config

package
v0.1.13 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 11, 2026 License: MIT Imports: 22 Imported by: 0

Documentation

Overview

Package config defines the runtime configuration model: database, entities, per-tool toggles, cost thresholds, cache, rate limits, and audit. It contains defaults, validation, encoding-independent presence tracking, and presence-aware JSON decoding. Schema exports YAML editor assistance and documentation; it is not an encoding/json input contract.

Field rules live in `schema` struct tags (see schema_rules.go) and field help in fields.yaml; schema.json and the field reference in docs/configuration.md are generated from them.

Index

Constants

View Source 
const DefaultConnection = "default"

DefaultConnection names the single connection a DSN shorthand declares.

View Source 
const StoreTablePrefix = "smcp_"

StoreTablePrefix prefixes every configuration store table. Entities may not use such a source and introspection skips such tables, so the store is never exposed through the governed data plane.

View Source 
const TokenHashPrefix = "sha256:"

TokenHashPrefix is the only supported tokenHash algorithm.

View Source 
const UserPrincipalPrefix = "user:"

UserPrincipalPrefix prefixes the principal key of a configured user. Role and user names cannot contain ':', so the prefix never collides with a role.

Variables

View Source 
var (
	// ErrInvalidDriver is returned when Database.Driver is empty or malformed.
	ErrInvalidDriver = errors.New("config: invalid database driver")
	// ErrEmptyDSN is returned when Database.DSN is empty.
	ErrEmptyDSN = errors.New("config: empty database DSN")
	// ErrEmptyEntityName is returned when an entity has an empty name.
	ErrEmptyEntityName = errors.New("config: empty entity name")
)

Sentinel validation errors.

View Source 
var (
	// ErrUnknownEntity reports an entity reference naming no entity.
	ErrUnknownEntity = errors.New("unknown entity")
	// ErrAmbiguousEntity reports an entity reference naming several entities.
	ErrAmbiguousEntity = errors.New("ambiguous entity")
)

Functions

func DefaultSecretRoots added in v0.1.11 

func DefaultSecretRoots() []string

DefaultSecretRoots are the directories ${file:...} secrets may be read from when server.secrets.allowedRoots is unset.

func IsStoreTable added in v0.1.11 

func IsStoreTable(name string) bool

IsStoreTable reports whether a table name is reserved for the store.

func NewUserToken added in v0.1.11 

func NewUserToken() (string, error)

NewUserToken returns a 256-bit random bearer token ("smcp_" + base64url).

func ParseFilter added in v0.1.13 

func ParseFilter(fc FilterConfig) (relalg.Predicate, error)

ParseFilter converts a declarative filter to a predicate. A nil filter is no predicate.

func RestartFieldChanges added in v0.1.11 

func RestartFieldChanges(old, next *Config) []string

RestartFieldChanges returns the paths of fields tagged restart whose value differs between old and next. Empty and unset lists or maps compare equal, and unexported bookkeeping is ignored.

func Schema 

func Schema() json.RawMessage

Schema returns a JSON Schema for YAML editor assistance and documentation. Duration fields therefore describe the YAML string form (for example "30s"); this schema is not a standard encoding/json input contract. Runtime validation and provider capability checks still run when the configuration is loaded.

func TokenHash added in v0.1.11 

func TokenHash(token string) string

TokenHash returns the tokenHash form ("sha256:<hex>") of a bearer token.

func YAMLName added in v0.1.11 

func YAMLName(f reflect.StructField) string

YAMLName returns a field's configuration key, or "" when it has none.

Types

type AQEConfig 

type AQEConfig struct {
	WindowSize        int           `yaml:"windowSize"        json:"windowSize" schema:"min=0"`
	AnomalyFactor     float64       `yaml:"anomalyFactor"     json:"anomalyFactor" schema:"min=0"`
	AnomalyMinSamples int           `yaml:"anomalyMinSamples" json:"anomalyMinSamples" schema:"min=0"`
	ExplainAnalyze    bool          `yaml:"explainAnalyze"    json:"explainAnalyze"`
	ReadOnly          bool          `yaml:"readOnly"          json:"readOnly"`
	SampleRate        float64       `yaml:"sampleRate"        json:"sampleRate" schema:"min=0,max=1"`
	Timeout           time.Duration `yaml:"timeout"           json:"timeout" schema:"min=0,max=5s"`
	MaxFingerprints   int           `yaml:"maxFingerprints"   json:"maxFingerprints" schema:"min=1"`
	// contains filtered or unexported fields
}

AQEConfig controls bounded estimate feedback and optional read-only EXPLAIN ANALYZE sampling.

type AQESpec added in v0.1.13 

type AQESpec struct {
	WindowSize        *int           `yaml:"windowSize,omitempty" json:"windowSize,omitempty"`
	AnomalyFactor     *float64       `yaml:"anomalyFactor,omitempty" json:"anomalyFactor,omitempty"`
	AnomalyMinSamples *int           `yaml:"anomalyMinSamples,omitempty" json:"anomalyMinSamples,omitempty"`
	ExplainAnalyze    *bool          `yaml:"explainAnalyze,omitempty" json:"explainAnalyze,omitempty"`
	ReadOnly          *bool          `yaml:"readOnly,omitempty" json:"readOnly,omitempty"`
	SampleRate        *float64       `yaml:"sampleRate,omitempty" json:"sampleRate,omitempty"`
	Timeout           *time.Duration `yaml:"timeout,omitempty" json:"timeout,omitempty"`
	MaxFingerprints   *int           `yaml:"maxFingerprints,omitempty" json:"maxFingerprints,omitempty"`
}

AQESpec is a AQEConfig as written: a nil field was not.

type AuditConfig 

type AuditConfig struct {
	Enabled   bool   `yaml:"enabled"         json:"enabled"`
	Path      string `yaml:"path"      json:"path"`
	QueueSize int    `yaml:"queueSize" json:"queueSize" schema:"min=0"`
}

AuditConfig configures the audit sink.

type AuditSpec added in v0.1.13 

type AuditSpec struct {
	Enabled   *bool   `yaml:"enabled,omitempty" json:"enabled,omitempty"`
	Path      *string `yaml:"path,omitempty" json:"path,omitempty"`
	QueueSize *int    `yaml:"queueSize,omitempty" json:"queueSize,omitempty"`
}

AuditSpec is a AuditConfig as written: a nil field was not.

type AuthConfig 

type AuthConfig struct {
	Token             string    `yaml:"token"             json:"token"`
	TrustProxyHeaders bool      `yaml:"trustProxyHeaders" json:"trustProxyHeaders"`
	TrustedProxyCIDRs []string  `yaml:"trustedProxyCIDRs" json:"trustedProxyCIDRs"`
	TLS               TLSConfig `yaml:"tls"               json:"tls"`
}

AuthConfig configures HTTP transport authentication. When the listener is not bound to loopback, at least one of Token or TLS.ClientCA (mTLS) must be configured or startup is refused (fail-closed). The caller identity headers (X-MCP-Role / X-MCP-Subject) are trusted only when TrustProxyHeaders is true, and either mTLS or TrustedProxyCIDRs establishes the proxy trust boundary.

type AuthSpec added in v0.1.13 

type AuthSpec struct {
	Token             *string      `yaml:"token,omitempty" json:"token,omitempty"`
	TrustProxyHeaders *bool        `yaml:"trustProxyHeaders,omitempty" json:"trustProxyHeaders,omitempty"`
	TrustedProxyCIDRs List[string] `yaml:"trustedProxyCIDRs,omitempty" json:"trustedProxyCIDRs,omitempty"`
	TLS               *TLSSpec     `yaml:"tls,omitempty" json:"tls,omitempty"`
}

AuthSpec is a AuthConfig as written: a nil field was not.

type BudgetConfig 

type BudgetConfig struct {
	Roles   map[string]BudgetLimits `yaml:"roles"   json:"roles"`
	Tenants map[string]BudgetLimits `yaml:"tenants" json:"tenants"`
	Users   map[string]BudgetLimits `yaml:"users,omitempty" json:"users,omitempty"`
}

BudgetConfig contains role and tenant scoped resource limits.

type BudgetLimits 

type BudgetLimits struct {
	MaxConcurrent           int           `yaml:"maxConcurrent" json:"maxConcurrent" schema:"min=0"`
	MaxExecution            time.Duration `yaml:"maxExecution"             json:"maxExecution" schema:"min=0"`
	MaxEstimatedScannedRows int64         `yaml:"maxEstimatedScannedRows"  json:"maxEstimatedScannedRows" schema:"min=0"`
	MaxReturnedRows         int64         `yaml:"maxReturnedRows"          json:"maxReturnedRows" schema:"min=0"`
	MaxReturnedBytes        int64         `yaml:"maxReturnedBytes"         json:"maxReturnedBytes" schema:"min=0"`
	MaxSessionCost          int64         `yaml:"maxSessionCost"           json:"maxSessionCost" schema:"min=0"`
}

BudgetLimits is unlimited when all fields are zero.

type BudgetLimitsSpec added in v0.1.13 

type BudgetLimitsSpec struct {
	MaxConcurrent           *int           `yaml:"maxConcurrent,omitempty" json:"maxConcurrent,omitempty"`
	MaxExecution            *time.Duration `yaml:"maxExecution,omitempty" json:"maxExecution,omitempty"`
	MaxEstimatedScannedRows *int64         `yaml:"maxEstimatedScannedRows,omitempty" json:"maxEstimatedScannedRows,omitempty"`
	MaxReturnedRows         *int64         `yaml:"maxReturnedRows,omitempty" json:"maxReturnedRows,omitempty"`
	MaxReturnedBytes        *int64         `yaml:"maxReturnedBytes,omitempty" json:"maxReturnedBytes,omitempty"`
	MaxSessionCost          *int64         `yaml:"maxSessionCost,omitempty" json:"maxSessionCost,omitempty"`
}

BudgetLimitsSpec is a BudgetLimits as written: a nil field was not.

type BudgetSpec added in v0.1.13 

type BudgetSpec struct {
	Roles   Map[string, BudgetLimitsSpec] `yaml:"roles,omitempty" json:"roles,omitempty"`
	Tenants Map[string, BudgetLimitsSpec] `yaml:"tenants,omitempty" json:"tenants,omitempty"`
	Users   Map[string, BudgetLimitsSpec] `yaml:"users,omitempty" json:"users,omitempty"`
}

BudgetSpec is a BudgetConfig as written: a nil field was not.

type CacheConfig 

type CacheConfig struct {
	Enabled         bool          `yaml:"enabled"         json:"enabled"`
	TTL             time.Duration `yaml:"ttl"             json:"ttl" schema:"min=0"`
	MaxSize         int           `yaml:"maxSize"         json:"maxSize" schema:"min=0"`
	MaxEntryRows    int           `yaml:"maxEntryRows"    json:"maxEntryRows" schema:"min=0"`
	MaxEntryBytes   int64         `yaml:"maxEntryBytes"   json:"maxEntryBytes" schema:"min=0"`
	PreparedMaxSize int           `yaml:"preparedMaxSize" json:"preparedMaxSize" schema:"min=0"`
}

CacheConfig configures the read cache.

type CacheSpec added in v0.1.13 

type CacheSpec struct {
	Enabled         *bool          `yaml:"enabled,omitempty" json:"enabled,omitempty"`
	TTL             *time.Duration `yaml:"ttl,omitempty" json:"ttl,omitempty"`
	MaxSize         *int           `yaml:"maxSize,omitempty" json:"maxSize,omitempty"`
	MaxEntryRows    *int           `yaml:"maxEntryRows,omitempty" json:"maxEntryRows,omitempty"`
	MaxEntryBytes   *int64         `yaml:"maxEntryBytes,omitempty" json:"maxEntryBytes,omitempty"`
	PreparedMaxSize *int           `yaml:"preparedMaxSize,omitempty" json:"preparedMaxSize,omitempty"`
}

CacheSpec is a CacheConfig as written: a nil field was not.

type Config 

type Config struct {
	Version      string                    `yaml:"version"         json:"version"`
	Server       ServerConfig              `yaml:"server"          json:"server"`
	Database     DatabaseConfig            `yaml:"database"        json:"database" schema:"nodefault"`
	Databases    map[string]DatabaseConfig `yaml:"databases"       json:"databases" schema:"nodefault,keys=@pathSegment"`
	Entities     []EntityConfig            `yaml:"entities"        json:"entities"`
	Roles        map[string]RoleDefinition `yaml:"roles,omitempty" json:"roles,omitempty" schema:"keys=@accessName"`
	Users        map[string]UserConfig     `yaml:"users,omitempty" json:"users,omitempty" schema:"keys=@accessName"`
	Tools        ToolFlags                 `yaml:"tools"           json:"tools" schema:"nodefault"`
	Cost         CostConfig                `yaml:"cost"            json:"cost"`
	Budget       BudgetConfig              `yaml:"budget"          json:"budget"`
	Cache        CacheConfig               `yaml:"cache"           json:"cache"`
	RateLimit    RateLimitConfig           `yaml:"rateLimit"       json:"rateLimit"`
	Mask         MaskConfig                `yaml:"mask"            json:"mask"`
	Audit        AuditConfig               `yaml:"audit"           json:"audit"`
	Transactions TransactionConfig         `yaml:"transactions"    json:"transactions"`
	Execution    ExecutionConfig           `yaml:"execution"       json:"execution"`
}

Config is the top-level configuration. Version is the configuration contract marker; the current value is "1" and loaders currently preserve it without rejecting other values.

func Resolve added in v0.1.13 

func Resolve(spec *Spec) (*Config, error)

Resolve is the configuration spec describes: its defaults filled in, and validated.

func (*Config) ApplyDefaults 

func (c *Config) ApplyDefaults()

ApplyDefaults fills unset fields with safe defaults. An omitted Tools section receives DefaultToolFlags; entities with unset MCP get DMLTools=true; each omitted cost safety field receives its own default; rate limits default to conservative bounds.

func (*Config) Validate 

func (c *Config) Validate() error

Validate checks a configuration whose defaults are applied (ApplyDefaults; every loader does this). DSN placeholder resolution happens later in x/bootstrap; here we only require non-empty.

type ConnectionConfig added in v0.1.11 

type ConnectionConfig struct {
	DSN string `yaml:"dsn" json:"dsn" schema:"required,minLength=1"`
	// Role is primary (the default) or replica; a replica serves reads only.
	Role string `yaml:"role,omitempty" json:"role,omitempty" schema:"enum=@connectionRole"`
	// Pooler is "transaction" behind a transaction-mode pooler (pgbouncer,
	// ProxySQL): no session state such as prepared statements is kept.
	Pooler string `yaml:"pooler,omitempty" json:"pooler,omitempty" schema:"enum=@pooler"`
}

ConnectionConfig is one way to reach a database: an endpoint and account.

type ConnectionSpec added in v0.1.13 

type ConnectionSpec struct {
	DSN    *string `yaml:"dsn,omitempty" json:"dsn,omitempty"`
	Role   *string `yaml:"role,omitempty" json:"role,omitempty"`
	Pooler *string `yaml:"pooler,omitempty" json:"pooler,omitempty"`
}

ConnectionSpec is a ConnectionConfig as written: a nil field was not.

type Connections added in v0.1.11 

type Connections map[string]ConnectionConfig

Connections are a database's connections by name.

type CostConfig 

type CostConfig struct {
	Enabled             *bool         `yaml:"enabled,omitempty"           json:"enabled,omitempty"`
	SoftScore           int           `yaml:"softScore"                   json:"softScore" schema:"min=0,max=100"`
	HardScore           int           `yaml:"hardScore"                   json:"hardScore" schema:"min=0,max=100"`
	MaxRows             int64         `yaml:"maxRows"                     json:"maxRows" schema:"min=1"`
	MaxBytes            int64         `yaml:"maxBytes"                    json:"maxBytes" schema:"min=1"`
	MaxINListSize       int           `yaml:"maxINListSize"               json:"maxINListSize" schema:"min=1"`
	MaxFilterConditions int           `yaml:"maxFilterConditions"         json:"maxFilterConditions" schema:"min=1"`
	MaxGroupByFields    int           `yaml:"maxGroupByFields"            json:"maxGroupByFields" schema:"min=1"`
	MaxAggregates       int           `yaml:"maxAggregates"               json:"maxAggregates" schema:"min=1"`
	MaxExpand           int           `yaml:"maxExpand"                   json:"maxExpand" schema:"min=1"`
	MaxProcedureRows    int64         `yaml:"maxProcedureRows"            json:"maxProcedureRows" schema:"min=1"`
	RejectFullScan      bool          `yaml:"rejectFullScan"              json:"rejectFullScan"`
	FullScanMaxRows     int64         `yaml:"fullScanMaxRows"             json:"fullScanMaxRows" schema:"min=0"`
	WhitelistPKPoint    bool          `yaml:"whitelistPKPoint"            json:"whitelistPKPoint"`
	RequirePKForWrite   *bool         `yaml:"requirePKForWrite,omitempty" json:"requirePKForWrite,omitempty"`
	RequireKnownScan    bool          `yaml:"requireKnownScan"            json:"requireKnownScan"`
	RequireFreshStats   bool          `yaml:"requireFreshStats"           json:"requireFreshStats"`
	QueryTimeout        time.Duration `yaml:"queryTimeout"                json:"queryTimeout" schema:"min=0"`
	AllowTemplates      []string      `yaml:"allowTemplates"              json:"allowTemplates"`
	RejectTemplates     []string      `yaml:"rejectTemplates"             json:"rejectTemplates"`
	AQE                 AQEConfig     `yaml:"aqe"                         json:"aqe"`
	// contains filtered or unexported fields
}

CostConfig configures the defense-in-depth cost gate. SoftScore/HardScore are the 0-100 normalized thresholds (from cost.ScorePlan) for soft/hard reject.

func (CostConfig) EnabledOrDefault 

func (c CostConfig) EnabledOrDefault() bool

EnabledOrDefault reports whether cost protection is on; nil means default true. A pointer preserves an explicit enabled: false through YAML decoding.

func (CostConfig) RequirePKForWriteOrDefault 

func (c CostConfig) RequirePKForWriteOrDefault() bool

RequirePKForWriteOrDefault reports whether writes must be primary-key scoped. A nil setting defaults to true (safe): a non-point UPDATE/DELETE is rejected unless explicitly allowed via allowTemplates.

func (CostConfig) Threshold added in v0.1.13 

func (c CostConfig) Threshold() cost.Threshold

Threshold is the cost gate's threshold the configuration sets, before the datasource and dialect it applies to are named.

type CostSpec added in v0.1.13 

type CostSpec struct {
	Enabled             *bool          `yaml:"enabled,omitempty" json:"enabled,omitempty"`
	SoftScore           *int           `yaml:"softScore,omitempty" json:"softScore,omitempty"`
	HardScore           *int           `yaml:"hardScore,omitempty" json:"hardScore,omitempty"`
	MaxRows             *int64         `yaml:"maxRows,omitempty" json:"maxRows,omitempty"`
	MaxBytes            *int64         `yaml:"maxBytes,omitempty" json:"maxBytes,omitempty"`
	MaxINListSize       *int           `yaml:"maxINListSize,omitempty" json:"maxINListSize,omitempty"`
	MaxFilterConditions *int           `yaml:"maxFilterConditions,omitempty" json:"maxFilterConditions,omitempty"`
	MaxGroupByFields    *int           `yaml:"maxGroupByFields,omitempty" json:"maxGroupByFields,omitempty"`
	MaxAggregates       *int           `yaml:"maxAggregates,omitempty" json:"maxAggregates,omitempty"`
	MaxExpand           *int           `yaml:"maxExpand,omitempty" json:"maxExpand,omitempty"`
	MaxProcedureRows    *int64         `yaml:"maxProcedureRows,omitempty" json:"maxProcedureRows,omitempty"`
	RejectFullScan      *bool          `yaml:"rejectFullScan,omitempty" json:"rejectFullScan,omitempty"`
	FullScanMaxRows     *int64         `yaml:"fullScanMaxRows,omitempty" json:"fullScanMaxRows,omitempty"`
	WhitelistPKPoint    *bool          `yaml:"whitelistPKPoint,omitempty" json:"whitelistPKPoint,omitempty"`
	RequirePKForWrite   *bool          `yaml:"requirePKForWrite,omitempty" json:"requirePKForWrite,omitempty"`
	RequireKnownScan    *bool          `yaml:"requireKnownScan,omitempty" json:"requireKnownScan,omitempty"`
	RequireFreshStats   *bool          `yaml:"requireFreshStats,omitempty" json:"requireFreshStats,omitempty"`
	QueryTimeout        *time.Duration `yaml:"queryTimeout,omitempty" json:"queryTimeout,omitempty"`
	AllowTemplates      List[string]   `yaml:"allowTemplates,omitempty" json:"allowTemplates,omitempty"`
	RejectTemplates     List[string]   `yaml:"rejectTemplates,omitempty" json:"rejectTemplates,omitempty"`
	AQE                 *AQESpec       `yaml:"aqe,omitempty" json:"aqe,omitempty"`
}

CostSpec is a CostConfig as written: a nil field was not.

type DatabaseConfig 

type DatabaseConfig struct {
	Driver      string        `yaml:"driver"                json:"driver" schema:"required,pattern=@driver"`
	DSN         string        `yaml:"dsn,omitempty"         json:"dsn,omitempty"`
	Connections Connections   `yaml:"connections,omitempty" json:"connections,omitempty" schema:"keys=@accessName"`
	Routing     RoutingConfig `yaml:"routing,omitempty"     json:"routing,omitempty"`
	// ReadAfterWrite routes a session's reads to the write connection for
	// this long after it writes, so it reads its own writes on a replica.
	ReadAfterWrite time.Duration `yaml:"readAfterWrite,omitempty" json:"readAfterWrite,omitempty" schema:"min=0"`
}

DatabaseConfig is one database (a datasource): one connection given by DSN, or several connections, such as accounts with different privileges or read replicas, with Routing choosing one per kind of action. DSNs may contain ${ENV} or ${file:/path} placeholders resolved by x/bootstrap.

func (DatabaseConfig) ConnectionsOrDSN added in v0.1.11 

func (d DatabaseConfig) ConnectionsOrDSN() Connections

ConnectionsOrDSN returns the database's connections: the DSN shorthand as one primary connection named DefaultConnection, or Connections. A configuration built in code may hold either until ApplyDefaults.

func (DatabaseConfig) Route added in v0.1.11 

func (d DatabaseConfig) Route() RoutingConfig

Route returns the connections for reads, writes and procedure calls; a single connection without routing serves every route.

type DatabaseSpec added in v0.1.13 

type DatabaseSpec struct {
	Driver         *string                     `yaml:"driver,omitempty" json:"driver,omitempty"`
	DSN            *string                     `yaml:"dsn,omitempty" json:"dsn,omitempty"`
	Connections    Map[string, ConnectionSpec] `yaml:"connections,omitempty" json:"connections,omitempty"`
	Routing        *RoutingSpec                `yaml:"routing,omitempty" json:"routing,omitempty"`
	ReadAfterWrite *time.Duration              `yaml:"readAfterWrite,omitempty" json:"readAfterWrite,omitempty"`
}

DatabaseSpec is a DatabaseConfig as written: a nil field was not.

type EntityConfig 

type EntityConfig struct {
	Name          string                    `yaml:"name" json:"name" schema:"required,minLength=1,pattern=@pathSegment"`
	Source        string                    `yaml:"source,omitempty"        json:"source,omitempty"`
	DataSource    string                    `yaml:"datasource,omitempty"    json:"datasource,omitempty"`
	Schema        string                    `yaml:"schema,omitempty" json:"schema,omitempty" schema:"pattern=@pathSegment"`
	Kind          string                    `yaml:"kind,omitempty" json:"kind,omitempty" schema:"enum=@entityKind"`
	Description   string                    `yaml:"description,omitempty"   json:"description,omitempty"`
	PrimaryKey    []string                  `yaml:"primaryKey,omitempty"    json:"primaryKey,omitempty"`
	UniqueKeys    [][]string                `yaml:"uniqueKeys,omitempty"    json:"uniqueKeys,omitempty"`
	Fields        []FieldConfig             `yaml:"fields,omitempty"        json:"fields,omitempty"`
	Roles         RoleConfig                `yaml:"roles,omitempty"         json:"roles,omitempty"`
	FieldACL      map[string]FieldACLConfig `yaml:"fieldACL,omitempty"      json:"fieldACL,omitempty"`
	MCP           MCPFlags                  `yaml:"mcp"                     json:"mcp"`
	RowPolicies   RowPolicies               `yaml:"rowPolicies,omitempty"   json:"rowPolicies,omitempty"`
	Relationships []RelationshipConfig      `yaml:"relationships,omitempty" json:"relationships,omitempty"`
	// TenantPolicy is ANDed for every principal and never merged across grants.
	TenantPolicy FilterConfig `yaml:"tenantPolicy,omitempty"  json:"tenantPolicy,omitempty"`
	// Params is the ordered formal-parameter list for a procedure entity, bound
	// positionally by execute_entity. Required for procedures.
	Params []string `yaml:"params,omitempty"        json:"params,omitempty"`
	// Affects lists the entities a procedure writes, for cache invalidation;
	// empty invalidates every cached read of its datasource.
	Affects []string `yaml:"affects,omitempty"       json:"affects,omitempty"`
	// AllowCascade admits deletes and key updates that foreign keys cascade
	// to other relations without the caller's permissions on them.
	AllowCascade bool `yaml:"allowCascade,omitempty"  json:"allowCascade,omitempty"`
}

EntityConfig is the configuration view of one entity. Kind is table, view or procedure.

func (EntityConfig) DatasourceName added in v0.1.11 

func (e EntityConfig) DatasourceName() string

DatasourceName is the entity's datasource: DataSource, or "default" (the single database section) when empty.

func (EntityConfig) ID added in v0.1.12 

func (e EntityConfig) ID() string

ID is the canonical identity of the entity (see entity.ID).

func (EntityConfig) PhysicalSource added in v0.1.11 

func (e EntityConfig) PhysicalSource() string

PhysicalSource is the table or procedure the entity reads: Source, or the entity name when Source is empty.

type EntityRefs added in v0.1.12 

type EntityRefs struct {
	// contains filtered or unexported fields
}

EntityRefs resolves entity references the way the gateway does (see entity.Registry.Match): an entity's ID names it, otherwise any of its entity.ReferencesOf. A configuration's references must each name exactly one entity, so adding an entity can never silently change what an existing reference names: the configuration fails validation instead.

func NewEntityRefs added in v0.1.12 

func NewEntityRefs(entities []EntityConfig) EntityRefs

NewEntityRefs indexes entities; the last of several with one ID wins.

func (EntityRefs) Resolve added in v0.1.12 

func (r EntityRefs) Resolve(ref string) (EntityConfig, error)

Resolve returns the one entity ref names.

type EntitySpec added in v0.1.13 

type EntitySpec struct {
	Name          *string                     `yaml:"name,omitempty" json:"name,omitempty"`
	Source        *string                     `yaml:"source,omitempty" json:"source,omitempty"`
	DataSource    *string                     `yaml:"datasource,omitempty" json:"datasource,omitempty"`
	Schema        *string                     `yaml:"schema,omitempty" json:"schema,omitempty"`
	Kind          *string                     `yaml:"kind,omitempty" json:"kind,omitempty"`
	Description   *string                     `yaml:"description,omitempty" json:"description,omitempty"`
	PrimaryKey    List[string]                `yaml:"primaryKey,omitempty" json:"primaryKey,omitempty"`
	UniqueKeys    List[[]string]              `yaml:"uniqueKeys,omitempty" json:"uniqueKeys,omitempty"`
	Fields        List[FieldSpec]             `yaml:"fields,omitempty" json:"fields,omitempty"`
	Roles         *RoleSpec                   `yaml:"roles,omitempty" json:"roles,omitempty"`
	FieldACL      Map[string, FieldACLSpec]   `yaml:"fieldACL,omitempty" json:"fieldACL,omitempty"`
	MCP           *MCPFlagsSpec               `yaml:"mcp,omitempty" json:"mcp,omitempty"`
	RowPolicies   Map[string, map[string]any] `yaml:"rowPolicies,omitempty" json:"rowPolicies,omitempty"`
	Relationships List[RelationshipSpec]      `yaml:"relationships,omitempty" json:"relationships,omitempty"`
	TenantPolicy  map[string]any              `yaml:"tenantPolicy,omitempty" json:"tenantPolicy,omitempty"`
	Params        List[string]                `yaml:"params,omitempty" json:"params,omitempty"`
	Affects       List[string]                `yaml:"affects,omitempty" json:"affects,omitempty"`
	AllowCascade  *bool                       `yaml:"allowCascade,omitempty" json:"allowCascade,omitempty"`
}

EntitySpec is a EntityConfig as written: a nil field was not.

type ExecutionConfig added in v0.1.13 

type ExecutionConfig struct {
	Admin      LaneConfig `yaml:"admin"      json:"admin"`
	Scan       LaneConfig `yaml:"scan"       json:"scan"`
	Background LaneConfig `yaml:"background" json:"background"`
}

ExecutionConfig bounds the lanes of the execution bus other than tool calls, which rateLimit bounds. All lanes share rateLimit.ioPool; these lanes together hold at most half of it.

type ExecutionSpec added in v0.1.13 

type ExecutionSpec struct {
	Admin      *LaneSpec `yaml:"admin,omitempty" json:"admin,omitempty"`
	Scan       *LaneSpec `yaml:"scan,omitempty" json:"scan,omitempty"`
	Background *LaneSpec `yaml:"background,omitempty" json:"background,omitempty"`
}

ExecutionSpec is a ExecutionConfig as written: a nil field was not.

type FieldACLConfig 

type FieldACLConfig struct {
	Read  []string `yaml:"read,omitempty"      json:"read,omitempty"`
	Write []string `yaml:"write,omitempty" json:"write,omitempty"`
}

FieldACLConfig restricts one role to named readable and writable fields. Omitting a role leaves existing entity-level authorization behavior intact.

type FieldACLSpec added in v0.1.13 

type FieldACLSpec struct {
	Read  List[string] `yaml:"read,omitempty" json:"read,omitempty"`
	Write List[string] `yaml:"write,omitempty" json:"write,omitempty"`
}

FieldACLSpec is a FieldACLConfig as written: a nil field was not.

type FieldConfig 

type FieldConfig struct {
	Name        string `yaml:"name"        json:"name" schema:"required,minLength=1"`
	Alias       string `yaml:"alias,omitempty"       json:"alias,omitempty"`
	Description string `yaml:"description,omitempty"   json:"description,omitempty"`
	Mask        string `yaml:"mask,omitempty"        json:"mask,omitempty" schema:"enum=@maskRule"`
	Exclude     bool   `yaml:"exclude,omitempty"     json:"exclude,omitempty"`
}

FieldConfig configures one column.

type FieldSpec added in v0.1.13 

type FieldSpec struct {
	Name        *string `yaml:"name,omitempty" json:"name,omitempty"`
	Alias       *string `yaml:"alias,omitempty" json:"alias,omitempty"`
	Description *string `yaml:"description,omitempty" json:"description,omitempty"`
	Mask        *string `yaml:"mask,omitempty" json:"mask,omitempty"`
	Exclude     *bool   `yaml:"exclude,omitempty" json:"exclude,omitempty"`
}

FieldSpec is a FieldConfig as written: a nil field was not.

type FilterConfig 

type FilterConfig = map[string]any

FilterConfig is a declarative filter (JSON object) for row-level policies, converted to a relalg.Predicate by x/bootstrap.

func FilterOf added in v0.1.13 

func FilterOf(p relalg.Predicate) FilterConfig

FilterOf renders a predicate in the filter shape ParseFilter reads; nil for no predicate.

type GrantConfig added in v0.1.11 

type GrantConfig struct {
	Entity  string          `yaml:"entity"           json:"entity" schema:"required,minLength=1"`
	Actions []string        `yaml:"actions"          json:"actions" schema:"required,minItems=1,enum=@grantAction"`
	Fields  *FieldACLConfig `yaml:"fields,omitempty" json:"fields,omitempty"`
	Rows    FilterConfig    `yaml:"rows,omitempty"   json:"rows,omitempty"`
}

GrantConfig is one entity permission. A nil Fields grants every visible field; a present Fields behaves like a fieldACL entry. Empty Rows grants all rows.

type GrantSpec added in v0.1.13 

type GrantSpec struct {
	Entity  *string        `yaml:"entity,omitempty" json:"entity,omitempty"`
	Actions List[string]   `yaml:"actions,omitempty" json:"actions,omitempty"`
	Fields  *FieldACLSpec  `yaml:"fields,omitempty" json:"fields,omitempty"`
	Rows    map[string]any `yaml:"rows,omitempty" json:"rows,omitempty"`
}

GrantSpec is a GrantConfig as written: a nil field was not.

type LaneConfig added in v0.1.13 

type LaneConfig struct {
	MaxConcurrent int `yaml:"maxConcurrent" json:"maxConcurrent" schema:"min=0"`
	MaxQueue      int `yaml:"maxQueue"      json:"maxQueue" schema:"min=0"`
}

LaneConfig bounds one lane: work running at once and work waiting.

type LaneSpec added in v0.1.13 

type LaneSpec struct {
	MaxConcurrent *int `yaml:"maxConcurrent,omitempty" json:"maxConcurrent,omitempty"`
	MaxQueue      *int `yaml:"maxQueue,omitempty" json:"maxQueue,omitempty"`
}

LaneSpec is a LaneConfig as written: a nil field was not.

type List added in v0.1.13 

type List[T any] []T

List is a list of a Spec: nil when unset, and kept when set empty, so an empty list written stays written.

func (List[T]) IsZero added in v0.1.13 

func (l List[T]) IsZero() bool

IsZero reports an unset list (omitted when encoded), not an empty one.

type MCPFlags 

type MCPFlags struct {
	DMLTools         bool `yaml:"dmlTools"                   json:"dmlTools"`
	CustomTool       bool `yaml:"customTool,omitempty"       json:"customTool,omitempty"`
	TrustedProcedure bool `yaml:"trustedProcedure,omitempty" json:"trustedProcedure,omitempty"`
	// contains filtered or unexported fields
}

MCPFlags controls entity participation in MCP. DMLTools defaults on: a Spec that does not set it resolves with dmlToolsSet false, and ApplyDefaults turns it on.

type MCPFlagsSpec added in v0.1.13 

type MCPFlagsSpec struct {
	DMLTools         *bool `yaml:"dmlTools,omitempty" json:"dmlTools,omitempty"`
	CustomTool       *bool `yaml:"customTool,omitempty" json:"customTool,omitempty"`
	TrustedProcedure *bool `yaml:"trustedProcedure,omitempty" json:"trustedProcedure,omitempty"`
}

MCPFlagsSpec is a MCPFlags as written: a nil field was not.

type Map added in v0.1.13 

type Map[K comparable, V any] map[K]V

Map is a map of a Spec: nil when unset, and kept when set empty.

func (Map[K, V]) IsZero added in v0.1.13 

func (m Map[K, V]) IsZero() bool

IsZero reports an unset map (omitted when encoded), not an empty one.

type MaskConfig 

type MaskConfig struct {
	Enabled *bool `yaml:"enabled,omitempty"           json:"enabled,omitempty"`
}

MaskConfig controls field masking. Enabled defaults to true when unset.

func (MaskConfig) EnabledOrDefault 

func (c MaskConfig) EnabledOrDefault() bool

EnabledOrDefault reports whether masking is on; nil means default true.

type MaskSpec added in v0.1.13 

type MaskSpec struct {
	Enabled *bool `yaml:"enabled,omitempty" json:"enabled,omitempty"`
}

MaskSpec is a MaskConfig as written: a nil field was not.

type RateLimitConfig 

type RateLimitConfig struct {
	Enabled          *bool         `yaml:"enabled,omitempty"           json:"enabled,omitempty"`
	RPS              float64       `yaml:"rps"               json:"rps" schema:"min=0"`
	MaxInflight      int           `yaml:"maxInflight"       json:"maxInflight" schema:"min=0"`
	IOPool           int           `yaml:"ioPool"            json:"ioPool" schema:"min=0"`
	MinConcurrency   int           `yaml:"minConcurrency"    json:"minConcurrency" schema:"min=0"`
	RTTThreshold     time.Duration `yaml:"rttThreshold"      json:"rttThreshold" schema:"min=0"`
	BreakerThreshold int           `yaml:"breakerThreshold"  json:"breakerThreshold" schema:"min=0"`
	BreakerCooldown  time.Duration `yaml:"breakerCooldown"   json:"breakerCooldown" schema:"min=0"`
	ConnMaxIdleTime  time.Duration `yaml:"connMaxIdleTime"   json:"connMaxIdleTime" schema:"min=0"`
	ConnMaxLifetime  time.Duration `yaml:"connMaxLifetime"   json:"connMaxLifetime" schema:"min=0"`
	MaxResultMemory  int64         `yaml:"maxResultMemory"   json:"maxResultMemory" schema:"min=0"`
}

RateLimitConfig configures the engine's concurrency and rate limits.

func (RateLimitConfig) EnabledOrDefault 

func (c RateLimitConfig) EnabledOrDefault() bool

EnabledOrDefault reports whether rate limiting is on; nil means default true.

type RateLimitSpec added in v0.1.13 

type RateLimitSpec struct {
	Enabled          *bool          `yaml:"enabled,omitempty" json:"enabled,omitempty"`
	RPS              *float64       `yaml:"rps,omitempty" json:"rps,omitempty"`
	MaxInflight      *int           `yaml:"maxInflight,omitempty" json:"maxInflight,omitempty"`
	IOPool           *int           `yaml:"ioPool,omitempty" json:"ioPool,omitempty"`
	MinConcurrency   *int           `yaml:"minConcurrency,omitempty" json:"minConcurrency,omitempty"`
	RTTThreshold     *time.Duration `yaml:"rttThreshold,omitempty" json:"rttThreshold,omitempty"`
	BreakerThreshold *int           `yaml:"breakerThreshold,omitempty" json:"breakerThreshold,omitempty"`
	BreakerCooldown  *time.Duration `yaml:"breakerCooldown,omitempty" json:"breakerCooldown,omitempty"`
	ConnMaxIdleTime  *time.Duration `yaml:"connMaxIdleTime,omitempty" json:"connMaxIdleTime,omitempty"`
	ConnMaxLifetime  *time.Duration `yaml:"connMaxLifetime,omitempty" json:"connMaxLifetime,omitempty"`
	MaxResultMemory  *int64         `yaml:"maxResultMemory,omitempty" json:"maxResultMemory,omitempty"`
}

RateLimitSpec is a RateLimitConfig as written: a nil field was not.

type RelationshipConfig 

type RelationshipConfig struct {
	Name        string            `yaml:"name"        json:"name" schema:"required,minLength=1"`
	Target      string            `yaml:"target"      json:"target" schema:"required,minLength=1"`
	Cardinality string            `yaml:"cardinality" json:"cardinality" schema:"required,enum=@cardinality"`
	JoinOn      map[string]string `yaml:"joinOn"      json:"joinOn" schema:"required"`
}

RelationshipConfig configures a same-data-source batch expansion.

type RelationshipSpec added in v0.1.13 

type RelationshipSpec struct {
	Name        *string             `yaml:"name,omitempty" json:"name,omitempty"`
	Target      *string             `yaml:"target,omitempty" json:"target,omitempty"`
	Cardinality *string             `yaml:"cardinality,omitempty" json:"cardinality,omitempty"`
	JoinOn      Map[string, string] `yaml:"joinOn,omitempty" json:"joinOn,omitempty"`
}

RelationshipSpec is a RelationshipConfig as written: a nil field was not.

type RoleConfig 

type RoleConfig struct {
	Read      []string `yaml:"read,omitempty"      json:"read,omitempty"`
	Create    []string `yaml:"create,omitempty"    json:"create,omitempty"`
	Update    []string `yaml:"update,omitempty"    json:"update,omitempty"`
	Delete    []string `yaml:"delete,omitempty"    json:"delete,omitempty"`
	Execute   []string `yaml:"execute,omitempty"   json:"execute,omitempty"`
	Aggregate []string `yaml:"aggregate,omitempty" json:"aggregate,omitempty"`
}

RoleConfig lists allowed roles per action.

type RoleDefinition added in v0.1.11 

type RoleDefinition struct {
	Description string        `yaml:"description,omitempty"   json:"description,omitempty"`
	Grants      []GrantConfig `yaml:"grants,omitempty"      json:"grants,omitempty"`
	// Permissions holds system permissions such as "sql:execute@<datasource>".
	// None is supported yet; any value fails validation.
	Permissions []string `yaml:"permissions,omitempty" json:"permissions,omitempty"`
}

RoleDefinition is a named set of grants declared at the top level. Entity level roles/fieldACL/rowPolicies remain valid and merge into the same role.

type RoleDefinitionSpec added in v0.1.13 

type RoleDefinitionSpec struct {
	Description *string         `yaml:"description,omitempty" json:"description,omitempty"`
	Grants      List[GrantSpec] `yaml:"grants,omitempty" json:"grants,omitempty"`
	Permissions List[string]    `yaml:"permissions,omitempty" json:"permissions,omitempty"`
}

RoleDefinitionSpec is a RoleDefinition as written: a nil field was not.

type RoleSpec added in v0.1.13 

type RoleSpec struct {
	Read      List[string] `yaml:"read,omitempty" json:"read,omitempty"`
	Create    List[string] `yaml:"create,omitempty" json:"create,omitempty"`
	Update    List[string] `yaml:"update,omitempty" json:"update,omitempty"`
	Delete    List[string] `yaml:"delete,omitempty" json:"delete,omitempty"`
	Execute   List[string] `yaml:"execute,omitempty" json:"execute,omitempty"`
	Aggregate List[string] `yaml:"aggregate,omitempty" json:"aggregate,omitempty"`
}

RoleSpec is a RoleConfig as written: a nil field was not.

type RoutingConfig added in v0.1.11 

type RoutingConfig struct {
	Read    string `yaml:"read,omitempty"    json:"read,omitempty"`
	Write   string `yaml:"write,omitempty"   json:"write,omitempty"`
	Execute string `yaml:"execute,omitempty" json:"execute,omitempty"`
}

RoutingConfig names the connection each kind of action uses: Read for reads, aggregates, EXPLAIN and read-only transactions; Write for creates, updates, deletes and read-write transactions; Execute for procedures.

type RoutingSpec added in v0.1.13 

type RoutingSpec struct {
	Read    *string `yaml:"read,omitempty" json:"read,omitempty"`
	Write   *string `yaml:"write,omitempty" json:"write,omitempty"`
	Execute *string `yaml:"execute,omitempty" json:"execute,omitempty"`
}

RoutingSpec is a RoutingConfig as written: a nil field was not.

type RowPolicies 

type RowPolicies map[string]FilterConfig

RowPolicies maps a role name to its row-level filter.

type Rule added in v0.1.11 

type Rule struct {
	Required, Restart, NoDefault bool
	// Min and Max are numbers, or Go durations on duration fields.
	Min, Max            string
	MinLength, MinItems int
	Enum                []string
	// Pattern and Keys are regular expressions; the names are their keys in
	// the named pattern table.
	Pattern, Keys         string
	PatternName, KeysName string
}

Rule is the parsed `schema` tag of one field.

func ParseRule added in v0.1.11 

func ParseRule(tag string) (Rule, error)

ParseRule parses a `schema` struct tag.

type SecretsConfig 

type SecretsConfig struct {
	AllowedRoots []string `yaml:"allowedRoots" json:"allowedRoots"`
}

SecretsConfig restricts ${file:...} expansion to explicitly trusted roots.

type SecretsSpec added in v0.1.13 

type SecretsSpec struct {
	AllowedRoots List[string] `yaml:"allowedRoots,omitempty" json:"allowedRoots,omitempty"`
}

SecretsSpec is a SecretsConfig as written: a nil field was not.

type ServerConfig 

type ServerConfig struct {
	Transport string `yaml:"transport" json:"transport" schema:"enum=@transport,restart"`
	// Addr is the HTTP listen address.
	Addr string `yaml:"addr" json:"addr" schema:"restart"`
	// PathPrefix is the path a gateway serves this service under and strips
	// from requests, such as /sql-mcp-server; the console's pages, cookie and
	// redirects carry it, so the gateway need not rewrite responses.
	PathPrefix string `yaml:"pathPrefix,omitempty" json:"pathPrefix,omitempty" schema:"pattern=@pathPrefix,restart"`
	// PublicURL is the MCP endpoint as clients reach it, through any proxy;
	// the console builds client configuration with it.
	PublicURL string `yaml:"publicURL,omitempty" json:"publicURL,omitempty" schema:"pattern=@httpURL"`
	// Role is the runtime role; the --role flag overrides it.
	Role string `yaml:"role" json:"role"`
	// Auth configures HTTP transport authentication.
	Auth    AuthConfig    `yaml:"auth"    json:"auth"`
	Secrets SecretsConfig `yaml:"secrets" json:"secrets"`

	// User is the default user for requests without a user identity; it takes
	// precedence over Role and may be overridden by the --user flag.
	User string `yaml:"user,omitempty" json:"user,omitempty"`
}

ServerConfig holds transport and role settings.

type ServerSpec added in v0.1.13 

type ServerSpec struct {
	Transport  *string      `yaml:"transport,omitempty" json:"transport,omitempty"`
	Addr       *string      `yaml:"addr,omitempty" json:"addr,omitempty"`
	PathPrefix *string      `yaml:"pathPrefix,omitempty" json:"pathPrefix,omitempty"`
	PublicURL  *string      `yaml:"publicURL,omitempty" json:"publicURL,omitempty"`
	Role       *string      `yaml:"role,omitempty" json:"role,omitempty"`
	Auth       *AuthSpec    `yaml:"auth,omitempty" json:"auth,omitempty"`
	Secrets    *SecretsSpec `yaml:"secrets,omitempty" json:"secrets,omitempty"`
	User       *string      `yaml:"user,omitempty" json:"user,omitempty"`
}

ServerSpec is a ServerConfig as written: a nil field was not.

type Spec added in v0.1.13 

type Spec struct {
	Version      *string                         `yaml:"version,omitempty" json:"version,omitempty"`
	Server       *ServerSpec                     `yaml:"server,omitempty" json:"server,omitempty"`
	Database     *DatabaseSpec                   `yaml:"database,omitempty" json:"database,omitempty"`
	Databases    Map[string, DatabaseSpec]       `yaml:"databases,omitempty" json:"databases,omitempty"`
	Entities     List[EntitySpec]                `yaml:"entities,omitempty" json:"entities,omitempty"`
	Roles        Map[string, RoleDefinitionSpec] `yaml:"roles,omitempty" json:"roles,omitempty"`
	Users        Map[string, UserSpec]           `yaml:"users,omitempty" json:"users,omitempty"`
	Tools        *ToolFlagsSpec                  `yaml:"tools,omitempty" json:"tools,omitempty"`
	Cost         *CostSpec                       `yaml:"cost,omitempty" json:"cost,omitempty"`
	Budget       *BudgetSpec                     `yaml:"budget,omitempty" json:"budget,omitempty"`
	Cache        *CacheSpec                      `yaml:"cache,omitempty" json:"cache,omitempty"`
	RateLimit    *RateLimitSpec                  `yaml:"rateLimit,omitempty" json:"rateLimit,omitempty"`
	Mask         *MaskSpec                       `yaml:"mask,omitempty" json:"mask,omitempty"`
	Audit        *AuditSpec                      `yaml:"audit,omitempty" json:"audit,omitempty"`
	Transactions *TransactionSpec                `yaml:"transactions,omitempty" json:"transactions,omitempty"`
	Execution    *ExecutionSpec                  `yaml:"execution,omitempty" json:"execution,omitempty"`
}

Spec is a Config as written: a nil field was not.

func SpecOf added in v0.1.13 

func SpecOf(c *Config) *Spec

SpecOf is the Spec of a configuration built in code, where a zero field means unset (as before ApplyDefaults), or of one in effect, its defaults then written out.

func (*Spec) Canonical added in v0.1.13 

func (s *Spec) Canonical()

Canonical unsets what spec writes but means unset: a zero where the configuration omits zero (older encodings wrote some, such as an empty schema). Decoding canonicalizes, so two payloads that say the same read the same.

type TLSConfig 

type TLSConfig struct {
	Cert     string `yaml:"cert"     json:"cert"`
	Key      string `yaml:"key"      json:"key"`
	ClientCA string `yaml:"clientCA" json:"clientCA"`
}

TLSConfig configures TLS/mTLS for the HTTP transport. Cert+Key enable TLS; setting ClientCA additionally requires and verifies a client certificate.

type TLSSpec added in v0.1.13 

type TLSSpec struct {
	Cert     *string `yaml:"cert,omitempty" json:"cert,omitempty"`
	Key      *string `yaml:"key,omitempty" json:"key,omitempty"`
	ClientCA *string `yaml:"clientCA,omitempty" json:"clientCA,omitempty"`
}

TLSSpec is a TLSConfig as written: a nil field was not.

type ToolFlags 

type ToolFlags struct {
	DescribeEntities    bool `yaml:"describeEntities"    json:"describeEntities"`
	ReadRecords         bool `yaml:"readRecords"         json:"readRecords"`
	CreateRecord        bool `yaml:"createRecord"        json:"createRecord"`
	UpdateRecord        bool `yaml:"updateRecord"        json:"updateRecord"`
	DeleteRecord        bool `yaml:"deleteRecord"        json:"deleteRecord"`
	ExecuteEntity       bool `yaml:"executeEntity"       json:"executeEntity"`
	AggregateRecords    bool `yaml:"aggregateRecords"    json:"aggregateRecords"`
	BeginTransaction    bool `yaml:"beginTransaction"    json:"beginTransaction"`
	CommitTransaction   bool `yaml:"commitTransaction"   json:"commitTransaction"`
	RollbackTransaction bool `yaml:"rollbackTransaction" json:"rollbackTransaction"`
	// contains filtered or unexported fields
}

ToolFlags toggles each DML tool. present records that the tools section was written (see Spec), so an explicit all-false object differs from omission.

func DefaultToolFlags 

func DefaultToolFlags() ToolFlags

DefaultToolFlags returns the safe default tool set: all tools enabled except delete_record, which is off by default to prevent accidental data loss.

type ToolFlagsSpec added in v0.1.13 

type ToolFlagsSpec struct {
	DescribeEntities    *bool `yaml:"describeEntities,omitempty" json:"describeEntities,omitempty"`
	ReadRecords         *bool `yaml:"readRecords,omitempty" json:"readRecords,omitempty"`
	CreateRecord        *bool `yaml:"createRecord,omitempty" json:"createRecord,omitempty"`
	UpdateRecord        *bool `yaml:"updateRecord,omitempty" json:"updateRecord,omitempty"`
	DeleteRecord        *bool `yaml:"deleteRecord,omitempty" json:"deleteRecord,omitempty"`
	ExecuteEntity       *bool `yaml:"executeEntity,omitempty" json:"executeEntity,omitempty"`
	AggregateRecords    *bool `yaml:"aggregateRecords,omitempty" json:"aggregateRecords,omitempty"`
	BeginTransaction    *bool `yaml:"beginTransaction,omitempty" json:"beginTransaction,omitempty"`
	CommitTransaction   *bool `yaml:"commitTransaction,omitempty" json:"commitTransaction,omitempty"`
	RollbackTransaction *bool `yaml:"rollbackTransaction,omitempty" json:"rollbackTransaction,omitempty"`
}

ToolFlagsSpec is a ToolFlags as written: a nil field was not.

type TransactionConfig 

type TransactionConfig struct {
	TTL     time.Duration `yaml:"ttl"             json:"ttl" schema:"min=0"`
	MaxOpen int           `yaml:"maxOpen"         json:"maxOpen" schema:"min=0"`
	// MaxOpenPerConnection bounds the transactions holding one database
	// connection at once, so they leave queries a share of its pool.
	MaxOpenPerConnection int           `yaml:"maxOpenPerConnection" json:"maxOpenPerConnection" schema:"min=0"`
	BeginTimeout         time.Duration `yaml:"beginTimeout"    json:"beginTimeout" schema:"min=0"`
	CommitTimeout        time.Duration `yaml:"commitTimeout"   json:"commitTimeout" schema:"min=0"`
	RollbackTimeout      time.Duration `yaml:"rollbackTimeout" json:"rollbackTimeout" schema:"min=0"`
}

TransactionConfig bounds explicit transaction lifetime and cardinality.

type TransactionSpec added in v0.1.13 

type TransactionSpec struct {
	TTL                  *time.Duration `yaml:"ttl,omitempty" json:"ttl,omitempty"`
	MaxOpen              *int           `yaml:"maxOpen,omitempty" json:"maxOpen,omitempty"`
	MaxOpenPerConnection *int           `yaml:"maxOpenPerConnection,omitempty" json:"maxOpenPerConnection,omitempty"`
	BeginTimeout         *time.Duration `yaml:"beginTimeout,omitempty" json:"beginTimeout,omitempty"`
	CommitTimeout        *time.Duration `yaml:"commitTimeout,omitempty" json:"commitTimeout,omitempty"`
	RollbackTimeout      *time.Duration `yaml:"rollbackTimeout,omitempty" json:"rollbackTimeout,omitempty"`
}

TransactionSpec is a TransactionConfig as written: a nil field was not.

type UserConfig added in v0.1.11 

type UserConfig struct {
	Description string         `yaml:"description,omitempty"   json:"description,omitempty"`
	TokenHash   string         `yaml:"tokenHash,omitempty"   json:"tokenHash,omitempty" schema:"pattern=@tokenHash"`
	Roles       []string       `yaml:"roles,omitempty"       json:"roles,omitempty" schema:"pattern=@accessName"`
	Subject     map[string]any `yaml:"subject,omitempty"     json:"subject,omitempty"`
	Grants      []GrantConfig  `yaml:"grants,omitempty"      json:"grants,omitempty"`
	Permissions []string       `yaml:"permissions,omitempty" json:"permissions,omitempty"`
	Disabled    bool           `yaml:"disabled,omitempty"    json:"disabled,omitempty"`
}

UserConfig is one authenticated caller. TokenHash is "sha256:<hex>" of the bearer token; the plaintext token never appears in configuration.

type UserSpec added in v0.1.13 

type UserSpec struct {
	Description *string         `yaml:"description,omitempty" json:"description,omitempty"`
	TokenHash   *string         `yaml:"tokenHash,omitempty" json:"tokenHash,omitempty"`
	Roles       List[string]    `yaml:"roles,omitempty" json:"roles,omitempty"`
	Subject     map[string]any  `yaml:"subject,omitempty" json:"subject,omitempty"`
	Grants      List[GrantSpec] `yaml:"grants,omitempty" json:"grants,omitempty"`
	Permissions List[string]    `yaml:"permissions,omitempty" json:"permissions,omitempty"`
	Disabled    *bool           `yaml:"disabled,omitempty" json:"disabled,omitempty"`
}

UserSpec is a UserConfig as written: a nil field was not.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.