Documentation
¶
Index ¶
- Constants
- func OpenDatabase(connUrl string, databaseName string) (*sql.DB, error)
- type Database
- type Databases
- type DbInfo
- type DbOpener
- type DefaultGrant
- type DefaultGrantKey
- type DefaultGrants
- func (g *DefaultGrants) Create(grant DefaultGrant) (*DefaultGrant, error)
- func (g *DefaultGrants) Drop(key DefaultGrantKey) (bool, error)
- func (g *DefaultGrants) Read(key DefaultGrantKey) (*DefaultGrant, error)
- func (g *DefaultGrants) Update(key DefaultGrantKey, grant DefaultGrant) (*DefaultGrant, error)
- type FeatureName
- type Features
- type NoopRevoker
- type Publication
- type PublicationKey
- type PublicationTable
- type Publications
- type ReplicationSlot
- type ReplicationSlotKey
- type ReplicationSlots
- func (r *ReplicationSlots) Create(obj ReplicationSlot) (*ReplicationSlot, error)
- func (r *ReplicationSlots) Drop(key ReplicationSlotKey) (bool, error)
- func (r *ReplicationSlots) Read(key ReplicationSlotKey) (*ReplicationSlot, error)
- func (r *ReplicationSlots) Update(key ReplicationSlotKey, obj ReplicationSlot) (*ReplicationSlot, error)
- type Revoker
- type Role
- type RoleAttributes
- type RoleMember
- type RoleMemberKey
- type RoleMembers
- type Roles
- type SchemaPrivilege
- type SchemaPrivilegeKey
- type SchemaPrivileges
- func (r *SchemaPrivileges) Create(obj SchemaPrivilege) (*SchemaPrivilege, error)
- func (r *SchemaPrivileges) Drop(key SchemaPrivilegeKey) (bool, error)
- func (r *SchemaPrivileges) Read(key SchemaPrivilegeKey) (*SchemaPrivilege, error)
- func (r *SchemaPrivileges) Update(key SchemaPrivilegeKey, obj SchemaPrivilege) (*SchemaPrivilege, error)
- type Settings
- type SettingsReader
- type Store
- type TablePrivilege
- type TablePrivilegeKey
- type TablePrivileges
- func (t *TablePrivileges) Create(obj TablePrivilege) (*TablePrivilege, error)
- func (t *TablePrivileges) Drop(key TablePrivilegeKey) (bool, error)
- func (t *TablePrivileges) Read(key TablePrivilegeKey) (*TablePrivilege, error)
- func (t *TablePrivileges) Update(key TablePrivilegeKey, obj TablePrivilege) (*TablePrivilege, error)
- type TempGrant
- type TempGrants
Constants ¶
const AllSchemas = "*"
AllSchemas selects every non-system schema in the database
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Database ¶
type Database struct {
Name string `json:"name"`
Owner string `json:"owner"`
Template string `json:"template"`
Encoding string `json:"encoding"`
Collation string `json:"collation"`
LcCtype string `json:"lcCtype"`
TablespaceName string `json:"tablespaceName"`
ConnectionLimit int `json:"connectionLimit"`
IsTemplate bool `json:"isTemplate"`
DisableConnections bool `json:"disableConnections"`
// Do not error if trying to create a database that already exists
// Instead, read the existing and return
UseExisting bool `json:"useExisting"`
}
type Databases ¶ added in v0.5.0
type Databases struct {
DbOpener DbOpener
}
type DbInfo ¶
type DefaultGrant ¶ added in v0.5.0
type DefaultGrant struct {
Id string `json:"id"`
Role string `json:"role"`
Target string `json:"target"`
Database string `json:"database"`
}
DefaultGrant defines a template of privileges that Role will be granted to Database This grants default privileges on schema objects created by Role in Database to Target
func (DefaultGrant) Key ¶ added in v0.5.0
func (g DefaultGrant) Key() DefaultGrantKey
func (*DefaultGrant) SetId ¶ added in v0.5.0
func (g *DefaultGrant) SetId()
type DefaultGrantKey ¶ added in v0.5.0
type DefaultGrants ¶ added in v0.5.0
type DefaultGrants struct {
DbOpener DbOpener
}
func (*DefaultGrants) Create ¶ added in v0.5.0
func (g *DefaultGrants) Create(grant DefaultGrant) (*DefaultGrant, error)
func (*DefaultGrants) Drop ¶ added in v0.5.0
func (g *DefaultGrants) Drop(key DefaultGrantKey) (bool, error)
func (*DefaultGrants) Read ¶ added in v0.5.0
func (g *DefaultGrants) Read(key DefaultGrantKey) (*DefaultGrant, error)
func (*DefaultGrants) Update ¶ added in v0.5.0
func (g *DefaultGrants) Update(key DefaultGrantKey, grant DefaultGrant) (*DefaultGrant, error)
type FeatureName ¶
type FeatureName uint
const ( FeatureCreateRoleWith FeatureName = iota FeatureDBAllowConnections FeatureDBIsTemplate FeatureFallbackApplicationName FeatureRLS FeatureSchemaCreateIfNotExist FeatureReplication FeatureExtension FeaturePrivileges FeatureForceDropDatabase FeaturePid FeatureReplicationSlot FeaturePublication FeaturePublicationSchema FeatureRoleInheritOption )
type Features ¶
type Features map[FeatureName]bool
func CalcSupportedFeatures ¶
func (Features) IsSupported ¶
func (f Features) IsSupported(name FeatureName) bool
type NoopRevoker ¶ added in v0.1.1
type NoopRevoker struct {
}
type Publication ¶ added in v0.9.0
type Publication struct {
Name string `json:"name"`
Database string `json:"database"`
AllTables bool `json:"allTables"`
Schemas []string `json:"schemas"`
Tables []PublicationTable `json:"tables"`
// Do not error if trying to create a publication that already exists
// Instead, reconcile the existing publication's membership and return
UseExisting bool `json:"useExisting"`
}
Publication defines a postgres publication -- the set of tables that a logical replication consumer receives
A publication selects its tables in one of three ways:
- AllTables: `FOR ALL TABLES` -- every table in every schema, including tables created later
- Schemas: `FOR TABLES IN SCHEMA <schema>` -- every table in the schema, including tables created later (postgres 15+)
- Tables: `FOR TABLE <schema>.<table>` -- only the listed tables
Schemas and Tables can be combined; AllTables cannot be combined with either.
func (Publication) Key ¶ added in v0.9.0
func (p Publication) Key() PublicationKey
type PublicationKey ¶ added in v0.9.0
type PublicationTable ¶ added in v0.9.0
func (PublicationTable) String ¶ added in v0.9.0
func (t PublicationTable) String() string
type Publications ¶ added in v0.9.0
type Publications struct {
DbOpener DbOpener
}
func (*Publications) Create ¶ added in v0.9.0
func (p *Publications) Create(obj Publication) (*Publication, error)
func (*Publications) Drop ¶ added in v0.9.0
func (p *Publications) Drop(key PublicationKey) (bool, error)
func (*Publications) Read ¶ added in v0.9.0
func (p *Publications) Read(key PublicationKey) (*Publication, error)
func (*Publications) Update ¶ added in v0.9.0
func (p *Publications) Update(key PublicationKey, obj Publication) (*Publication, error)
Update reconciles the publication's membership using `ALTER PUBLICATION ... ADD|DROP` The publication is never dropped and recreated: recreating invalidates any active subscription
type ReplicationSlot ¶ added in v0.9.0
type ReplicationSlot struct {
Name string `json:"name"`
Database string `json:"database"`
// Plugin is the logical decoding output plugin, defaults to `pgoutput`
Plugin string `json:"plugin"`
// Active reports whether a consumer is currently streaming from this slot (read-only)
Active bool `json:"active"`
// Do not error if trying to create a slot that already exists
// Instead, read the existing and return
UseExisting bool `json:"useExisting"`
}
ReplicationSlot defines a logical replication slot that a consumer (e.g. Datastream) reads changes from
A slot is bound to a single database and retains WAL until its consumer has acknowledged it. An orphaned slot retains WAL forever, which eventually fills the instance disk -- Drop really drops the slot.
func (ReplicationSlot) Key ¶ added in v0.9.0
func (s ReplicationSlot) Key() ReplicationSlotKey
type ReplicationSlotKey ¶ added in v0.9.0
type ReplicationSlots ¶ added in v0.9.0
type ReplicationSlots struct {
DbOpener DbOpener
}
func (*ReplicationSlots) Create ¶ added in v0.9.0
func (r *ReplicationSlots) Create(obj ReplicationSlot) (*ReplicationSlot, error)
func (*ReplicationSlots) Drop ¶ added in v0.9.0
func (r *ReplicationSlots) Drop(key ReplicationSlotKey) (bool, error)
Drop really drops the slot Unlike the other resources in this api, leaving a logical replication slot behind is not harmless: the slot pins WAL indefinitely and will eventually fill the instance's disk
func (*ReplicationSlots) Read ¶ added in v0.9.0
func (r *ReplicationSlots) Read(key ReplicationSlotKey) (*ReplicationSlot, error)
func (*ReplicationSlots) Update ¶ added in v0.9.0
func (r *ReplicationSlots) Update(key ReplicationSlotKey, obj ReplicationSlot) (*ReplicationSlot, error)
Update cannot alter a slot -- postgres offers no way to change a slot's plugin or database It exists to ensure the slot is present and to report its current state
type Revoker ¶ added in v0.1.1
func GrantRoleMembership ¶ added in v0.1.1
GrantRoleMembership grants role membership of the target 'role' to the current user This is used to perform commands if user is not a superuser For instance, when using AWS RDS, user is not given superuser It returns a nil Revoker if the grant is not needed because the user already has the role's privileges.
func GrantRoleMemberships ¶ added in v0.9.1
GrantRoleMemberships acquires the privileges of every role in 'roles' at once
This takes the advisory lock once for the whole batch. Granting the roles one at a time would deadlock: each grant locks the same key (the current user), and the lock is held until its membership is revoked.
Membership errors are returned alongside a Revoker for whatever was acquired: the caller usually only cares about them if the statement it is about to run fails.
type Role ¶
type Role struct {
Name string `json:"name"`
Password string `json:"password"`
// Do not error if trying to create a role that already exists
// Instead, read the existing, set the password, and return
UseExisting bool `json:"useExisting"`
// SkipPasswordUpdate informs Create to skip updating the role's password if the role already exists
SkipPasswordUpdate bool `json:"-"`
MemberOf []string `json:"memberOf"`
Attributes RoleAttributes `json:"attributes"`
}
type RoleAttributes ¶ added in v0.6.0
type RoleAttributes struct {
CreateDb bool `json:"createDb"`
CreateRole bool `json:"createRole"`
// Replication allows the role to initiate streaming replication and to create/drop replication slots
// This is required for logical replication consumers (e.g. Datastream)
Replication bool `json:"replication"`
}
type RoleMember ¶ added in v0.5.0
type RoleMember struct {
// Member receives all the permissions for Target
Member string `json:"member"`
// Target is the role that gains an additional Member
Target string `json:"target"`
// WithAdminOption permits Member to grant it to others
WithAdminOption bool `json:"withAdminOption"`
// Do not error if trying to create a role membership that already exists
// Instead, return the existing
UseExisting bool `json:"useExisting"`
}
RoleMember adds Member to the Target role
func (RoleMember) Key ¶ added in v0.7.0
func (r RoleMember) Key() RoleMemberKey
type RoleMemberKey ¶ added in v0.5.0
type RoleMembers ¶ added in v0.5.0
type RoleMembers struct {
DbOpener DbOpener
}
func (*RoleMembers) Create ¶ added in v0.5.0
func (r *RoleMembers) Create(membership RoleMember) (*RoleMember, error)
func (*RoleMembers) Drop ¶ added in v0.5.0
func (r *RoleMembers) Drop(key RoleMemberKey) (bool, error)
func (*RoleMembers) Read ¶ added in v0.5.0
func (r *RoleMembers) Read(key RoleMemberKey) (*RoleMember, error)
func (*RoleMembers) Update ¶ added in v0.5.0
func (r *RoleMembers) Update(key RoleMemberKey, membership RoleMember) (*RoleMember, error)
type SchemaPrivilege ¶ added in v0.5.0
SchemaPrivilege grants to Role on Database
CREATE|USAGE on public schema CREATE|CONNECT|TEMPORARY on database
func (SchemaPrivilege) Key ¶ added in v0.5.0
func (p SchemaPrivilege) Key() SchemaPrivilegeKey
type SchemaPrivilegeKey ¶ added in v0.5.0
type SchemaPrivileges ¶ added in v0.5.0
type SchemaPrivileges struct {
DbOpener DbOpener
}
func (*SchemaPrivileges) Create ¶ added in v0.5.0
func (r *SchemaPrivileges) Create(obj SchemaPrivilege) (*SchemaPrivilege, error)
func (*SchemaPrivileges) Drop ¶ added in v0.5.0
func (r *SchemaPrivileges) Drop(key SchemaPrivilegeKey) (bool, error)
func (*SchemaPrivileges) Read ¶ added in v0.5.0
func (r *SchemaPrivileges) Read(key SchemaPrivilegeKey) (*SchemaPrivilege, error)
func (*SchemaPrivileges) Update ¶ added in v0.5.0
func (r *SchemaPrivileges) Update(key SchemaPrivilegeKey, obj SchemaPrivilege) (*SchemaPrivilege, error)
type Settings ¶ added in v0.9.0
type Settings struct {
Version string `json:"version"`
CurrentUser string `json:"currentUser"`
IsSuperuser bool `json:"isSuperuser"`
// WalLevel is `logical` when logical replication is available
// On cloud sql, this is controlled by the `cloudsql.logical_decoding` database flag (requires an instance restart)
WalLevel string `json:"walLevel"`
MaxReplicationSlots int `json:"maxReplicationSlots"`
MaxWalSenders int `json:"maxWalSenders"`
UsedReplicationSlots int `json:"usedReplicationSlots"`
}
Settings reports the server configuration that callers need to know before they attempt logical replication
This is exposed over the api (`GET /settings`) so that infrastructure modules can detect a misconfigured instance up front instead of failing later with an opaque error from postgres or from a replication consumer.
func (Settings) LogicalReplicationEnabled ¶ added in v0.9.0
LogicalReplicationEnabled reports whether the server can support logical replication slots
type SettingsReader ¶ added in v0.9.0
type SettingsReader struct {
DbOpener DbOpener
}
func (*SettingsReader) Read ¶ added in v0.9.0
func (r *SettingsReader) Read() (*Settings, error)
type Store ¶ added in v0.5.0
type Store struct {
Databases *Databases
Roles *Roles
RoleMembers *RoleMembers
DefaultGrants *DefaultGrants
SchemaPrivileges *SchemaPrivileges
TablePrivileges *TablePrivileges
Publications *Publications
ReplicationSlots *ReplicationSlots
Settings *SettingsReader
sync.Mutex
// contains filtered or unexported fields
}
func (*Store) ConnectionUrl ¶ added in v0.6.0
type TablePrivilege ¶ added in v0.9.0
type TablePrivilege struct {
Id string `json:"id"`
Database string `json:"database"`
// Schema is the schema to grant on, or `*` for every non-system schema in the database
Schema string `json:"schema"`
Role string `json:"role"`
// Privileges defaults to `["SELECT"]`
Privileges []string `json:"privileges"`
// IncludeFuture also grants the privileges on tables created later, via ALTER DEFAULT PRIVILEGES
IncludeFuture bool `json:"includeFuture"`
// FutureFromRoles lists the roles whose future tables are covered by IncludeFuture
// Default privileges only apply to objects created by a specific role, so covering an application's future tables
// requires naming the role that creates them -- an empty list only covers tables created by the admin user itself
FutureFromRoles []string `json:"futureFromRoles"`
// FutureFromTableOwners adds every role that currently owns a table in the schema to FutureFromRoles
FutureFromTableOwners bool `json:"futureFromTableOwners"`
// GrantConnect also grants CONNECT on the database
GrantConnect bool `json:"grantConnect"`
}
TablePrivilege grants table-level access on a schema to Role
GRANT USAGE ON SCHEMA <schema> TO <role> GRANT <privileges> ON ALL TABLES IN SCHEMA <schema> TO <role> ALTER DEFAULT PRIVILEGES [FOR ROLE ...] IN SCHEMA <schema> GRANT <privileges> ON TABLES TO <role>
Unlike SchemaPrivilege -- which grants full access so an application can own and modify its schema -- this grants a specific (typically read-only) set of privileges, e.g. for a replication consumer.
func (TablePrivilege) Key ¶ added in v0.9.0
func (p TablePrivilege) Key() TablePrivilegeKey
func (*TablePrivilege) SetId ¶ added in v0.9.0
func (p *TablePrivilege) SetId()
type TablePrivilegeKey ¶ added in v0.9.0
type TablePrivileges ¶ added in v0.9.0
type TablePrivileges struct {
DbOpener DbOpener
}
func (*TablePrivileges) Create ¶ added in v0.9.0
func (t *TablePrivileges) Create(obj TablePrivilege) (*TablePrivilege, error)
func (*TablePrivileges) Drop ¶ added in v0.9.0
func (t *TablePrivileges) Drop(key TablePrivilegeKey) (bool, error)
func (*TablePrivileges) Read ¶ added in v0.9.0
func (t *TablePrivileges) Read(key TablePrivilegeKey) (*TablePrivilege, error)
func (*TablePrivileges) Update ¶ added in v0.9.0
func (t *TablePrivileges) Update(key TablePrivilegeKey, obj TablePrivilege) (*TablePrivilege, error)
type TempGrants ¶ added in v0.9.1
TempGrants releases a batch of temporary memberships acquired under a single advisory lock