Documentation
¶
Overview ¶
Package sqlguard is §12.2's parse gate: the check every statement passes before it reaches a connector database.
Two passes over one parsed statement. The SHAPE must be a single SELECT — not a script, not a write, not a PRAGMA. The VOCABULARY must be on an allowlist, read from the token stream rather than the parse tree, because a walk misses CTE bodies and subqueries and a comment can sit between a function name and its parenthesis.
An allowlist and not a denylist: every function SQLite adds, and every extension a future build links in, would otherwise be permitted until somebody remembered to deny it.
Index ¶
Constants ¶
const MaxLength = 8192
MaxLength caps statement size. A template renders a bounded query; anything approaching this is not one of ours.
Variables ¶
var ErrRejected = errors.New("sqlguard: rejected")
ErrRejected matches every refusal from Check, so a caller can tell "this statement is not allowed" from "the guard itself failed".
Functions ¶
func Aggregates ¶
func Aggregates() []string
Aggregates returns the allowlisted functions that collapse rows.
func AllowedFunctions ¶
func AllowedFunctions() []string
AllowedFunctions returns the vocabulary, sorted. For `doctor` and for tests that assert what is reachable rather than trusting the literal above.
func Check ¶
Check reports whether query may be executed against a connector.
A nil return means: one statement, it is a SELECT, and every function it names is on the allowlist. It does NOT mean the query is cheap, bounded, or that its result may be shown to a model — the row cap and the aggregation gate (§12.1) are separate and neither is here.
Types ¶
This section is empty.
Source Files