sqlrefusal

package

v0.8.1 Latest Latest Go to latest Published: Oct 20, 2026 License: Apache-2.0 Imports: 1 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/DavidGodefroid/locksql

Links

Open Source Insights

Documentation ¶

Overview ¶

Package sqlrefusal holds locksql's refusal codes, registered with lockkit's refusal package, and re-exports that package so call sites import one name. Every refusal carries a stable code an agent can act on, the place of the statement it points at when one is known, and a rewrite hint.

A refusal never carries more than the agent could already see: the reason and the hint are written by locksql (never the database's text), and the token of a span is a word or a punctuation sign of the agent's own statement, never a literal.

Constants ¶

View Source

const (
	RetryRewrite = refusal.RetryRewrite
	RetryAskUser = refusal.RetryAskUser
	RetryStop    = refusal.RetryStop
	MaxToken     = refusal.MaxToken
)

Variables ¶

View Source

var (
	New   = refusal.New
	Newf  = refusal.Newf
	From  = refusal.From
	Codes = refusal.Codes
)

Functions ¶

This section is empty.

Types ¶

type Code ¶

type Code = refusal.Code

The types and functions of lockkit's refusal package.

const (
	// Parsing and statement shape.
	UnsupportedSyntax Code = "E_UNSUPPORTED_SYNTAX"
	MultiStatement    Code = "E_MULTI_STATEMENT"
	ForbiddenToken    Code = "E_FORBIDDEN_TOKEN"
	StatementKind     Code = "E_STATEMENT_KIND"
	InvalidSQL        Code = "E_INVALID_SQL"
	UnknownName       Code = "E_UNKNOWN_NAME"
	TooComplex        Code = "E_TOO_COMPLEX"
	Size              Code = "E_SIZE"
	// Constructs refused at every tier.
	Forbidden    Code = "E_FORBIDDEN"
	Function     Code = "E_FUNCTION"
	SystemObject Code = "E_SYSTEM_OBJECT"
	// Limits and policy.
	NoLimit           Code = "E_NO_LIMIT"
	LimitTooHigh      Code = "E_LIMIT_TOO_HIGH"
	Tier              Code = "E_TIER"
	DatabaseNotServed Code = "E_DATABASE_NOT_SERVED"
	UnmaskOff         Code = "E_UNMASK_OFF"
	Cost              Code = "E_COST"
	// KAnon is no longer emitted (v0.5.2): a k-anonymity count under k
	// is a warning on the approval screen. The code stays known so that
	// past audit records keep it, and is never reused.
	//
	// Deprecated: no refusal carries it.
	KAnon            Code = "E_K_ANON"
	Engine           Code = "E_ENGINE"
	Placeholder      Code = "E_PLACEHOLDER"
	MaskedFilter     Code = "E_MASKED_FILTER"
	MaskedExpression Code = "E_MASKED_EXPRESSION"
	MaskedOrder      Code = "E_MASKED_ORDER"
	MaskedSetOp      Code = "E_MASKED_SET_OP"
	MaskUncertain    Code = "E_MASK_UNCERTAIN"
	MaskedWrite      Code = "E_MASKED_WRITE"
	// Policy is the fail-closed code of a refusal no check named: it
	// should never be seen, and is a bug to report. lockkit defines it.
	Policy Code = refusal.Policy
)