guard

type Decision struct {
	Verdict Verdict
	// Reason explains the verdict; the status bar and dialog show it.
	Reason string
	// TypeToConfirm, when set, is the phrase the user must type out before
	// the statement runs. Reserved for irreversible operations, where a
	// reflexive "yes" is the failure mode being defended against.
	TypeToConfirm string
	// InjectLimit is the LIMIT to append, or zero to leave the SQL alone.
	InjectLimit int
	// Unlockable reports that the production write lock is the only thing in
	// the way, so the caller may offer the way past it.
	//
	// It is a flag rather than a sentence because guard must not name a route
	// through an interface it cannot see: the reason once read "unlock with
	// :write", which was a command no preset had. Whoever draws the dialog
	// knows what the keys are; this package does not.
	Unlockable bool
}

type Policy struct {
	// Env decides how strict the rules are.
	Env config.Env
	// AutoLimit is appended to unbounded SELECTs. Zero disables it.
	AutoLimit int
	// WritesEnabled records the session-level ":write" opt-in. It only ever
	// relaxes a Deny into a Confirm, and never for unbounded or destructive
	// statements.
	WritesEnabled bool
	// InTransaction says a transaction is open, which changes what is true
	// rather than what is permitted: the connection is held for its whole
	// life, so session state set on it does reach the next statement.
	InTransaction bool
}

type Verdict int