Documentation
¶
Overview ¶
Package gormguard integrates sqlguard with GORM.
Analysis is driven by the single shared sqlguard core (middleware.Guard), so redaction-by-default, stable fingerprints, the pluggable real-grammar parser, slow-query timing and N+1 detection behave identically to the database/sql driver wrapper and to pgxguard. There is no parallel option surface — configure with the standard middleware options:
gormDB, _ := gorm.Open(postgres.Open(dsn), &gorm.Config{})
gormguard.Register(gormDB,
middleware.WithSlowQueryThreshold(500*time.Millisecond),
middleware.WithN1Detection(10, time.Second),
)
GORM only exposes the final built SQL in its after-callback (it has not been generated when the before-callback fires), so this plugin uses the explicit Check+CheckLatency pair rather than middleware.Guard.Observe. Behaviour matches Observe semantically: static rules run on every call, latency is reported only on success.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Plugin ¶
type Plugin struct {
// contains filtered or unexported fields
}
Plugin implements gorm.Plugin and drives every traced statement through the shared sqlguard analysis core.
func New ¶
func New(opts ...middleware.Option) *Plugin
New creates a new sqlguard GORM plugin. It accepts the standard sqlguard middleware options (WithAnalyzer, WithReporter, WithSlowQueryThreshold, WithParser, WithN1Detection, …) — the same option set the database/sql driver wrapper and pgxguard use, so there is no parallel configuration surface to drift.
func (*Plugin) Initialize ¶
Initialize registers before/after callbacks on every GORM callback chain.
GORM v2 routes operations through six distinct callback chains:
- Create/Update/Delete — ORM-style mutating operations
- Query — ORM-style reads (First/Find/Take/…)
- Row — raw SQL that returns rows (db.Raw().Scan / .Row)
- Raw — raw SQL without rows (db.Exec)
Missing any chain silently uncovers a query class — pre-rewrite, only Create/Query/Update/Delete were hooked, so every db.Raw and db.Exec bypassed analysis (and there were no tests to catch it). All six chains are now registered.
SQL is analyzed in the after-callback because GORM has not yet rendered db.Statement.SQL when the before-callback fires for the ORM chains.
Source Files