Documentation
¶
Overview ¶
Package entity defines the entity abstraction layer: configured tables, views, and procedures exposed to MCP tools, with aliases, field projection, masking, descriptions, role permissions, row-level security, and keys.
An Entity is a complete description of a Relation (Codd): attributes with domains and constraints, candidate keys, foreign keys, and role access. Registry holds an immutable set of entities keyed by logical name. RowPolicies attach a relalg.Predicate per role for row-level security, applied by rbac.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrDuplicateEntity = errors.New("entity: duplicate name")
ErrDuplicateEntity is returned by NewRegistry when two entities share a name.
var ErrEmptyName = errors.New("entity: empty name")
ErrEmptyName is returned by NewRegistry when an entity has an empty name.
Functions ¶
This section is empty.
Types ¶
type Action ¶
type Action uint8
Action names a DML operation for role permissions.
const ( // ActionRead selects records. ActionRead Action = iota // ActionCreate inserts records. ActionCreate // ActionUpdate updates records. ActionUpdate // ActionDelete deletes records. ActionDelete // ActionExecute calls a stored procedure. ActionExecute // ActionAggregate groups/aggregate-queries records. ActionAggregate )
type Attribute ¶
type Attribute struct {
Name string
Alias string
Description string
Domain Domain
Excluded bool // true removes the column from all responses (field projection)
Mask string // optional mask rule name (see mask package)
}
Attribute is one column of a relation, with projection and masking controls.
type Constraint ¶
type Constraint struct {
Kind ConstraintKind
Expr string
}
Constraint is a domain constraint.
type ConstraintKind ¶
type ConstraintKind uint8
ConstraintKind names a domain constraint.
const ( // ConstraintNotNull forbids nulls. ConstraintNotNull ConstraintKind = iota // ConstraintUnique requires uniqueness. ConstraintUnique // ConstraintCheck is an arbitrary check (Expr is informational only). ConstraintCheck // ConstraintRange bounds a numeric value (Expr is informational only). ConstraintRange )
type Domain ¶
type Domain struct {
Type string
Nullable bool
Constraints []Constraint
}
Domain is a value domain: a SQL type plus constraints. The type is informational; IR construction validates value kinds against it where it can.
type Entity ¶
type Entity struct {
Name string
Source string
DataSource string
Schema string
Description string
Kind Kind
Attributes []Attribute
Keys []Key
ForeignKeys []ForeignKey
Role RoleAccess
FieldAccess FieldAccess
MCP MCPFlags
RowPolicies RowPolicies
Relations []Relationship
// Params is the ordered list of formal parameter names for a KindProcedure
// entity. execute_entity binds a caller's named args to positional CALL
// placeholders in this exact order; a stored procedure whose params are not
// declared cannot be executed (fail-closed) since positional binding would
// otherwise be guesswork.
Params []string
}
Entity is a complete description of an exposed relation.
func (Entity) AttributeByName ¶
AttributeByName returns the attribute with the given logical name and a found flag. It matches Name or Alias.
func (Entity) PrimaryKey ¶
PrimaryKey returns the columns of the primary key, or nil if none is declared.
type FieldAccess ¶
type FieldAccess map[string]FieldPermissions
FieldAccess maps role names to field-level permissions. Absence of a role preserves entity-level authorization behavior for backwards compatibility.
type FieldPermissions ¶
FieldPermissions is one role's field-level access. Read applies to projections, filters, grouping, and aggregate inputs; Write applies to create values and update assignments.
type ForeignKey ¶
ForeignKey declares referential integrity to another relation.
type MCPFlags ¶
type MCPFlags struct {
DMLTools bool // expose the seven DML tools for this entity
CustomTool bool // register a stored procedure as a named tool
TrustedProcedure bool // procedure passed explicit DBA cost/safety review
}
MCPFlags controls how an entity participates in MCP.
type Registry ¶
type Registry struct {
// contains filtered or unexported fields
}
Registry is an immutable set of entities keyed by logical name. It holds no per-request state and is safe for concurrent use (invariant I9).
func NewRegistry ¶
NewRegistry builds a Registry from entities, rejecting empty names and duplicates. It copies the slice so callers cannot mutate the registry.
type Relationship ¶
type Relationship struct {
Name string
Target string
Cardinality string
JoinOn map[string]string // this field -> target field
}
Relationship describes a link to another entity for nested expansion.
type Resolved ¶
Resolved is a request-time view of an entity with field projection applied (excluded attributes removed). RBAC further restricts Attributes per role.
type RoleAccess ¶
RoleAccess maps each action to the roles allowed to perform it.
type RowPolicies ¶
RowPolicies maps a role name to a row-level filter predicate. The rbac package ANDs the role's predicate with the request predicate.