postgres

package
v0.4.5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 21, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Documentation

Overview

Package postgres implements the durable management storage.Store adapter. PostgreSQL is the management-plane source of truth; every security-sensitive mutation is committed in a database transaction.

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrInvalidStore = errors.New("invalid management PostgreSQL store")
	ErrSchemaTooNew = errors.New("newer management PostgreSQL schema version")
)

Functions

func NormalizeSiteForWrite 

func NormalizeSiteForWrite(v *storage.Site)

Types

type Store 

type Store struct {
	// contains filtered or unexported fields
}

Store is safe for concurrent callers. database/sql and PostgreSQL provide connection pooling; transaction boundaries in this adapter provide the atomic identity, epoch, and session semantics.

func New 

func New(db *sql.DB) (*Store, error)

func NewWithRoles 

func NewWithRoles(db *sql.DB, permissions map[string][]string) (*Store, error)

NewWithRoles accepts the exact keys from the active apisec.permissions map. Values in that map are permission expressions and are not role identities.

func Open 

func Open(ctx context.Context, dsn string) (*Store, error)

func (*Store) ClaimReviewItem 

func (s *Store) ClaimReviewItem(ctx context.Context, id, decision string) (*storage.ReviewDecisionClaim, error)

func (*Store) ClearNotifications 

func (s *Store) ClearNotifications(ctx context.Context, userID string) (int64, error)

func (*Store) Close 

func (s *Store) Close() error

func (*Store) CompleteReviewItem 

func (s *Store) CompleteReviewItem(ctx context.Context, id, token string, d storage.ReviewDecision) (*storage.ReviewItem, error)

func (*Store) ConfigureRoles added in v0.4.5 

func (s *Store) ConfigureRoles(permissions map[string][]string)

ConfigureRoles atomically publishes the exact configured role identities.

func (*Store) ConsumeTOTP 

func (s *Store) ConsumeTOTP(ctx context.Context, userID string, counter int64, expiresAt, now time.Time) (bool, error)

ConsumeTOTP atomically claims a TOTP counter. PostgreSQL's unique key and conditional UPSERT make the claim safe across processes and connections: only an insert or replacement of an expired row returns a result row.

func (*Store) CreateNotification 

func (s *Store) CreateNotification(ctx context.Context, v *storage.Notification) error

func (*Store) CreateReviewItem 

func (s *Store) CreateReviewItem(ctx context.Context, v *storage.ReviewItem) error

func (*Store) CreateRule 

func (s *Store) CreateRule(ctx context.Context, v *storage.Rule) error

func (*Store) CreateSession 

func (s *Store) CreateSession(ctx context.Context, v *storage.Session) error

func (*Store) CreateSite 

func (s *Store) CreateSite(ctx context.Context, v *storage.Site) error

func (*Store) CreateUser 

func (s *Store) CreateUser(ctx context.Context, v *storage.User) error

func (*Store) DecideReviewItem 

func (s *Store) DecideReviewItem(ctx context.Context, id string, d storage.ReviewDecision) (*storage.ReviewItem, error)

func (*Store) DeleteRule 

func (s *Store) DeleteRule(ctx context.Context, id string) error

func (*Store) DeleteSite 

func (s *Store) DeleteSite(ctx context.Context, id string) error

func (*Store) DeleteSitePromote 

func (s *Store) DeleteSitePromote(ctx context.Context, siteID string) error

func (*Store) DeleteTOTPConsumed 

func (s *Store) DeleteTOTPConsumed(ctx context.Context, userID string, counter int64) error

func (*Store) DeleteUser 

func (s *Store) DeleteUser(ctx context.Context, id string) error

func (*Store) GetReviewItem 

func (s *Store) GetReviewItem(ctx context.Context, id string) (*storage.ReviewItem, error)

func (*Store) GetRule 

func (s *Store) GetRule(ctx context.Context, id string) (*storage.Rule, error)

func (*Store) GetSession added in v0.4.0 

func (s *Store) GetSession(ctx context.Context, id, userID string) (*storage.Session, error)

func (*Store) GetSite 

func (s *Store) GetSite(ctx context.Context, id string) (*storage.Site, error)

func (*Store) GetUserByID 

func (s *Store) GetUserByID(ctx context.Context, id string) (*storage.User, error)

func (*Store) GetUserByUsername 

func (s *Store) GetUserByUsername(ctx context.Context, name string) (*storage.User, error)

func (*Store) HasPendingReview 

func (s *Store) HasPendingReview(ctx context.Context, siteID, category, payload, uri string) (bool, error)

func (*Store) HasSimilarReview 

func (s *Store) HasSimilarReview(ctx context.Context, siteID, category, payload, uri string) (bool, error)

func (*Store) Health 

func (s *Store) Health(ctx context.Context) error

Health verifies the management database is reachable and its migration ledger is at the version supported by this binary.

func (*Store) IsSessionActive 

func (s *Store) IsSessionActive(ctx context.Context, id, userID string, now time.Time) (bool, error)

func (*Store) IsTOTPConsumed 

func (s *Store) IsTOTPConsumed(ctx context.Context, userID string, counter int64, now time.Time) (bool, error)

func (*Store) ListNotifications 

func (s *Store) ListNotifications(ctx context.Context, userID string, f storage.NotificationFilter) ([]storage.Notification, int64, int64, int64, error)

func (*Store) ListReviewItems 

func (s *Store) ListReviewItems(ctx context.Context, f storage.ReviewFilter) ([]storage.ReviewItem, int64, error)

func (*Store) ListRules 

func (s *Store) ListRules(ctx context.Context, siteID string) ([]storage.Rule, error)

func (*Store) ListSitePromotes 

func (s *Store) ListSitePromotes(ctx context.Context) (map[string]time.Time, error)

func (*Store) ListSites 

func (s *Store) ListSites(ctx context.Context) ([]storage.Site, error)

func (*Store) ListUsers 

func (s *Store) ListUsers(ctx context.Context) ([]storage.User, error)

func (*Store) MarkAllNotificationsRead 

func (s *Store) MarkAllNotificationsRead(ctx context.Context, userID string) (int64, error)

func (*Store) MarkTOTPConsumed 

func (s *Store) MarkTOTPConsumed(ctx context.Context, userID string, counter int64, expiresAt time.Time) error

func (*Store) Migrate 

func (s *Store) Migrate(ctx context.Context) error

func (*Store) PruneReviewItems 

func (s *Store) PruneReviewItems(ctx context.Context, before time.Time, batchSize int) (int64, error)

func (*Store) PruneSessions 

func (s *Store) PruneSessions(ctx context.Context, before time.Time) (int64, error)

func (*Store) PruneTOTPConsumed 

func (s *Store) PruneTOTPConsumed(ctx context.Context, before time.Time) error

func (*Store) ReleaseReviewItem 

func (s *Store) ReleaseReviewItem(ctx context.Context, id, token string) error

func (*Store) RepairUserUsername 

func (s *Store) RepairUserUsername(ctx context.Context, userID, newUsername, actor, reason string) (*storage.UserUsernameRepair, error)

func (*Store) RestoreSite 

func (s *Store) RestoreSite(ctx context.Context, v *storage.Site) error

RestoreSite writes a previously read site snapshot without changing its timestamps.

func (*Store) RevokeSession 

func (s *Store) RevokeSession(ctx context.Context, id, userID string) error

func (*Store) RevokeUserSessions 

func (s *Store) RevokeUserSessions(ctx context.Context, userID, exceptID string) error

func (*Store) RotateSession 

func (s *Store) RotateSession(ctx context.Context, oldID, userID string, next *storage.Session) error

func (*Store) SetReviewAIVerdict 

func (s *Store) SetReviewAIVerdict(ctx context.Context, id, verdict string) error

func (*Store) UpdateNotification 

func (s *Store) UpdateNotification(ctx context.Context, userID, id string, p storage.NotificationPatch) (*storage.Notification, error)

func (*Store) UpdateRule 

func (s *Store) UpdateRule(ctx context.Context, v *storage.Rule) error

func (*Store) UpdateSite 

func (s *Store) UpdateSite(ctx context.Context, v *storage.Site) error

func (*Store) UpdateUser 

func (s *Store) UpdateUser(ctx context.Context, v *storage.User) error

func (*Store) UpsertSitePromote 

func (s *Store) UpsertSitePromote(ctx context.Context, siteID string, until time.Time) error

func (*Store) VerifyMigrationHandoff added in v0.4.0 

func (s *Store) VerifyMigrationHandoff(ctx context.Context, evidence storage.MigrationHandoffEvidence) error

VerifyMigrationHandoff checks the durable cutover ledger against the metadata-only handoff published by the migration transaction. The query is deliberately exact: a live production store must not serve with a stale, cross-cluster, or partially matching handoff file.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.