feat(raster): transparent OutDb byte loading via a GDAL loader hook

rust/sedona-raster-functions/src/rs_setsrid.rs

@@ -531,10 +531,15 @@ mod tests {
             let orig_bands = original.bands();
             let mod_bands = modified.bands();
             assert_eq!(orig_bands.len(), mod_bands.len());
+            let mut orig_scratch = Vec::new();
+            let mut mod_scratch = Vec::new();
             for band_idx in 0..orig_bands.len() {
                 let orig_band = orig_bands.band(band_idx + 1).unwrap();
                 let mod_band = mod_bands.band(band_idx + 1).unwrap();
-                assert_eq!(orig_band.data(), mod_band.data());
+                assert_eq!(
+                    orig_band.contiguous_data(&mut orig_scratch).unwrap(),
+                    mod_band.contiguous_data(&mut mod_scratch).unwrap()
+                );
                 assert_eq!(
                     orig_band.metadata().data_type().unwrap(),
                     mod_band.metadata().data_type().unwrap()

rust/sedona-raster-gdal/Cargo.toml

@@ -33,6 +33,7 @@ result_large_err = "allow"
 [dependencies]
 arrow-array = { workspace = true }
 arrow-buffer = { workspace = true }
+arrow-schema = { workspace = true }
 datafusion-common = { workspace = true }
 lru = { workspace = true }
 sedona-common = { workspace = true }

rust/sedona-raster-gdal/src/gdal_common.rs

@@ -217,6 +217,16 @@ pub unsafe fn raster_ref_to_gdal_mem<R: RasterRef + ?Sized>(
     // Note: GDALAddBand always appends a new band, so the destination band index
     // is sequential (1..=band_indices.len()), even if the source band indices are
     // sparse (e.g. [1, 3]).
+    //
+    // Safety: this loop rejects non-InDb bands above, so `contiguous_data` must
+    // early-return with a zero-copy slice of the Arrow column and leave `scratch`
+    // untouched. The Arrow column outlives the returned dataset (the caller owns
+    // the StructArray driving this loop), so the raw pointer captured into the
+    // builder remains valid for the dataset's lifetime. We assert `scratch` was
+    // not written after each iteration — if a future change relaxes the OutDb
+    // rejection above, the assert fires loudly instead of silently aliasing the
+    // captured pointer into a `scratch` that the next iteration will overwrite.
+    let mut scratch: Vec<u8> = Vec::new();
     for &src_band_index in band_indices.iter() {
         let band = bands
             .band(src_band_index)
@@ -238,11 +248,24 @@ pub unsafe fn raster_ref_to_gdal_mem<R: RasterRef + ?Sized>(
         let band_metadata = band.metadata();
         let band_type = band_metadata.data_type()?;
         let gdal_type = band_data_type_to_gdal(&band_type);
-        let band_data = band.data();
+        let band_data = band
+            .contiguous_data(&mut scratch)
+            .map_err(|e| arrow_datafusion_err!(e))?;
         let data_ptr = band_data.as_ptr();
         unsafe {
             mem_ds_builder = mem_ds_builder.add_band(gdal_type, data_ptr as *mut u8);
         }
+        if !scratch.is_empty() {
+            return Err(DataFusionError::Internal(format!(
+                "raster_ref_to_gdal_mem: contiguous_data wrote {} bytes into scratch \
+                 for band {src_band_index}; this path captures the slice's pointer and \
+                 reuses scratch across iterations, so the band MUST be schema-InDb \
+                 (zero-copy from the Arrow column). Either an InDb band hit the OutDb \
+                 loader path, or a future caller relaxed the OutDb rejection above \
+                 without restructuring to per-band buffers.",
+                scratch.len()
+            )));
+        }
     }
 
     let dataset = unsafe {

rust/sedona-raster-gdal/src/gdal_dataset_provider.rs

@@ -187,7 +187,7 @@ impl GDALDatasetCache {
         })
     }
 
-    fn get_or_create_outdb_source(
+    pub(crate) fn get_or_create_outdb_source(
         &self,
         gdal: &Gdal,
         path: &str,

rust/sedona-raster-gdal/src/lib.rs

@@ -31,15 +31,14 @@ mod gdal_common;
 // Temporary until https://github.com/apache/sedona-db/issues/804 is resolved.
 #[allow(dead_code)]
 mod gdal_dataset_provider;
-
-mod utils;
-
-#[cfg(test)]
+mod outdb_loader;
 mod source_uri;
+mod utils;
 
 // Re-export main dataset conversion functions
 pub use gdal_common::{
     band_data_type_to_gdal, bytes_to_f64, gdal_to_band_data_type, gdal_type_byte_size,
     nodata_bytes_to_f64, nodata_f64_to_bytes,
 };
+pub use outdb_loader::register_outdb_loader;
 pub use utils::{append_as_indb_raster, dataset_to_indb_raster};