Documentation
¶
Overview ¶
Package rules contains AgentSQL's built-in SQL security rules.
Index ¶
- Constants
- func BuiltinRuleOverrides() []model.Rule
- func NewGenericRules(limiter RateLimiter) []engine.Rule
- func NewMysqlRules(meta MysqlTransactionMetadataProvider) []engine.Rule
- func NewPostgresRules(meta MetadataProvider) []engine.Rule
- type Clock
- type MetadataProvider
- type MysqlTransactionMetadataProvider
- type MysqlTransactionState
- type RateLimitReason
- type RateLimitResult
- type RateLimiter
- type TokenBucketLimiter
- type TransactionMetadataProvider
- type TransactionState
Constants ¶
const ( // ThresholdMaxScanRows controls R004 estimated scan rows. ThresholdMaxScanRows = "max_scan_rows" // ThresholdRowLimit controls R005 large-result detection. ThresholdRowLimit = "row_limit" // ThresholdQPS controls R008 per-Agent requests per second. ThresholdQPS = "qps_per_agent" // ThresholdMaxConcurrent controls R008 per-Agent in-flight requests. ThresholdMaxConcurrent = "max_conns_per_datasource" // ThresholdMaxSQLLength controls R009 SQL byte length. ThresholdMaxSQLLength = "max_sql_length" // ThresholdMaxNesting controls R009 parser-reported nesting depth. ThresholdMaxNesting = "max_nesting_depth" // ThresholdMaxUnion controls R009 parser-reported UNION count. ThresholdMaxUnion = "max_union_count" // OperationNestingDepth prefixes the parser's structured nesting signal. OperationNestingDepth = "NESTING_DEPTH" // OperationUnionCount prefixes the parser's structured UNION signal. OperationUnionCount = "UNION_COUNT" // OperationSelectColumn prefixes a parser-reported outer projection column. OperationSelectColumn = "SELECT_COLUMN" )
const ( // ThresholdMysqlTransactionAgeMS controls R204 transaction age. ThresholdMysqlTransactionAgeMS = "mysql_transaction_age_ms" // ThresholdMysqlTransactionAffectedRows controls R204 cumulative affected rows. ThresholdMysqlTransactionAffectedRows = "mysql_transaction_affected_rows" )
const ( // ThresholdLargeTableRows controls R106 large-table ALTER detection. ThresholdLargeTableRows = "large_table_rows" // ThresholdLongTransactionMS controls R107 active transaction age. ThresholdLongTransactionMS = "long_transaction_ms" // ThresholdIdleTransactionMS controls R107 idle-in-transaction age. ThresholdIdleTransactionMS = "idle_transaction_ms" )
Variables ¶
This section is empty.
Functions ¶
func BuiltinRuleOverrides ¶
BuiltinRuleOverrides returns one persisted, enabled override for every rule that the runtime can actually execute. The list is derived from the runtime constructors so callers cannot accidentally register database-only rules.
func NewGenericRules ¶
func NewGenericRules(limiter RateLimiter) []engine.Rule
NewGenericRules returns R001-R010 in stable order with an injected limiter. The caller retains the limiter so it can release R008 reservations.
func NewMysqlRules ¶
func NewMysqlRules(meta MysqlTransactionMetadataProvider) []engine.Rule
NewMysqlRules returns R201-R204 in stable evaluation order.
func NewPostgresRules ¶
func NewPostgresRules(meta MetadataProvider) []engine.Rule
NewPostgresRules returns R101-R107 in stable evaluation order.
Types ¶
type MetadataProvider ¶
type MetadataProvider interface {
TableHasIndex(schema, table string) (bool, error)
TableRowCount(schema, table string) (int64, error)
}
MetadataProvider supplies the minimum read-only metadata required by T06. A real database-backed implementation is deferred to T10.
type MysqlTransactionMetadataProvider ¶
type MysqlTransactionMetadataProvider interface {
MysqlTransactionState() (MysqlTransactionState, error)
}
MysqlTransactionMetadataProvider supplies optional MySQL session metadata. Complete large-transaction detection depends on T10 session/connection metadata.
type MysqlTransactionState ¶
MysqlTransactionState is the optional session snapshot consumed by R204.
type RateLimitReason ¶
type RateLimitReason string
RateLimitReason identifies the exhausted part of a rate limit.
const ( // RateLimitQPS indicates that the token bucket is empty. RateLimitQPS RateLimitReason = "qps" // RateLimitConcurrency indicates that all in-flight slots are occupied. RateLimitConcurrency RateLimitReason = "concurrency" )
type RateLimitResult ¶
type RateLimitResult struct {
Allowed bool
Reason RateLimitReason
}
RateLimitResult is the atomic admission result returned by a RateLimiter.
type RateLimiter ¶
type RateLimiter interface {
Allow(key string, qps float64, maxConcurrent int) (RateLimitResult, error)
Release(key string) error
}
RateLimiter reserves one QPS token and one concurrent-request slot when it allows a request. The pipeline must call Release after that request finishes.
type TokenBucketLimiter ¶
type TokenBucketLimiter struct {
// contains filtered or unexported fields
}
TokenBucketLimiter is an in-memory, concurrency-safe QPS and in-flight limiter.
func NewDefaultTokenBucketLimiter ¶
func NewDefaultTokenBucketLimiter() *TokenBucketLimiter
NewDefaultTokenBucketLimiter constructs a limiter backed by the system clock.
func NewTokenBucketLimiter ¶
func NewTokenBucketLimiter(clock Clock) (*TokenBucketLimiter, error)
NewTokenBucketLimiter constructs a limiter with an injectable clock.
func (*TokenBucketLimiter) Allow ¶
func (limiter *TokenBucketLimiter) Allow( key string, qps float64, maxConcurrent int, ) (RateLimitResult, error)
Allow atomically reserves a token and concurrent-request slot.
func (*TokenBucketLimiter) Release ¶
func (limiter *TokenBucketLimiter) Release(key string) error
Release returns one concurrent-request slot after execution finishes.
type TransactionMetadataProvider ¶
type TransactionMetadataProvider interface {
MetadataProvider
TransactionState() (TransactionState, error)
}
TransactionMetadataProvider extends PostgreSQL table metadata with session state.
type TransactionState ¶
TransactionState is a side-effect-free snapshot used by R107.
Source Files