Security + multi-tenancy #816

The power of Mosaic is the embrace of SQL as the core language, allowing it to issue arbitrary SQL commands to build tables, and through DuckDB, interact with other databases, files, and apis. If I'm running DuckDB on the server, what is the path for client authorization? I know that the requests themselves can authenticate the user, but how can I make sure that the sql queries themselves aren't accessing data that they shouldn't be? DuckDB doesn't have user permissions, so I can't lean on it.

I'm thinking that the most viable option is to use DuckDB json_serialize_sql, and recurse through it to make sure that only an allowlist of schemas/tables/commands are included, and reject anything that doesn't match. Setting preagg.schema in mosaic to something like the tenant_id, I could match the user from the request to the duckdb schema, preventing any cross-tenant arbitrary queries.

Does that sound like a viable solution? Are there considerations aside from just SQL that I'm missing?