Documentation
¶
Overview ¶
Package sqlguard classifies statements and source-native commands as reads or writes. It is the single place that decides whether a statement can modify data, so the read-only gate, the confirmation gate, and telemetry can never disagree about the same query.
The classifier fails closed: anything it does not recognize is reported as mutating, because executing an unrecognized statement without confirmation is the failure mode that matters.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ContainsKeyword ¶
ContainsKeyword reports whether a query contains any of the given keywords as whole words, ignoring comments and string literals.
func IsReadOnly ¶
IsReadOnly reports whether a statement cannot modify anything.
func IsReadOnlyStatement ¶
func IsReadOnlyStatement(stmtType StatementType) bool
IsReadOnlyStatement reports whether a statement type is read-only on its own. Prefer Classify, which also inspects the rest of the statement.
func IsWriteStatement ¶
func IsWriteStatement(stmtType StatementType) bool
IsWriteStatement reports whether a statement type modifies data or schema.
func OperationName ¶
func OperationName(cls Classification) string
OperationName returns the lowercase verb for a statement, for event payloads and telemetry. Reads report "get" so callers can key display off one value.
Types ¶
type Classification ¶
type Classification struct {
// Type is the statement kind, or StatementUnknown when unrecognized.
Type StatementType
// Mutating reports whether the statement can change data, schema, or
// permissions, or otherwise execute server-side code. Unknown statements are
// reported as mutating.
Mutating bool
// MultiStatement reports whether more than one statement was submitted. It is
// tracked separately from Mutating because execution paths differ: a single
// write still runs as a normal query, while a batch needs script execution.
MultiStatement bool
// Reason explains the verdict in one clause, for audit and error messages.
Reason string
}
Classification is the verdict for one statement or command.
func Classify ¶
func Classify(query string) Classification
Classify decides whether a SQL statement can modify anything.
Detection runs over a normalized copy of the query with comments, string literals, quoted identifiers, and dollar-quoted bodies removed, so a keyword cannot be hidden behind `-- x`, `/* x */`, a leading `(` or `;`, or a tab or newline separator, and a keyword inside a string literal cannot cause a false positive.
func ClassifyCommand ¶
func ClassifyCommand(sourceType, command string) Classification
ClassifyCommand classifies a source-native command for sources whose query surface is not SQL. Unknown source types fall through to Classify, and every unrecognized command is reported as mutating so a source-specific write verb can never reach execution without confirmation.
type StatementType ¶
type StatementType string
StatementType is the kind of statement, derived from its leading keyword.
const ( StatementSelect StatementType = "SELECT" StatementInsert StatementType = "INSERT" StatementUpdate StatementType = "UPDATE" StatementDelete StatementType = "DELETE" StatementDrop StatementType = "DROP" StatementCreate StatementType = "CREATE" StatementAlter StatementType = "ALTER" StatementTruncate StatementType = "TRUNCATE" StatementShow StatementType = "SHOW" StatementDescribe StatementType = "DESCRIBE" StatementExplain StatementType = "EXPLAIN" StatementWith StatementType = "WITH" StatementMerge StatementType = "MERGE" StatementReplace StatementType = "REPLACE" StatementUpsert StatementType = "UPSERT" StatementGrant StatementType = "GRANT" StatementRevoke StatementType = "REVOKE" StatementSet StatementType = "SET" StatementCopy StatementType = "COPY" StatementCall StatementType = "CALL" StatementDo StatementType = "DO" StatementLock StatementType = "LOCK" StatementVacuum StatementType = "VACUUM" StatementAnalyze StatementType = "ANALYZE" StatementPragma StatementType = "PRAGMA" StatementUse StatementType = "USE" StatementCommand StatementType = "COMMAND" StatementUnknown StatementType = "UNKNOWN" )
Source Files