re_prepares_cached_statements() {
        use crate::prelude::*;
        use crate::sqlite::AuthorizerContext;

        crate::table! {
            auth_ignore_items (id) {
                id -> Integer,
            }
        }

        let conn = &mut connection();
        crate::sql_query("CREATE TABLE auth_ignore_items (id INTEGER PRIMARY KEY)")
            .execute(conn)
            .unwrap();
        crate::sql_query("INSERT INTO auth_ignore_items (id) VALUES (42)")
            .execute(conn)
            .unwrap();

        // An authorizer that ignores column reads. SQLite bakes a NULL
        // substitution for the column into the prepared (and cached) statement.
        // A typed query is used because raw `sql_query` is never cached.
        conn.on_authorize(|ctx| match ctx {
            AuthorizerContext::Read(_) => AuthorizerDecision::Ignore,
            _ => AuthorizerDecision::Allow,
        });
        let ignored = auth_ignore_items::table
            .select(auth_ignore_items::id.nullable())
            .load::<Option<i32>>(conn)
            .unwrap();
        assert_eq!(
            ignored,
            vec![None],
            "Ignore substitutes NULL for the column"
        );

        // SQLite does not expire prepared statements when an authorizer is
        // removed, so `remove_authorizer` clears diesel's statement cache to
        // force the cached statement (with its baked-in NULL) to be re-prepared.
        conn.remove_authorizer();
        let restored = auth_ignore_items::table
            .select(auth_ignore_items::id.nullable())
            .load::<Option<i32>>(conn)
            .unwrap();
        assert_eq!(
            restored,
            vec![Some(42)],
            "after removing the authorizer the real value is returned"
        );
    }

    #[diesel_test_helper::test]
    fn on_authorize_re_prepares_cached_statements() {
        use crate::prelude::*;
        use crate::sqlite::AuthorizerContext;

        crate::table! {
            auth_replace_items (id) {
                id -> Integer,
            }
        }

        let conn = &mut connection();
        crate::sql_query("CREATE TABLE auth_replace_items (id INTEGER PRIMARY KEY)")
            .execute(conn)
            .unwrap();
        crate::sql_query("INSERT INTO auth_replace_items (id) VALUES (42)")
            .execute(conn)
            .unwrap();

        // A first authorizer that allows everything. The typed query is
        // prepared and cached while it is active, returning the real value.
        conn.on_authorize(|_ctx| AuthorizerDecision::Allow);
        let allowed = auth_replace_items::table
            .select(auth_replace_items::id.nullable())
            .load::<Option<i32>>(conn)
            .unwrap();
        assert_eq!(
            allowed,
            vec![Some(42)],
            "the allow-all authorizer returns the real value"
        );

        // Installing the replacement authorizer expires the cached statement
        // (SQLite expires all prepared statements when a non-null authorizer is
        // set), so `sqlite3_prepare_v3` re-prepares it under the new authorizer
        // and it now yields NULL. This documents that no diesel-side cache clear
        // is required on the install path.
        conn.on_authorize(|ctx| match ctx {
            AuthorizerContext::Read(_) => AuthorizerDecision::Ignore,
            _ => AuthorizerDecision::Allow,
        });
        let ignored = auth_replace_items::table
            .select(auth_replace_items::id.nullable())
            .load::<Option<i32>>(conn)
            .unwrap();
        assert_eq!(
            ignored,
            vec![None],
            "after replacing the authorizer the new decision takes effect"
        );
    }

    #[diesel_test_helper::test]
    #[expect(
        unsafe_code,
        reason = "a non-UTF-8 identifier cannot be written through `&str` SQL"
    )]
    fn non_utf8_names_are_denied_before_the_callback() {
        use std::sync::Mutex;

        let conn = &mut connection();
        let sql = c"CREATE VIEW \"helper\xff\" AS SELECT abs(-1) AS id; CREATE VIEW items AS SELECT id FROM \"helper\xff\";";
        // SAFETY: the connection is live, and `sql` is a NUL-terminated string borrowed for the call.
        let rc = unsafe {
            conn.with_raw_connection(|raw| {
                ffi::sqlite3_exec(
                    raw,
                    sql.as_ptr(),
                    None,
                    core::ptr::null_mut(),
                    core::ptr::null_mut(),
                )
            })
        };
        assert_eq!(rc, ffi::SQLITE_OK);

        let abs_accessors = Arc::new(Mutex::new(Vec::new()));
        let abs_accessors2 = abs_accessors.clone();
        conn.on_authorize(move |ctx| {
            if let AuthorizerContext::Function(function) = ctx
                && function.function == Some("abs")
            {
                abs_accessors2
                    .lock()
                    .unwrap()
                    .push(function.accessor.map(str::to_owned));
            }
            AuthorizerDecision::Allow
        });

        let result = crate::sql_query("SELECT id FROM items").execute(conn);
        assert!(result.is_err());
        assert!(abs_accessors.lock().unwrap().iter().all(Option::is_some));
    }

    #[diesel_test_helper::test]
    fn schema_modifying_policy_blocks_writable_schema_edits() {
        use crate::connection::SimpleConnection;
        use crate::dsl::sql;
        use crate::sql_types::BigInt;

        let conn = &mut connection();
        conn.batch_execute(
            "CREATE TABLE accounts (id INTEGER PRIMARY KEY, balance INTEGER NOT NULL CHECK (balance >= 0));
             CREATE TRIGGER audit AFTER UPDATE ON accounts BEGIN SELECT 1; END;",
        )
        .unwrap();
        conn.on_authorize(|ctx| {
            if ctx.is_schema_modifying() {
                AuthorizerDecision::Deny
            } else {
                AuthorizerDecision::Allow
            }
        });

        let _ = conn.batch_execute(
            "PRAGMA writable_schema = ON;
             DELETE FROM sqlite_schema WHERE name = 'audit';
             PRAGMA writable_schema = RESET;",
        );
        assert!(conn.batch_execute("PRAGMA writable_schema").is_ok());
        assert!(conn.batch_execute("PRAGMA schema_version").is_ok());

        conn.remove_authorizer();
        let triggers: i64 =
            sql::<BigInt>("SELECT count(*) FROM sqlite_schema WHERE name = 'audit'")
                .get_result(conn)
                .unwrap();
        assert_eq!(triggers, 1);
    }
}