realtime

func CheckAccess ¶

func CheckAccess(ctx context.Context, db *pgxpool.Pool, role, table, rowID string) bool

CheckAccess returns true if the authenticated role may read the row identified by rowID in table. It executes:

BEGIN;
SET LOCAL role = {role};
SELECT 1 FROM {table} WHERE id = $1;
ROLLBACK;

The SET LOCAL role applies the caller's JWT role, which activates RLS policies defined for that role. A successful SELECT means the row is visible.

Positive results are cached for 5 seconds per (role, table, rowID) triplet to avoid hammering Postgres with repeated access checks on broadcast storms.

func Handler ¶

func Handler(hub *Hub, jwtSecret string, presenceTrackers map[string]*PresenceTracker, mu interface {
	Lock()
	Unlock()
}) http.Handler

Handler returns an http.Handler for the /realtime/v1/ endpoint. It upgrades incoming requests to WebSocket and handles:

• "auth" event: client sends JWT; verified before routing begins
• "subscribe" event: client subscribes to a Postgres NOTIFY channel
• "broadcast" event: client sends a message to all subscribers of a topic
• "presence:join" event: client joins the presence set of a topic
• "presence:leave" event: client leaves the presence set

jwtSecret is the GoTrue JWT secret used to verify access tokens. hub routes notifications to subscribers. presenceTrackers is a map of channel → *PresenceTracker (created lazily per channel in the calling code).

func LivenessHandler ¶

func LivenessHandler() http.HandlerFunc

LivenessHandler returns a GET-only handler for HTTP health checks (no WebSocket upgrade). Mounted at /realtime/v1/health when the realtime hub is enabled.