postgres

package
v2.1.8 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 23, 2026 License: MIT Imports: 23 Imported by: 0

Documentation

Overview

Package postgres contains the server-mode repositories. Every operation is transaction scoped and binds the authenticated tenant through the SECURITY DEFINER function installed by the server migration.

Index

Constants

View Source 
const (
	OutboxStatusPending    = "pending"
	OutboxStatusLeased     = "leased"
	OutboxStatusComplete   = "complete"
	OutboxStatusDeadLetter = "dead_letter"
)

Variables

View Source 
var (
	ErrInvalidRelation  = errors.New("postgres graph: invalid relation type")
	ErrInvalidTimeRange = errors.New("postgres graph: invalid valid-time range")
	ErrInvalidEdge      = errors.New("postgres graph: invalid edge")
)
View Source 
var (
	ErrTenantContextRequired   = errors.New("postgres store: tenant context is required")
	ErrPrincipalRequired       = errors.New("postgres store: principal is required")
	ErrGrantDigestRequired     = errors.New("postgres store: grant digest is required")
	ErrGrantVersionRequired    = errors.New("postgres store: grant version is required")
	ErrAuthorizedStoreRequired = errors.New("postgres store: authorized store is required")
)
View Source 
var ErrInvalidUser = errors.New("postgres users: invalid user")

Functions

This section is empty.

Types

type AuditSink 

type AuditSink struct {
	// contains filtered or unexported fields
}

AuditSink persists authorization decisions without recording request content, token material, or other secrets. Each event is bound to the same verified principal as the server store and is tenant-isolated by PostgreSQL RLS.

func NewAuditSink 

func NewAuditSink(pool *pgxpool.Pool, principalSubject, grantDigest string, grantVersion int64) (*AuditSink, error)

func (*AuditSink) Record 

func (a *AuditSink) Record(ctx context.Context, e authz.AuditEvent) error

type AuthorizedStore 

type AuthorizedStore struct {
	// contains filtered or unexported fields
}

AuthorizedStore is the only server-facing storage capability. The raw Store remains package-private in composition; transports receive repository ports and cannot select a tenant or bypass the authorization binding.

func NewAuthorizedStore 

func NewAuthorizedStore(pool *pgxpool.Pool, ac authz.AuthorizedContext) (*AuthorizedStore, error)

NewAuthorizedStore is the server-safe constructor. The tenant and grants are taken from a prior authorization decision; callers cannot supply a client-owned tenant independently of the verified principal.

func (*AuthorizedStore) BulkSaveObservations 

func (s *AuthorizedStore) BulkSaveObservations(ctx context.Context, observations []*domain.Observation) error

func (*AuthorizedStore) CreateGraphEdge 

func (s *AuthorizedStore) CreateGraphEdge(ctx context.Context, e *domain.Edge) error

func (*AuthorizedStore) CreateSession 

func (s *AuthorizedStore) CreateSession(ctx context.Context, session *domain.Session) error

CreateSession creates a session in the authorized workspace context.

func (*AuthorizedStore) CreateUser 

func (s *AuthorizedStore) CreateUser(ctx context.Context, in identity.UserCreate) (identity.UserRecord, error)

func (*AuthorizedStore) DeleteGraphEdge 

func (s *AuthorizedStore) DeleteGraphEdge(ctx context.Context, id int64) error

func (*AuthorizedStore) DeleteObservation 

func (s *AuthorizedStore) DeleteObservation(ctx context.Context, id int64) error

func (*AuthorizedStore) DeleteProjectArtifact 

func (s *AuthorizedStore) DeleteProjectArtifact(ctx context.Context, id string, reason string) error

DeleteProjectArtifact soft deletes an artifact.

func (*AuthorizedStore) ExecuteHandoff 

func (s *AuthorizedStore) ExecuteHandoff(ctx context.Context, req domain.HandoffRequest) (domain.ObservationWriteResult, error)

ExecuteHandoff performs the compound preauthorization — observation write ahead of the transaction, plus the optional relation INSIDE it — and then delegates to the RLS-bound executor. tenant/workspace/scope authority comes only from the verified principal; partial permission, an unavailable authorization dependency, or a cross-tenant target fails closed with zero effects (REM-AUTH-001, RD5).

func (*AuthorizedStore) GetGraphEdge 

func (s *AuthorizedStore) GetGraphEdge(ctx context.Context, id int64) (*domain.Edge, error)

func (*AuthorizedStore) GetGraphEdgeByPublicID 

func (s *AuthorizedStore) GetGraphEdgeByPublicID(ctx context.Context, publicID string) (*domain.Edge, error)

func (*AuthorizedStore) GetGraphSubgraph 

func (s *AuthorizedStore) GetGraphSubgraph(ctx context.Context, rootPublicID string, depth, maxNodes int) (*domain.GraphSubgraph, error)

GetGraphSubgraph projects authorized aggregates into a bounded heterogeneous graph without duplicating users, sessions, projects, or entities into a generic source-of-truth table.

func (*AuthorizedStore) GetImportanceScore 

func (s *AuthorizedStore) GetImportanceScore(ctx context.Context, id int64) (*domain.ImportanceScore, error)

func (*AuthorizedStore) GetObservationByID 

func (s *AuthorizedStore) GetObservationByID(ctx context.Context, id int64) (*domain.Observation, error)

func (*AuthorizedStore) GetObservationByPublicID 

func (s *AuthorizedStore) GetObservationByPublicID(ctx context.Context, publicID string) (*domain.Observation, error)

func (*AuthorizedStore) GetProjectContext 

func (s *AuthorizedStore) GetProjectContext(ctx context.Context, project string) (*domain.ProjectContext, error)

GetProjectContext resolves the corporate and project rules into a consolidated System Prompt along with the list of available skills.

func (*AuthorizedStore) GetProjectDuplicates 

func (s *AuthorizedStore) GetProjectDuplicates(ctx context.Context) ([]domain.ProjectDuplicateGroup, error)

GetProjectDuplicates scans projects and returns groups with casing or near-duplicate discrepancies.

func (*AuthorizedStore) GetProjectSkill 

func (s *AuthorizedStore) GetProjectSkill(ctx context.Context, project, key string) (*domain.ProjectSkill, error)

GetProjectSkill gets a specific skill by key.

func (*AuthorizedStore) GetRelatedObservations 

func (s *AuthorizedStore) GetRelatedObservations(ctx context.Context, id int64, depth int) ([]*domain.Observation, error)

func (*AuthorizedStore) GetServerStats 

func (s *AuthorizedStore) GetServerStats(ctx context.Context) (*domain.ServerStats, error)

GetServerStats returns counters scoped by the configured tenant and workspace.

func (*AuthorizedStore) GetUserProfile 

func (s *AuthorizedStore) GetUserProfile(ctx context.Context, id string) (*identity.UserRecord, error)

func (*AuthorizedStore) IssueToken 

func (s *AuthorizedStore) IssueToken(ctx context.Context, in identity.TokenIssue) (identity.IssuedToken, error)

func (*AuthorizedStore) ListAuditEvents 

func (s *AuthorizedStore) ListAuditEvents(ctx context.Context, limit int) ([]*domain.AuditEntry, error)

ListAuditEvents returns recent administrative audit entries for the workspace tenant.

func (*AuthorizedStore) ListObservations 

func (s *AuthorizedStore) ListObservations(ctx context.Context, f domain.ObservationFilter) ([]*domain.Observation, error)

func (*AuthorizedStore) ListProjectArtifacts 

func (s *AuthorizedStore) ListProjectArtifacts(ctx context.Context, project string, kind string) ([]*domain.ProjectArtifactItem, error)

ListProjectArtifacts lists all artifacts (rules & skills) for a project and workspace default.

func (*AuthorizedStore) ListProjectSkills 

func (s *AuthorizedStore) ListProjectSkills(ctx context.Context, project string) ([]*domain.ProjectSkill, error)

ListProjectSkills returns the list of active skills for a project and workspace default.

func (*AuthorizedStore) ListProjects 

func (s *AuthorizedStore) ListProjects(ctx context.Context) ([]string, error)

ListProjects returns project keys visible to the configured principal.

func (*AuthorizedStore) ListSessions 

func (s *AuthorizedStore) ListSessions(ctx context.Context, project string) ([]*domain.Session, error)

ListSessions returns sessions visible in the authorized workspace.

func (*AuthorizedStore) ListTokens 

func (s *AuthorizedStore) ListTokens(ctx context.Context) ([]identity.TokenRecord, error)

func (*AuthorizedStore) ListUsers 

func (s *AuthorizedStore) ListUsers(ctx context.Context) ([]identity.UserRecord, error)

func (*AuthorizedStore) MergeProject 

func (s *AuthorizedStore) MergeProject(ctx context.Context, sourceProject, targetProject string) (*domain.ProjectMergeResult, error)

MergeProject consolidates observations, sessions, prompts, and importance scores from sourceProject into targetProject.

func (*AuthorizedStore) PullSync 

func (s *AuthorizedStore) PullSync(ctx context.Context, cursor int64, limit int) (*domain.SyncPage, error)

func (*AuthorizedStore) PushSync 

func (s *AuthorizedStore) PushSync(ctx context.Context, batch *domain.SyncBatch) (*domain.SyncResult, error)

func (*AuthorizedStore) RecordImportanceAccess 

func (s *AuthorizedStore) RecordImportanceAccess(ctx context.Context, id int64) error

RecordImportanceAccess records a read against an authorized observation. The resource is resolved before authorization so an id from another tenant cannot be used as an oracle or mutate its score metadata.

func (*AuthorizedStore) RevokeToken 

func (s *AuthorizedStore) RevokeToken(ctx context.Context, id string) error

func (*AuthorizedStore) RotateToken 

func (s *AuthorizedStore) RotateToken(ctx context.Context, id string) (identity.IssuedToken, error)

func (*AuthorizedStore) SaveObservation 

func (s *AuthorizedStore) SaveObservation(ctx context.Context, o *domain.Observation) error

func (*AuthorizedStore) SaveObservationWithEffect 

func (s *AuthorizedStore) SaveObservationWithEffect(ctx context.Context, o *domain.Observation) (domain.SaveEffect, error)

SaveObservationWithEffect authorizes the write exactly like SaveObservation and persists through the transactional effect primitive, so the durable created/updated classification is decided inside the transaction (RD2, REM-SAVE-001). No repository escapes the boundary.

func (*AuthorizedStore) SaveProjectArtifact 

func (s *AuthorizedStore) SaveProjectArtifact(ctx context.Context, in domain.SaveProjectArtifactInput) (*domain.ProjectArtifactItem, error)

SaveProjectArtifact saves (creates or updates revision) for a project rule or skill.

func (*AuthorizedStore) SearchObservations 

func (s *AuthorizedStore) SearchObservations(ctx context.Context, query string, opts domain.SearchOptions) ([]*domain.SearchResult, error)

func (*AuthorizedStore) SetImportanceScore 

func (s *AuthorizedStore) SetImportanceScore(ctx context.Context, id int64, score float64) error

SetImportanceScore sets a lifecycle score only after resolving and enforcing the actual observation resource.

func (*AuthorizedStore) SetUserActive 

func (s *AuthorizedStore) SetUserActive(ctx context.Context, id string, active bool) error

func (*AuthorizedStore) UpdateImportanceScore 

func (s *AuthorizedStore) UpdateImportanceScore(ctx context.Context, id int64, increment float64) error

func (*AuthorizedStore) UpdateObservation 

func (s *AuthorizedStore) UpdateObservation(ctx context.Context, o *domain.Observation) error

func (*AuthorizedStore) VerifyToken 

func (s *AuthorizedStore) VerifyToken(ctx context.Context, secret, scope string) (identity.Principal, error)

type EntityRepository 

type EntityRepository struct{ *Store }

func (*EntityRepository) DeleteByObservation 

func (r *EntityRepository) DeleteByObservation(ctx context.Context, id int64) error

func (*EntityRepository) FindByEntity 

func (r *EntityRepository) FindByEntity(ctx context.Context, typ, val string) (out []*domain.EntityLink, err error)

func (*EntityRepository) GetByObservation 

func (r *EntityRepository) GetByObservation(ctx context.Context, id int64) (out []*domain.EntityLink, err error)
func (r *EntityRepository) SaveLinks(ctx context.Context, links []*domain.EntityLink) error

type GraphRepository 

type GraphRepository struct{ *Store }

func (*GraphRepository) CountAllEdges 

func (r *GraphRepository) CountAllEdges(ctx context.Context) (n int, err error)

func (*GraphRepository) CountEdgesByObservation 

func (r *GraphRepository) CountEdgesByObservation(ctx context.Context, id int64) (n int, err error)

func (*GraphRepository) CreateEdge 

func (r *GraphRepository) CreateEdge(ctx context.Context, e *domain.Edge) error

func (*GraphRepository) DeleteEdge 

func (r *GraphRepository) DeleteEdge(ctx context.Context, id int64) error

func (*GraphRepository) GetContradictions 

func (r *GraphRepository) GetContradictions(ctx context.Context, from, to time.Time) ([]*domain.Edge, error)

func (*GraphRepository) GetEdge 

func (r *GraphRepository) GetEdge(ctx context.Context, id int64) (*domain.Edge, error)

func (*GraphRepository) GetEdgeByPublicID 

func (r *GraphRepository) GetEdgeByPublicID(ctx context.Context, publicID string) (*domain.Edge, error)

func (*GraphRepository) GetEdgesForObservation 

func (r *GraphRepository) GetEdgesForObservation(ctx context.Context, id int64) (out []*domain.Edge, err error)

func (*GraphRepository) GetEvolutionChain 

func (r *GraphRepository) GetEvolutionChain(ctx context.Context, a, b int64) ([]*domain.Edge, error)

func (*GraphRepository) GetRelated 

func (r *GraphRepository) GetRelated(ctx context.Context, id int64, depth int) (out []*domain.Observation, err error)

func (*GraphRepository) UpdateEdge 

func (r *GraphRepository) UpdateEdge(ctx context.Context, e *domain.Edge) error

type ObservationRepository 

type ObservationRepository struct{ *Store }

func (*ObservationRepository) CountAll 

func (r *ObservationRepository) CountAll(ctx context.Context) (n int, err error)

func (*ObservationRepository) CountByRoot 

func (r *ObservationRepository) CountByRoot(ctx context.Context, id int64) (n int, err error)

func (*ObservationRepository) CountEdgesAsObs 

func (r *ObservationRepository) CountEdgesAsObs(ctx context.Context, id int64) (n int, err error)

func (*ObservationRepository) Delete 

func (r *ObservationRepository) Delete(ctx context.Context, id int64) error

func (*ObservationRepository) GetByID 

func (r *ObservationRepository) GetByID(ctx context.Context, id int64) (*domain.Observation, error)

func (*ObservationRepository) GetByPublicID 

func (r *ObservationRepository) GetByPublicID(ctx context.Context, publicID string) (*domain.Observation, error)

func (*ObservationRepository) GetBySource 

func (r *ObservationRepository) GetBySource(ctx context.Context, source string, limit int) ([]*domain.Observation, error)

func (*ObservationRepository) GetByTopicKey 

func (r *ObservationRepository) GetByTopicKey(ctx context.Context, project, key string) (*domain.Observation, error)

func (*ObservationRepository) GetByType 

func (r *ObservationRepository) GetByType(ctx context.Context, typ string, limit int) ([]*domain.Observation, error)

func (*ObservationRepository) List 

func (r *ObservationRepository) List(ctx context.Context, f domain.ObservationFilter) (out []*domain.Observation, err error)

func (*ObservationRepository) ListArchivable 

func (r *ObservationRepository) ListArchivable(ctx context.Context, cutoff time.Time, minScore float64, limit int) ([]*domain.Observation, error)

ListArchivable returns old, low-importance observations for lifecycle jobs. Importance is currently represented by the supplied score threshold; the server schema keeps lifecycle filtering tenant-scoped inside the transaction.

func (*ObservationRepository) Save 

func (r *ObservationRepository) Save(ctx context.Context, o *domain.Observation) error

Save keeps the legacy contract and delegates to SaveWithEffect, preserving signature, topic upsert, and unconditional duplicate inserts (REM-SAVE-001, RD2).

func (*ObservationRepository) SaveBulk 

func (r *ObservationRepository) SaveBulk(ctx context.Context, observations []*domain.Observation) error

SaveBulk persists an already-authorized batch in one transaction. Authorization belongs to the facade; this repository method only provides atomic persistence.

func (*ObservationRepository) SaveWithEffect 

func (r *ObservationRepository) SaveWithEffect(ctx context.Context, o *domain.Observation) (domain.SaveEffect, error)

SaveWithEffect persists the observation and reports the durable write status decided inside the same transaction. REM-SAVE-001 compatibility: the interactive path preserves the exact legacy Save observable — topic upsert plus unconditional insert — and never performs dedup replay; manual duplicates always produce a second durable row. Dedup classification is a handoff-only concern (saveWithEffectInTx).

func (*ObservationRepository) Update 

func (r *ObservationRepository) Update(ctx context.Context, o *domain.Observation) error

type OutboxIntent 

type OutboxIntent struct {
	ID            int64
	ObservationID int64
	Intent        string
	Status        string
	Attempts      int
	AvailableAt   time.Time
	LeaseOwner    string
	LeasedUntil   *time.Time
	Error         string
	CompletedAt   *time.Time
	AffectedRows  int
}

type OutboxStore 

type OutboxStore struct{ *Store }

func (*OutboxStore) DeadLetter 

func (r *OutboxStore) DeadLetter(ctx context.Context, id int64, cause error) error

func (*OutboxStore) EnqueueInTx 

func (r *OutboxStore) EnqueueInTx(ctx context.Context, id int64, intent, model string) error

func (*OutboxStore) Lease 

func (r *OutboxStore) Lease(ctx context.Context, limit int) (out []OutboxIntent, err error)

func (*OutboxStore) MarkComplete 

func (r *OutboxStore) MarkComplete(ctx context.Context, id int64) error

func (*OutboxStore) MarkFailed 

func (r *OutboxStore) MarkFailed(ctx context.Context, id int64, cause error, next time.Time) error

func (*OutboxStore) PendingCount 

func (r *OutboxStore) PendingCount(ctx context.Context) (n int, err error)

func (*OutboxStore) RecoverPending 

func (r *OutboxStore) RecoverPending(ctx context.Context) error

func (*OutboxStore) WithinTx 

func (r *OutboxStore) WithinTx(ctx context.Context, h any, fn func(context.Context) error) error

type PromptRepository 

type PromptRepository struct{ *Store }

func (*PromptRepository) List 

func (r *PromptRepository) List(ctx context.Context, project string, limit int) (out []*domain.Prompt, err error)

func (*PromptRepository) Save 

func (r *PromptRepository) Save(ctx context.Context, p *domain.Prompt) error

type SearchRepository 

type SearchRepository struct{ *Store }

func (*SearchRepository) Search 

func (r *SearchRepository) Search(ctx context.Context, query string, opts domain.SearchOptions) (out []*domain.SearchResult, err error)

type SessionRepository 

type SessionRepository struct{ *Store }

func (*SessionRepository) Create 

func (r *SessionRepository) Create(ctx context.Context, s *domain.Session) error

func (*SessionRepository) End 

func (r *SessionRepository) End(ctx context.Context, id, summary string) error

func (*SessionRepository) GetByID 

func (r *SessionRepository) GetByID(ctx context.Context, id string) (*domain.Session, error)

func (*SessionRepository) List 

func (r *SessionRepository) List(ctx context.Context, project string) (out []*domain.Session, err error)

type Store 

type Store struct {
	// contains filtered or unexported fields
}

Store is a tenant-scoped PostgreSQL repository bundle.

func NewStore 

func NewStore(pool *pgxpool.Pool, tenant *domain.TenantContext, principal domain.Principal) (*Store, error)

func (*Store) Backend 

func (s *Store) Backend() string

func (*Store) BeginTx 

func (s *Store) BeginTx(ctx context.Context) (domain.Tx, error)

func (*Store) ExecuteHandoff 

func (s *Store) ExecuteHandoff(ctx context.Context, scope domain.HandoffScope, key string, canonical domain.CanonicalHandoff, hash [32]byte) (domain.ObservationWriteResult, error)

ExecuteHandoff implements domain.HandoffExecutor for the PostgreSQL namespace. Claim/read, observation materialization, optional relation, and receipt finalize all share one authorized transaction: any failure rolls every effect back, and a retry with the same key replays the receipt. Relation targets are not revalidated here; use executeHandoff with an in-transaction authorizer (the AuthorizedStore path) for that.

func (*Store) GetAllScores 

func (r *Store) GetAllScores(ctx context.Context) ([]*domain.ImportanceScore, error)

func (*Store) GetIncomingEdgeCount 

func (r *Store) GetIncomingEdgeCount(ctx context.Context, obsID int64) (int, error)

func (*Store) GetObservation 

func (r *Store) GetObservation(ctx context.Context, obsID int64) (*domain.Observation, error)

func (*Store) GetScore 

func (r *Store) GetScore(ctx context.Context, obsID int64) (*domain.ImportanceScore, error)

GetScore retrieves the tenant-scoped score for an observation.

func (*Store) GetTop 

func (r *Store) GetTop(ctx context.Context, project string, limit int) ([]*domain.ImportanceScore, error)

GetTop retrieves tenant-scoped scores for a project.

func (*Store) GetTopByScore 

func (r *Store) GetTopByScore(ctx context.Context, project string, limit int) ([]*domain.ImportanceScore, error)

func (*Store) Health 

func (s *Store) Health(ctx context.Context) domain.Health

func (*Store) RecordAccess 

func (r *Store) RecordAccess(ctx context.Context, obsID int64) error

func (*Store) SetScore 

func (r *Store) SetScore(ctx context.Context, obsID int64, score float64) error

func (*Store) UpdateScore 

func (r *Store) UpdateScore(ctx context.Context, obsID int64, increment float64) error

UpdateScore adjusts a score and clamps it to the domain range.

func (*Store) WithinTx 

func (s *Store) WithinTx(ctx context.Context, handle any, fn func(context.Context) error) error

type SystemService 

type SystemService struct {
	// contains filtered or unexported fields
}

SystemService is the only capability granted to background lifecycle work. It intentionally exposes no repository and derives its identity from the already verified server principal; clients cannot construct or supply it.

func NewSystemService 

func NewSystemService(store *AuthorizedStore) (*SystemService, error)

func (*SystemService) Delete 

func (s *SystemService) Delete(ctx context.Context, id int64) error

func (*SystemService) ListArchivable 

func (s *SystemService) ListArchivable(ctx context.Context, cutoff time.Time, minScore float64, limit int) ([]*domain.Observation, error)

type TokenPrincipalVerifier 

type TokenPrincipalVerifier struct {
	// contains filtered or unexported fields
}

TokenPrincipalVerifier is the narrow, verification-only PostgreSQL capability for the pre-composition window: authentication runs before any principal exists, and NewStore requires a verified principal, so a middleware verifier cannot hold a repository. The verifier pins ONE fixed tenant whose UUID keys the credential digest HMAC; the mediated routine derives the actual tenant from the credential itself, so a token issued under any other tenant never matches. It holds no principal, no grant digest, and no mutation surface — VerifyToken is its only method — and it never logs or persists the presented secret or the returned provenance.

func NewTokenPrincipalVerifier 

func NewTokenPrincipalVerifier(pool *pgxpool.Pool, tenantID string) (*TokenPrincipalVerifier, error)

NewTokenPrincipalVerifier builds the fixed-tenant verifier over an application-role pool. The tenant comes from configuration, never from a request; pool and tenant id are validated fail-closed before any credential is accepted. uuid.Parse accepts uppercase, raw, URN, and braced spellings, but migration 106 derives credential digests from the canonical uuid::text form, so the parsed UUID is canonicalized before it is stored: every accepted spelling keys the same tenant digest HMAC.

func (*TokenPrincipalVerifier) VerifyToken 

func (v *TokenPrincipalVerifier) VerifyToken(ctx context.Context, secret, requiredScope string) (identity.Principal, error)

VerifyToken authenticates a presented secret with the same single cortex_verify_token_principal call the repository uses, inside its own principal-free transaction: nothing is bound before authentication succeeds. Errors keep the stable redacted taxonomy (ErrInvalidToken/ErrTokenRevoked/ErrTokenExpired/ErrInsufficientScope) and the returned Principal.GrantDigest is verify-minted provenance only.

type TokenRepository 

type TokenRepository struct{ *Store }

TokenRepository persists API credentials in PostgreSQL. Plaintext secrets are returned only by Issue and are never stored. Every token lifecycle mutation (issue, rotate, revoke) and verification execute exclusively through the migration-owned SECURITY DEFINER routines installed by the unshipped 106 server migration; the application role holds no direct api_tokens write and cannot select token_digest.

func (*TokenRepository) Issue 

func (r *TokenRepository) Issue(ctx context.Context, in identity.TokenIssue) (identity.IssuedToken, error)

func (*TokenRepository) List 

func (r *TokenRepository) List(ctx context.Context) (out []identity.TokenRecord, err error)

List returns metadata only. Secret and digest material are never exposed. It reads the non-sensitive api_tokens columns regranted by 106; the digest column is not part of the application role's column grant.

func (*TokenRepository) Revoke 

func (r *TokenRepository) Revoke(ctx context.Context, id string) error

func (*TokenRepository) Rotate 

func (r *TokenRepository) Rotate(ctx context.Context, id string) (identity.IssuedToken, error)

func (*TokenRepository) Verify 

func (r *TokenRepository) Verify(ctx context.Context, secret, requiredScope string) (identity.Principal, error)

Verify authenticates a presented secret through cortex_verify_token_principal. The routine locks the matched token, enforces revocation, expiry, subject liveness and the required scope, aggregates durable grants, folds last_used_at into the same transaction, and mints the one-time binding provenance consumed by cortex_bind_principal. The returned Principal.GrantDigest is that verify-minted provenance only — it is bearer-equivalent, must stay in memory, and is never a configured or recomputable grant digest.

type UserRepository 

type UserRepository struct{ *Store }

UserRepository persists application users. Identity provisioning, grant reads, and activation state changes execute exclusively through the migration-owned SECURITY DEFINER routines installed by the unshipped 106 server migration; the application role holds no direct DML on actor_subjects or principal_grants and cannot read grant digests or versions.

func (*UserRepository) Create 

func (r *UserRepository) Create(ctx context.Context, in identity.UserCreate) (identity.UserRecord, error)

func (*UserRepository) GetByPublicID 

func (r *UserRepository) GetByPublicID(ctx context.Context, id string) (*identity.UserRecord, error)

func (*UserRepository) List 

func (r *UserRepository) List(ctx context.Context) ([]identity.UserRecord, error)

func (*UserRepository) SetActive 

func (r *UserRepository) SetActive(ctx context.Context, id string, active bool) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.