modelhooks

type Callback ¶

type Callback struct {
	// contains filtered or unexported fields
}

Callback mints and serves the `previous()` endpoint.

Reads run as the **service role**, so a hook sees the rows as stored — RLS bypassed, field masking not applied. That is deliberate: a hook validating against a masked column would otherwise compare with `NULL` and pass. It is also not a privilege the hook lacks, since the worker already holds the service-role key; the endpoint is a convenience, not an escalation.

The token is what keeps it from being a general "read any rows matching any filter" surface: it pins the table and the filter to one in-flight request and expires with it.

func NewCallback(
	restBase func(*http.Request) string,
	schemaFor func(*http.Request) string,
	serviceRoleKey string,
	client Doer,
) (*Callback, error)

func (c *Callback) Handler() http.Handler

func (c *Callback) Path(op Operation, table, filter string) string

type Claims ¶

type Claims struct {
	Sub   string `json:"sub"`
	Role  string `json:"role"`
	Email string `json:"email,omitempty"`
}

Claims is the caller identity a hook payload carries.

type ClaimsFunc ¶

type ClaimsFunc func(*http.Request) *Claims

ClaimsFunc reads the verified caller identity from a request, or nil for an anonymous one.

func ClaimsFromBearer(jwtSecret string) ClaimsFunc

type Dispatcher ¶

type Dispatcher struct {
	// contains filtered or unexported fields
}

Dispatcher calls hook functions and turns their answers into outcomes.

Deliberately **not** `internal/hooks/hookshttp`: that dispatcher retries, which is right for an auth webhook and wrong here. A retry before a write multiplies the latency the caller waits, and re-invokes a handler that may already have acted. It also folds every non-2xx into an error, which would lose the distinction this design turns on — a 4xx is the hook saying no, a 5xx is the hook being broken.

func NewDispatcher(client Doer, secret string) *Dispatcher

func (d *Dispatcher) Call(
	ctx context.Context,
	url string,
	event string,
	cfg HookConfigView,
	payload []byte,

	depth int,
) Outcome

type Doer ¶

type Doer interface {
	Do(req *http.Request) (*http.Response, error)
}

Doer is the HTTP surface the dispatcher needs, so tests can supply their own.

type HookConfigEntry ¶

type HookConfigEntry struct {
	Function      string
	TimeoutMs     int
	OnUnavailable string
}

HookConfigEntry is one hook's configuration.

type HookConfigView ¶

type HookConfigView struct {
	TimeoutMs     int
	OnUnavailable string
}

HookConfigView is the part of a hook's config the dispatcher needs.

func (h HookConfigView) RejectsWhenUnavailable(event string) bool

func (h HookConfigView) Timeout() time.Duration

type HooksFunc ¶

type HooksFunc func(*http.Request) map[string]TableHooksView

HooksFunc returns the current hook map — read per request, since the manifest is hot-reloaded.

type Operation ¶

type Operation string

Operation is the write a request performs, as a hook payload reports it.

const (
	OpInsert Operation = "insert"
	OpUpdate Operation = "update"
	OpDelete Operation = "delete"
)

type Options ¶

type Options struct {
	Dispatcher   *Dispatcher
	Hooks        HooksFunc
	ResolveURL   UpstreamResolver
	Claims       ClaimsFunc
	RequestID    func(*http.Request) string
	MaxBodyBytes int64
	// Callback mints the `previous()` path. Optional: without it the context simply has no
	// `previous`, which the generated types already model as absent rather than as a broken call.
	Callback *Callback
}

Options configures Middleware.

type Outcome ¶

type Outcome struct {
	Kind   OutcomeKind
	Status int
	Body   []byte
	// Reason explains an OutcomeUnavailable, for the log line. Never sent to the caller: it may name
	// internal hosts, and a caller cannot act on it.
	Reason string
}

Outcome is the result of calling one hook.

type OutcomeKind ¶

type OutcomeKind int

OutcomeKind is what the server should do next.

const (
	// OutcomeProceed — carry on with the request unchanged.
	OutcomeProceed OutcomeKind = iota
	// OutcomeReplace — carry on, using Body as the request body.
	OutcomeReplace
	// OutcomeReject — the hook said no. Status and Body go to the caller.
	OutcomeReject
	// OutcomeUnavailable — the hook did not answer. The per-hook policy decides.
	OutcomeUnavailable
)

type TableHooksView ¶

type TableHooksView map[string]HookConfigEntry

TableHooksView is one table's hooks, decoupled from the manifest type so this package does not depend on how they were delivered.

type Target ¶

type Target struct {
	Table     string
	Operation Operation
	// Before is the hook to call before the write, if the table declares one.
	Before *HookConfigEntry
	// After is the hook to call once the write has succeeded, if the table declares one.
	After *HookConfigEntry
	// BeforeEvent and AfterEvent name the events, so a dispatcher can set the header without
	// re-deriving them from the operation.
	BeforeEvent string
	AfterEvent  string
}

Target is the hook work a single request implies.

func Classify(req *http.Request, hooks map[string]proxy.TableHooks) Target

func (t Target) HasWork() bool

type UpstreamResolver ¶

type UpstreamResolver func(req *http.Request, function string) (string, error)

UpstreamResolver returns the URL to POST a named function to. Wired to the server's existing functions resolution rather than duplicating it.