Documentation
¶
Overview ¶
Package db opens the ent client over Postgres (pgx) in production or a pure-Go SQLite database for local dev / tests, and installs the client-level hooks and interceptors that enforce audit logging, append-only ledgers, and per-user tenant isolation.
Tenant protection is intentionally dual-layered: native Ent privacy rejects missing viewers, while client interceptors and hooks add the exact row-level predicates for reads and writes.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrAccountNotFound = errors.New("db: account not found")
ErrAccountNotFound means that the user row was already gone.
var ErrNoViewer = errors.New("db: query on per-user entity without a viewer in context")
ErrNoViewer is returned when a per-user entity is queried with neither an authenticated user nor the internal-caller flag in context. It is the ORM-layer guarantee that untrusted code cannot read across tenants.
var ErrTenantMutation = errors.New("db: tenant mutation ownership mismatch")
ErrTenantMutation is returned when a caller attempts to create or re-parent a tenant-owned row for another user.
var ErrWorkspaceTransferConflict = errors.New("db: workspace transfer target changed")
ErrWorkspaceTransferConflict means that a workspace owner or the chosen successor changed between planning and deleting the account.
Functions ¶
This section is empty.
Types ¶
type DB ¶
DB bundles the ent client with the raw *sql.DB (for health pings) and the dialect in use.
func Open ¶
Open connects, installs hooks + interceptors, and (optionally) runs auto-migration. An empty DATABASE_URL falls back to a local sqlite file so the service is fully functional in local development with no external DB.
func (*DB) Cached ¶
Cached returns a context that opts this request's queries into the shared cache for the given TTL. Use only on staleness-tolerant reads (e.g. the /v1/me subscription join). Without it, queries hit the database directly.
func (*DB) DeleteAccount ¶
func (d *DB) DeleteAccount(ctx context.Context, userID uuid.UUID, transfers []WorkspaceTransfer) error
DeleteAccount removes the user and everything the user owns in one transaction. It runs as raw SQL: user edges are immutable in Ent, the ORM rejects deletes of append-only records, and ON DELETE CASCADE does the rest.
The order is important:
- Shared workspaces move to their successors.
- In every workspace that survives, the user's authored rows move to the workspace owner, so the cascade does not delete shared data.
- History rows go while their source rows still identify the user.
- Subscription facts the privacy policy keeps for tax and disputes are copied into billing_retentions. That table has no user foreign key.
- The user row goes, and the database cascades the delete.
- The user's own history rows go (they hold the email).
- A tombstone records the deleted identity, so a token issued before the deletion cannot create the account again.
Source Files