Documentation
¶
Overview ¶
Package db is the database-structure sensor (dimension "db"). Unlike the security sensor it does not walk source files: it resolves the configured database.schema_paths from disk (it is the filesystem-side caller, ADR 0014), asks the provider's SchemaParser for a neutral db.Schema, runs the core dbrules over it, and stamps baseline fingerprints. It is honest about NOT measuring: disabled, no schema_paths, or a provider without a schema parser return Measured=false with a note — never a false "clean, 0 findings".
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func StampSurface ¶ added in v0.2.4
func StampSurface(surf []findings.SurfaceItem, content map[string][]byte)
StampSurface fills the snippet (from the source line at the item's position), the baseline fingerprint, and the stable id of any surface item that lacks them. It is exported so the MCP adapter can stamp the cross rules' items (produced after Audit) with the SAME discipline the sensor uses on its own — one stamping, no drift (ADR 0029). Idempotent: an item already stamped is untouched.
Types ¶
type Result ¶
type Result struct {
Measured bool
Note string
Res findings.SensorResult
// Schema is the parsed neutral schema, exposed so the MCP adapter can run the
// code↔schema cross (crossrules) over it WITHOUT re-reading/re-parsing and
// without importing a provider here (ADR 0029). Nil on a not-measured result.
// The sensor stays schema-only: it merely returns what it parsed; the cross is
// orchestrated in the adapter, never here.
Schema *coredb.Schema
// SchemaContent is the raw content of the parsed schema files, keyed by path —
// exposed alongside Schema so the adapter can STAMP the cross rules' items
// (snippet + fingerprint) the same way the sensor stamps its own, since those
// items are produced after Audit returns and would otherwise carry no baseline
// identity (ADR 0029). Nil on a not-measured result.
SchemaContent map[string][]byte
}
Result is the DB audit outcome, including whether the DB was measured at all. Measured=false with a Note is the honest "not audited" state (disabled, no schema_paths, provider without a schema parser) — distinct from "audited, 0 findings".
type Sensor ¶
type Sensor struct {
// contains filtered or unexported fields
}
Sensor audits the database structure, driven by a schema parser resolved by the caller from the input's shape (.prisma / .sql — ADR 0018). The rule logic lives in the core (dbrules); the sensor only reads/orders the schema files and stamps identity. It depends on exactly the capability it uses, providers.SchemaParser — not LanguageProvider — so the "no parser" case is a compile-time concern of the adapter, not a runtime branch here.
func New ¶
func New(p providers.SchemaParser) *Sensor
New builds a DB sensor backed by a schema parser.
func (*Sensor) Audit ¶
func (s *Sensor) Audit(ctx auditctx.AuditContext) (Result, error)
Audit resolves the schema, runs the core DB rules, and stamps fingerprints. It returns Measured=false + a Note (never an error) for the honest not-measured cases; a hard error only for a configured-but-missing schema file or a parse failure — silently skipping those would be the false "all good" codefit exists to catch.
func (*Sensor) OwnedCategories ¶
OwnedCategories are the baseline Item categories the DB sensor produces: its finding dimension ("db") plus its per-rule surface categories. They scope the unified baseline (ADR 0019) and must be disjoint from every other sensor's.
func (*Sensor) Run ¶
func (s *Sensor) Run(ctx auditctx.AuditContext) (findings.SensorResult, error)
Run adapts Audit to the sensors.Sensor interface (for future aggregate use in scan-all). The standalone tool calls Audit directly to get Measured/Note.
Source Files