safety

package

v1.2.0 Latest Latest Go to latest Published: Jul 24, 2026 License: MIT Imports: 3 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/AllenMuu/mysql-cli

Links

Open Source Insights

Documentation ¶

Overview ¶

Package safety classifies SQL statements, enforces the read-only/write/ddl gate, validates identifiers, detects multi-statement input, and flags destructive operations. It is dependency-free and fully unit-testable.

Index ¶

Variables
func HasMultiStatement(sql string) bool
func IsDestructive(sql string) bool
func ValidateIdentifier(name string) error
func ValidateQualifiedTable(name string) (string, string, error)
type Category
- func Classify(sql string) Category
type CheckOptions
type Decision
- func Check(sql string, opts CheckOptions) (*Decision, error)

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	ErrReadonlyViolation      = errors.New("statement requires --write")
	ErrDDLRequiresWrite       = errors.New("ddl requires --write and --ddl")
	ErrDestructiveRequiresYes = errors.New("destructive operation requires --yes")
	ErrIdentifierInvalid      = errors.New("invalid identifier")
	ErrMultiStatement         = errors.New("multiple statements are not allowed; use the txn subcommand")
)

Sentinel errors. Each maps to a CLI exit code in the cli layer.

Functions ¶

func HasMultiStatement ¶

func HasMultiStatement(sql string) bool

HasMultiStatement reports whether sql contains more than one statement, matching the original MCP's trailing-semicolon-tolerant check.

func IsDestructive ¶

func IsDestructive(sql string) bool

IsDestructive reports whether a statement is DROP/TRUNCATE or an UPDATE/DELETE without a WHERE clause.

func ValidateIdentifier ¶

func ValidateIdentifier(name string) error

ValidateIdentifier ensures a bare identifier matches the allowlist.

func ValidateQualifiedTable ¶

func ValidateQualifiedTable(name string) (string, string, error)

ValidateQualifiedTable accepts "table" or "database.table" and returns the db (possibly empty) and table parts.

Types ¶

type Category ¶

type Category int

Category is the safety classification of a SQL statement.

const (
	CategoryUnknown Category = iota
	CategoryRead
	CategoryDML
	CategoryDDL
)

func Classify ¶

func Classify(sql string) Category

Classify categorizes a SQL statement by its leading keyword.

type CheckOptions ¶

type CheckOptions struct {
	Write bool
	DDL   bool
	Yes   bool
}

CheckOptions carries the user's explicit permission flags.

type Decision ¶

type Decision struct {
	Allowed  bool
	Category Category
}

Decision is the outcome of Check.

func Check ¶

func Check(sql string, opts CheckOptions) (*Decision, error)

Check enforces the gate: read always allowed; unknown statements need Write; DML needs Write and, if destructive, Yes; DDL needs Write+DDL and, if destructive, Yes.

Source Files ¶

View all Source files

safety.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL