sql

package
v0.3.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 5, 2026 License: GPL-3.0 Imports: 14 Imported by: 0

Documentation

Overview

Package sql renders complete deterministic P3 root read statements from authorized provider-neutral plans. Caller values remain positional binds.

Index

Constants

View Source 
const (
	MaxStatementBytes   = 1 << 20
	MaxStatementAliases = 2_048
)

MaxStatementBytes and MaxStatementAliases bound the two pieces of statement complexity that are independent of bind count. The byte ceiling prevents a deeply expanded authorized predicate from producing an arbitrarily large SQL string, while the alias ceiling prevents pathological relation/policy trees from exhausting provider parser resources. Both limits are deliberately provider-neutral so a request accepted for SQLite cannot fail only because it was rendered for PostgreSQL (or vice versa).

View Source 
const (
	BatchChunkKeys = 900
)

BatchChunkKeys is the maximum number of distinct parent correlation tuples accepted by one batch statement. MaxBatchParameters additionally protects old SQLite builds whose variable ceiling is 999.

View Source 
const MaxStatementParameters = 999

MaxStatementParameters is the shared provider-neutral ceiling for every P3 read statement. It deliberately targets legacy SQLite's 999-variable limit; PostgreSQL's higher protocol ceiling must not make a plan non-portable.

Variables

This section is empty.

Functions

func BatchKeyCapacity 

func BatchKeyCapacity(plan readplan.Plan, endpoint schema.RelationEndpoint, registry *schema.Registry, provider policyir.Provider, capabilities policysql.CapabilityProof) (int, error)

BatchKeyCapacity returns the exact per-statement tuple capacity after reserving binds used by the target policy, caller predicate, and cursor.

func StatementCapacityExceeded added in v0.3.0 

func StatementCapacityExceeded(err error) bool

StatementCapacityExceeded reports whether a rendered read exceeded a bind or byte ceiling.

func ValidateStatementComplexity added in v0.3.0 

func ValidateStatementComplexity(model policyir.ModelID, statement string, maximumBytes, maximumAliases int) error

ValidateStatementComplexity applies the configured provider-neutral SQL size limits.

Types

type BatchStatement 

type BatchStatement struct {
	// contains filtered or unexported fields
}

BatchStatement is one bounded, row-shaped relation loader statement. It uses the ordinary logical decoder; correlation fields are private fields already injected into the child plan by the planner.

func RenderBatch 

func RenderBatch(plan readplan.Plan, endpoint schema.RelationEndpoint, keys [][]policyir.Value, registry *schema.Registry, provider policyir.Provider, capabilities policysql.CapabilityProof) (BatchStatement, error)

RenderBatch renders one target-policy-scoped relation page for a chunk of distinct, non-null canonical parent keys. Pagination is performed by ROW_NUMBER partitioned by correlation key, so take/skip are per parent.

func (BatchStatement) Args 

func (statement BatchStatement) Args() []any

func (BatchStatement) CorrelationFields 

func (statement BatchStatement) CorrelationFields() []policyir.FieldID

func (BatchStatement) ExtraCorrelationFields 

func (statement BatchStatement) ExtraCorrelationFields() []policyir.FieldID

func (BatchStatement) PlanMap added in v0.1.0 

func (statement BatchStatement) PlanMap() PlanMap

func (BatchStatement) ReverseBuckets 

func (statement BatchStatement) ReverseBuckets() bool

func (BatchStatement) SQL 

func (statement BatchStatement) SQL() string

type Column 

type Column struct {
	// contains filtered or unexported fields
}

func (Column) Alias 

func (column Column) Alias() string

func (Column) FieldID 

func (column Column) FieldID() policyir.FieldID

func (Column) Public 

func (column Column) Public() bool

type CorrelatedColumn 

type CorrelatedColumn struct {
	// contains filtered or unexported fields
}

func (CorrelatedColumn) Alias 

func (column CorrelatedColumn) Alias() string

func (CorrelatedColumn) FieldID 

func (column CorrelatedColumn) FieldID() policyir.FieldID

func (CorrelatedColumn) OccurrenceID 

func (column CorrelatedColumn) OccurrenceID() readir.OccurrenceID

func (CorrelatedColumn) RelationID 

func (column CorrelatedColumn) RelationID() policyir.RelationID

type CountColumn 

type CountColumn struct {
	// contains filtered or unexported fields
}

func (CountColumn) Alias 

func (column CountColumn) Alias() string

func (CountColumn) OccurrenceID 

func (column CountColumn) OccurrenceID() readir.OccurrenceID

func (CountColumn) RelationID 

func (column CountColumn) RelationID() policyir.RelationID

type Error 

type Error struct {
	Code   ErrorCode
	Model  policyir.ModelID
	Field  policyir.FieldID
	Detail string
	Cause  error
}

func (*Error) Error 

func (failure *Error) Error() string

func (*Error) Unwrap 

func (failure *Error) Unwrap() error

type ErrorCode 

type ErrorCode string
const (
	CodeInput  ErrorCode = "P3_SQL_INPUT"
	CodeSchema ErrorCode = "P3_SQL_SCHEMA"
	CodeRender ErrorCode = "P3_SQL_RENDER"
)

type PlanAliasFact added in v0.1.0 

type PlanAliasFact struct {
	// contains filtered or unexported fields
}

PlanAliasFact is one allocation-scoped alias identity retained by the read renderer. It contains no SQL, binds, values, provider names, diagnostics, or public query-plan types.

func (PlanAliasFact) FieldIDs added in v0.1.0 

func (fact PlanAliasFact) FieldIDs() []policyir.FieldID

func (PlanAliasFact) Matches added in v0.1.0 

func (fact PlanAliasFact) Matches(candidate string) bool

Matches compares an untrusted provider alias with the renderer-owned token. Zero and incomplete facts always fail closed.

func (PlanAliasFact) ModelID added in v0.1.0 

func (fact PlanAliasFact) ModelID() policyir.ModelID

func (PlanAliasFact) RelationID added in v0.1.0 

func (fact PlanAliasFact) RelationID() (policyir.RelationID, bool)

func (PlanAliasFact) Role added in v0.1.0 

func (fact PlanAliasFact) Role() PlanAliasRole

type PlanAliasRole added in v0.1.0 

type PlanAliasRole uint8

PlanAliasRole is allocation provenance. Relation-bearing joins can still be ordinary physical accesses; only aliases allocated for correlated reads or policy traversals carry the correlated role. 

const (
	PlanAliasPhysicalAccess PlanAliasRole = iota + 1
	PlanAliasCorrelatedRelation
)

type PlanMap added in v0.1.0 

type PlanMap struct {
	// contains filtered or unexported fields
}

PlanMap is the immutable alias-identity map attached to one exact rendered statement. AliasFacts and MatchingAliasFacts always return caller-owned snapshots. Matching preserves all facts for a repeated alias; downstream sanitizers must use the stable identities to reject ambiguity, never guess.

func (PlanMap) AliasFacts added in v0.1.0 

func (plan PlanMap) AliasFacts() []PlanAliasFact

func (PlanMap) MatchingAliasFacts added in v0.1.0 

func (plan PlanMap) MatchingAliasFacts(candidate string) []PlanAliasFact

type RelationStrategy 

type RelationStrategy uint8
const (
	RelationBatch RelationStrategy = iota + 1
	RelationCorrelated
)

func ChooseRelationStrategy 

func ChooseRelationStrategy(parent readplan.Plan, relation readplan.Relation, registry *schema.Registry, provider policyir.Provider) RelationStrategy

ChooseRelationStrategy is the single deterministic production chooser. A true correlated JSON statement is selected for a single-column to-one, or for an equality-indexed, single-column, plain-scalar to-many correlation. Every other shape uses the bounded row batch.

type SemanticCandidates added in v0.3.0 

type SemanticCandidates struct {
	// contains filtered or unexported fields
}

SemanticCandidates is the authorized candidate subquery of one semantic rank statement. Its projection is the owner's primary-key columns in physical key order, each aliased to its own physical name, so managed shadow storage can join ranked vectors to exactly the rows an ordinary read would return.

func RenderSemanticCandidates added in v0.3.0 

func RenderSemanticCandidates(plan readplan.Plan, registry *schema.Registry, provider policyir.Provider, capabilities policysql.CapabilityProof, enclosingParameters int, requiredFieldConditions ...policyir.Condition) (SemanticCandidates, error)

RenderSemanticCandidates compiles the plan's authorized predicate, conjoined with the field mask of every conditional primary-key field, into a subquery over the owner table. The masks are mandatory: a masked primary identity was previously dropped in Go while extracting record keys, and candidacy is now decided entirely in SQL.

func (SemanticCandidates) Args added in v0.3.0 

func (statement SemanticCandidates) Args() []any

func (SemanticCandidates) Columns added in v0.3.0 

func (statement SemanticCandidates) Columns() []physical.PhysicalName

func (SemanticCandidates) Fields added in v0.3.0 

func (statement SemanticCandidates) Fields() []policyir.FieldID

func (SemanticCandidates) SQL added in v0.3.0 

func (statement SemanticCandidates) SQL() string

type Statement 

type Statement struct {
	// contains filtered or unexported fields
}

func Render 

func Render(plan readplan.Plan, registry *schema.Registry, provider policyir.Provider, capabilities policysql.CapabilityProof) (Statement, error)

func (Statement) Args 

func (statement Statement) Args() []any

func (Statement) Columns 

func (statement Statement) Columns() []Column

func (Statement) CorrelatedColumns 

func (statement Statement) CorrelatedColumns() []CorrelatedColumn

func (Statement) CountColumns 

func (statement Statement) CountColumns() []CountColumn

func (Statement) IsCount 

func (statement Statement) IsCount() bool

func (Statement) PlanMap added in v0.1.0 

func (statement Statement) PlanMap() PlanMap

func (Statement) ReverseResult 

func (statement Statement) ReverseResult() bool

func (Statement) SQL 

func (statement Statement) SQL() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.