Enhance the documentation on sqlite3_set_authorizer() to make it clear

that the authorizer callback is not invoked for elements of an expression
in a generated column.
[bugs:/info/2026-06-26T12:42:48Z|Bugs 2026-06-26T12:42:48Z].

FossilOrigin-Name: 45213c1c398cad9d05eda5420ae7379e84fa37d30793f8b4d28c358b88d62931

manifest

@@ -1,5 +1,5 @@
-C Fix\sboth\sa\sbuffer\soverread\sand\soverwrite\sin\sthe\ssessions\srebase\smodule.\sBug\s[bugs:/info/2026-06-26T12:16:48Z\s|\s2026-06-26T12:16:48Z].
-D 2026-06-26T15:04:47.895
+C Enhance\sthe\sdocumentation\son\ssqlite3_set_authorizer()\sto\smake\sit\sclear\nthat\sthe\sauthorizer\scallback\sis\snot\sinvoked\sfor\selements\sof\san\sexpression\nin\sa\sgenerated\scolumn.\n[bugs:/info/2026-06-26T12:42:48Z|Bugs\s2026-06-26T12:42:48Z].
+D 2026-06-26T15:27:30.376
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -740,7 +740,7 @@ F src/resolve.c d0724113da9f5c0430d2052808ce59519f51ae7c4fbb1f5ef21fe3a832956086
 F src/rowset.c 8432130e6c344b3401a8874c3cb49fefe6873fec593294de077afea2dce5ec97
 F src/select.c 80ea6935f8470b97d1212bc1b759b7fadb28351797877f493d0cf598be1fef5e
 F src/shell.c.in a4e83895cfa336065ad7f7a7dea8fc2a19d050f7ce7466621c67208acaac9e44
-F src/sqlite.h.in 57e0bf0e047dca1d2257dc96e597eebac6d54cd11e9f4ef67d4490341596bc62
+F src/sqlite.h.in d9ec41feb4cd804e68b174328b43beb3f1f71bba13e1c7a439efb826d301cccc
 F src/sqlite3.rc 015537e6ac1eec6c7050e17b616c2ffe6f70fca241835a84a4f0d5937383c479
 F src/sqlite3ext.h 0efd4723bad9124ea1f581d9f1ea0254ac1c6f3e5fb29e4f3dcf36c72485a456
 F src/sqliteInt.h 92563b8edc673513b82d87bf6a8d7aeb554b2c7b7d5e30992fbca04010db79ac
@@ -2209,8 +2209,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P c8f143bd618fe59c18eb92c8f5ae1b153f03cf05e1c457910f6a46599f719809
-R cdfad5e0db9e357d79f6aed03a7c7fdf
-U dan
-Z 312a7c42ad5d2e6cbcc603ddf5b5f8b1
+P cc36f1741308ea354d540d27c89b92d69a0481885ca3463bdaf0b9ab27464d78
+R 36257a1bc1b62387f6a53b622e10579c
+U drh
+Z d7d6d3fdcc16c76593fd1df10070f90e
 # Remove this line to create a well-formed Fossil manifest.

manifest.uuid

@@ -1 +1 @@
-cc36f1741308ea354d540d27c89b92d69a0481885ca3463bdaf0b9ab27464d78
+45213c1c398cad9d05eda5420ae7379e84fa37d30793f8b4d28c358b88d62931

src/sqlite.h.in

@@ -3456,21 +3456,33 @@ void sqlite3_randomness(int N, void *P);
 ** previous call.)^  ^Disable the authorizer by installing a NULL callback.
 ** The authorizer is disabled by default.
 **
-** The authorizer callback must not do anything that will modify
+** <h3>Limitations And Caveats</h3><ul>
+**
+** <li>The authorizer callback must not do anything that will modify
 ** the database connection that invoked the authorizer callback.
 ** Note that [sqlite3_prepare_v2()] and [sqlite3_step()] both modify their
 ** database connections for the meaning of "modify" in this paragraph.
 **
-** ^When [sqlite3_prepare_v2()] is used to prepare a statement, the
+** <li>^When [sqlite3_prepare_v2()] is used to prepare a statement, the
 ** statement might be re-prepared during [sqlite3_step()] due to a
 ** schema change.  Hence, the application should ensure that the
 ** correct authorizer callback remains in place during the [sqlite3_step()].
 **
-** ^Note that the authorizer callback is invoked only during
+** <li>^The authorizer callback is invoked only during
 ** [sqlite3_prepare()] or its variants.  Authorization is not
 ** performed during statement evaluation in [sqlite3_step()], unless
 ** as stated in the previous paragraph, sqlite3_step() invokes
 ** sqlite3_prepare_v2() to reprepare a statement after a schema change.
+**
+** <li>Authorizer callbacks for the expressions of a
+** [generated column] are invoked when the schema is parsed (and specifically
+** when the [CREATE TABLE] statement that contains the generated column is
+** parsed) not when the generated column is used in a DML statement.
+** This is deliberate, as one of the purposes of generated columns 
+** is to give schema designers the ability to provide gated access
+** to privileged columns and/or functions.
+**
+** </ul> 
 */
 int sqlite3_set_authorizer(
   sqlite3*,