Documentation
¶
Overview ¶
Package scoped provides authenticated, transaction-scoped access to a Codefly Postgres service. It deliberately has no admin capability: schema ownership and cross-tenant maintenance belong to separately wired control plane dependencies, never to request handlers.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrUnauthenticated = errors.New("postgres scope requires an authenticated principal") )
Functions ¶
This section is empty.
Types ¶
type Authenticator ¶
type Authenticator interface {
AuthenticatedPrincipal(context.Context) (Principal, error)
AuthorizeDatabaseWrite(context.Context, Principal) error
}
Authenticator resolves an already verified principal from context and owns the application-specific decision to issue a write capability.
type Factory ¶
type Factory struct {
// contains filtered or unexported fields
}
Factory owns the private reader/writer pools and converts authenticated request context into bound capabilities. It never exposes either raw pool.
func NewFactory ¶
func NewFactory(reader, writer *pgxpool.Pool, authenticator Authenticator, options ...Option) (*Factory, error)
NewFactory constructs the request-time database boundary. The pools must be built from Codefly's read-only-connection and read-write-connection secrets, respectively.
type Option ¶
type Option func(*config) error
Option configures the RLS settings used by application policies.
func WithScopeSettings ¶
WithScopeSettings changes the transaction-local Postgres settings. Custom settings must use the extension-style namespace required by Postgres, e.g. "app.current_tenant_id" and "app.current_user_id".
type Principal ¶
Principal is the minimal authenticated identity required by tenant RLS. Applications adapt their verified auth/proto identity to this interface at the request boundary; repositories never accept tenant or user IDs directly.
type ReadTx ¶
type ReadTx interface {
Query(context.Context, string, ...any) (pgx.Rows, error)
QueryRow(context.Context, string, ...any) pgx.Row
}
ReadTx intentionally exposes query operations only. Even if it is circumvented, the transaction and its dedicated credential are read-only at the database layer as defense in depth.
type Reader ¶
type Reader struct {
// contains filtered or unexported fields
}
Reader is an authenticated, principal-bound read capability.
type WriteTx ¶
WriteTx adds mutation to ReadTx. A writer may query to enforce invariants; a reader can never obtain Exec through this API.
Source Files