Documentation
¶
Overview ¶
Package postgres provides the Postgres concrete tenancy.Provider. It installs Row-Level Security policies at migration time and binds per-request tenancy state via pgxpool PrepareConn / AfterRelease hooks. Combined, application code never references tenant_id or partition_id directly.
Index ¶
- type ArmingCheck
- type Option
- type Provider
- func (p *Provider) AllowGlobalServices() []string
- func (*Provider) Capabilities() tenancy.Capabilities
- func (p *Provider) EnrollmentStrict() bool
- func (p *Provider) Install(_ context.Context, db *gorm.DB, models []tenancy.ModelInfo) error
- func (*Provider) Name() string
- func (p *Provider) SecurityMode() tenancy.SecurityMode
- func (p *Provider) SetAllowGlobalServices(names ...string)
- func (p *Provider) SetEnrollmentStrict(strict bool)
- func (p *Provider) SetSecurityMode(m tenancy.SecurityMode)
- func (p *Provider) WireAdapter(adapter dialect.DialectAdapter) error
- func (*Provider) WireGorm(_ *gorm.DB) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ArmingCheck ¶ added in v2.0.14
type ArmingCheck struct {
// DB returns a session for the app role. Called on each CheckHealth.
DB func(ctx context.Context) *gorm.DB
// NameOverride optional checker name (default tenancy_provider_armed).
NameOverride string
}
ArmingCheck verifies the database role used for application queries does not bypass RLS (not superuser, not BYPASSRLS). Intended for readiness (/readyz), never liveness.
Construct with a function that returns a *gorm.DB for the app pool (not the migration superuser pool).
func (*ArmingCheck) CheckHealth ¶ added in v2.0.14
func (c *ArmingCheck) CheckHealth() error
CheckHealth reports an error if the current DB role can bypass RLS.
func (*ArmingCheck) Name ¶ added in v2.0.14
func (c *ArmingCheck) Name() string
Name implements frame.NamedChecker when used with AddHealthCheck.
type Option ¶ added in v2.0.14
type Option func(*Provider)
Option configures a Provider.
func WithAllowGlobalServices ¶ added in v2.0.14
WithAllowGlobalServices sets the allowlist of ServiceName values that may use SystemPrincipal.AllowGlobal for match-all elevation.
func WithEnrollmentStrict ¶ added in v2.0.14
WithEnrollmentStrict enables strict enrollment: migrate fails if models look tenanted but do not implement tenancy.Tenanted and are not Unscoped.
func WithSecurityMode ¶ added in v2.0.14
func WithSecurityMode(m tenancy.SecurityMode) Option
WithSecurityMode sets the provider security mode (default ModeFailOpen).
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider is the Postgres concrete tenancy.Provider. It installs RLS policies during Migrate and binds per-request tenancy state via pgxpool acquire/release hooks (no transactions required).
Security modes (see tenancy.SecurityMode):
- ModeFailOpen (default): nil/empty/Skip → clear session (match-all).
- ModeHybrid / ModeFailClosed: require bindable claims or authorized SystemPrincipal; bare Skip rejected; partition-only rejected.
Connection poolers: session-scoped GUCs require session affinity (direct Postgres or PgBouncer pool_mode=session). See docs/datastore.md.
func (*Provider) AllowGlobalServices ¶ added in v2.0.14
AllowGlobalServices implements tenancy.AllowGlobalAware.
func (*Provider) Capabilities ¶
func (*Provider) Capabilities() tenancy.Capabilities
Capabilities implements tenancy.Provider.
func (*Provider) EnrollmentStrict ¶ added in v2.0.14
EnrollmentStrict reports whether strict enrollment is enabled.
func (*Provider) SecurityMode ¶ added in v2.0.14
func (p *Provider) SecurityMode() tenancy.SecurityMode
SecurityMode implements tenancy.ModeAware.
func (*Provider) SetAllowGlobalServices ¶ added in v2.0.14
SetAllowGlobalServices implements tenancy.AllowGlobalAware.
func (*Provider) SetEnrollmentStrict ¶ added in v2.0.14
SetEnrollmentStrict updates strict enrollment after construction.
func (*Provider) SetSecurityMode ¶ added in v2.0.14
func (p *Provider) SetSecurityMode(m tenancy.SecurityMode)
SetSecurityMode implements tenancy.ModeAware.
func (*Provider) WireAdapter ¶
func (p *Provider) WireAdapter(adapter dialect.DialectAdapter) error
WireAdapter implements tenancy.Provider.
Source Files