postgres

package
v1.8.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 18, 2026 License: Apache-2.0 Imports: 23 Imported by: 0

Documentation

Overview

Package postgres provides a PostgreSQL implementation of the Warden composite store using grove ORM with Go-based migrations.

Index

Constants

This section is empty.

Variables

View Source 
var Migrations = migrate.NewGroup("warden")

Migrations is the grove migration group for the Warden store. It can be registered with the grove extension for orchestrated migration management (locking, version tracking, rollback support).

Functions

This section is empty.

Types

type Option added in v1.7.0 

type Option func(*storeConfig)

Option configures a Store at construction time.

func WithStatementTimeout added in v1.7.0 

func WithStatementTimeout(d time.Duration) Option

WithStatementTimeout returns an Option that caps how long a single statement may run on Postgres before the server cancels it (statement_timeout), so a runaway query can't hold a connection forever.

Grove's pgdriver (v1.6.3) builds its pgxpool.Config from the DSN and doesn't expose pgxpool's AfterConnect hook through a driver.Option, so there is no way to guarantee every connection the pool ever opens picks this up. Store applies it as a session-level SET on the connection it acquires immediately at construction (best-effort, useful for a single-connection pool, or as a default before traffic arrives). For a setting that reliably reaches every connection the pool opens, prefer the DSN's `options` startup parameter instead, which pgx applies at connect time for every physical connection: 

postgres://user:pass@host/db?options=-c%20statement_timeout%3D5000

type Store 

type Store struct {
	// contains filtered or unexported fields
}

Store is a PostgreSQL implementation of the composite Warden store.

func New 

func New(db *grove.DB, opts ...Option) *Store

New creates a new PostgreSQL store. See WithStatementTimeout for the caveats of setting statement_timeout after the pool already exists.

func (*Store) AttachPermission 

func (s *Store) AttachPermission(ctx context.Context, tenantID string, roleID id.RoleID, ref permission.Ref) error

func (*Store) CheckDirectRelation 

func (s *Store) CheckDirectRelation(ctx context.Context, tenantID string, namespacePaths []string, objectType, objectID, rel, subjectType, subjectID string) (bool, error)

func (*Store) Close 

func (s *Store) Close() error

Close closes the database connection.

func (*Store) CountAssignments 

func (s *Store) CountAssignments(ctx context.Context, filter *assignment.ListFilter) (int64, error)

func (*Store) CountCheckLogs 

func (s *Store) CountCheckLogs(ctx context.Context, filter *checklog.QueryFilter) (int64, error)

func (*Store) CountPermissions 

func (s *Store) CountPermissions(ctx context.Context, filter *permission.ListFilter) (int64, error)

func (*Store) CountPolicies 

func (s *Store) CountPolicies(ctx context.Context, filter *policy.ListFilter) (int64, error)

func (*Store) CountRelations 

func (s *Store) CountRelations(ctx context.Context, filter *relation.ListFilter) (int64, error)

func (*Store) CountResourceTypes 

func (s *Store) CountResourceTypes(ctx context.Context, filter *resourcetype.ListFilter) (int64, error)

func (*Store) CountRoles 

func (s *Store) CountRoles(ctx context.Context, filter *role.ListFilter) (int64, error)

func (*Store) CreateAssignment 

func (s *Store) CreateAssignment(ctx context.Context, a *assignment.Assignment) error

func (*Store) CreateCheckLog 

func (s *Store) CreateCheckLog(ctx context.Context, e *checklog.Entry) error

func (*Store) CreatePermission 

func (s *Store) CreatePermission(ctx context.Context, p *permission.Permission) error

func (*Store) CreatePolicy 

func (s *Store) CreatePolicy(ctx context.Context, p *policy.Policy) error

func (*Store) CreateRelation 

func (s *Store) CreateRelation(ctx context.Context, t *relation.Tuple) error

func (*Store) CreateResourceType 

func (s *Store) CreateResourceType(ctx context.Context, rt *resourcetype.ResourceType) error

func (*Store) CreateRole 

func (s *Store) CreateRole(ctx context.Context, r *role.Role) error

func (*Store) DeleteAssignment 

func (s *Store) DeleteAssignment(ctx context.Context, tenantID string, assID id.AssignmentID) error

func (*Store) DeleteAssignmentsByRole 

func (s *Store) DeleteAssignmentsByRole(ctx context.Context, tenantID string, roleID id.RoleID) error

func (*Store) DeleteAssignmentsBySubject 

func (s *Store) DeleteAssignmentsBySubject(ctx context.Context, tenantID, subjectKind, subjectID string) error

func (*Store) DeleteAssignmentsByTenant 

func (s *Store) DeleteAssignmentsByTenant(ctx context.Context, tenantID string) error

func (*Store) DeleteCheckLogsBySubject added in v1.7.0 

func (s *Store) DeleteCheckLogsBySubject(ctx context.Context, tenantID, subjectKind, subjectID string) (int64, error)

func (*Store) DeleteCheckLogsByTenant 

func (s *Store) DeleteCheckLogsByTenant(ctx context.Context, tenantID string) error

func (*Store) DeleteExpiredAssignments 

func (s *Store) DeleteExpiredAssignments(ctx context.Context, now time.Time) (int64, error)

func (*Store) DeleteExpiredAssignmentsForTenant added in v1.7.0 

func (s *Store) DeleteExpiredAssignmentsForTenant(ctx context.Context, tenantID string, now time.Time) (int64, error)

func (*Store) DeletePermission 

func (s *Store) DeletePermission(ctx context.Context, tenantID string, permID id.PermissionID) error

func (*Store) DeletePermissionsByTenant 

func (s *Store) DeletePermissionsByTenant(ctx context.Context, tenantID string) error

func (*Store) DeletePoliciesByTenant 

func (s *Store) DeletePoliciesByTenant(ctx context.Context, tenantID string) error

func (*Store) DeletePolicy 

func (s *Store) DeletePolicy(ctx context.Context, tenantID string, polID id.PolicyID) error

func (*Store) DeleteRelation 

func (s *Store) DeleteRelation(ctx context.Context, tenantID string, relID id.RelationID) error

func (*Store) DeleteRelationTuple 

func (s *Store) DeleteRelationTuple(ctx context.Context, tenantID, namespacePath, objectType, objectID, rel, subjectType, subjectID, subjectRelation string) error

func (*Store) DeleteRelationsByObject 

func (s *Store) DeleteRelationsByObject(ctx context.Context, tenantID, objectType, objectID string) error

func (*Store) DeleteRelationsBySubject 

func (s *Store) DeleteRelationsBySubject(ctx context.Context, tenantID, subjectType, subjectID string) error

func (*Store) DeleteRelationsByTenant 

func (s *Store) DeleteRelationsByTenant(ctx context.Context, tenantID string) error

func (*Store) DeleteResourceType 

func (s *Store) DeleteResourceType(ctx context.Context, tenantID string, rtID id.ResourceTypeID) error

func (*Store) DeleteResourceTypesByTenant 

func (s *Store) DeleteResourceTypesByTenant(ctx context.Context, tenantID string) error

func (*Store) DeleteRole 

func (s *Store) DeleteRole(ctx context.Context, tenantID string, roleID id.RoleID) error

DeleteRole removes a role. Assignments and grants go with it via the foreign-key cascades in the schema.

func (*Store) DeleteRolesByTenant 

func (s *Store) DeleteRolesByTenant(ctx context.Context, tenantID string) error

func (*Store) DetachPermission 

func (s *Store) DetachPermission(ctx context.Context, tenantID string, roleID id.RoleID, ref permission.Ref) error

func (*Store) GetAssignment 

func (s *Store) GetAssignment(ctx context.Context, tenantID string, assID id.AssignmentID) (*assignment.Assignment, error)

func (*Store) GetCheckLog 

func (s *Store) GetCheckLog(ctx context.Context, tenantID string, logID id.CheckLogID) (*checklog.Entry, error)

func (*Store) GetPermission 

func (s *Store) GetPermission(ctx context.Context, tenantID string, permID id.PermissionID) (*permission.Permission, error)

func (*Store) GetPermissionByName 

func (s *Store) GetPermissionByName(ctx context.Context, tenantID, namespacePath, name string) (*permission.Permission, error)

func (*Store) GetPolicy 

func (s *Store) GetPolicy(ctx context.Context, tenantID string, polID id.PolicyID) (*policy.Policy, error)

func (*Store) GetPolicyByName 

func (s *Store) GetPolicyByName(ctx context.Context, tenantID, namespacePath, name string) (*policy.Policy, error)

func (*Store) GetRelation added in v1.7.0 

func (s *Store) GetRelation(ctx context.Context, tenantID string, relID id.RelationID) (*relation.Tuple, error)

func (*Store) GetResourceType 

func (s *Store) GetResourceType(ctx context.Context, tenantID string, rtID id.ResourceTypeID) (*resourcetype.ResourceType, error)

func (*Store) GetResourceTypeByName 

func (s *Store) GetResourceTypeByName(ctx context.Context, tenantID, namespacePath, name string) (*resourcetype.ResourceType, error)

func (*Store) GetRole 

func (s *Store) GetRole(ctx context.Context, tenantID string, roleID id.RoleID) (*role.Role, error)

func (*Store) GetRoleBySlug 

func (s *Store) GetRoleBySlug(ctx context.Context, tenantID, namespacePath, slug string) (*role.Role, error)

func (*Store) GetRoles added in v1.7.0 

func (s *Store) GetRoles(ctx context.Context, tenantID string, roleIDs []id.RoleID) ([]*role.Role, error)

func (*Store) ListActivePolicies 

func (s *Store) ListActivePolicies(ctx context.Context, tenantID string, namespacePaths []string) ([]*policy.Policy, error)

func (*Store) ListAssignments 

func (s *Store) ListAssignments(ctx context.Context, filter *assignment.ListFilter) ([]*assignment.Assignment, error)

func (*Store) ListCheckLogs 

func (s *Store) ListCheckLogs(ctx context.Context, filter *checklog.QueryFilter) ([]*checklog.Entry, error)

func (*Store) ListChildRoles 

func (s *Store) ListChildRoles(ctx context.Context, tenantID, parentSlug string) ([]*role.Role, error)

func (*Store) ListExpiringAssignments added in v1.7.0 

func (s *Store) ListExpiringAssignments(ctx context.Context, tenantID string, before time.Time, limit int) ([]*assignment.Assignment, error)

func (*Store) ListPermissions 

func (s *Store) ListPermissions(ctx context.Context, filter *permission.ListFilter) ([]*permission.Permission, error)

func (*Store) ListPermissionsByRole 

func (s *Store) ListPermissionsByRole(ctx context.Context, tenantID string, roleID id.RoleID) ([]*permission.Permission, error)

func (*Store) ListPermissionsBySubject 

func (s *Store) ListPermissionsBySubject(ctx context.Context, tenantID, subjectKind, subjectID string) ([]*permission.Permission, error)

func (*Store) ListPolicies 

func (s *Store) ListPolicies(ctx context.Context, filter *policy.ListFilter) ([]*policy.Policy, error)

func (*Store) ListRelationObjects 

func (s *Store) ListRelationObjects(ctx context.Context, tenantID, namespacePath, subjectType, subjectID, rel string, limit int) ([]*relation.Tuple, error)

func (*Store) ListRelationSubjects 

func (s *Store) ListRelationSubjects(ctx context.Context, tenantID string, namespacePaths []string, objectType, objectID, rel string, limit int) ([]*relation.Tuple, error)

func (*Store) ListRelations 

func (s *Store) ListRelations(ctx context.Context, filter *relation.ListFilter) ([]*relation.Tuple, error)

func (*Store) ListResourceTypes 

func (s *Store) ListResourceTypes(ctx context.Context, filter *resourcetype.ListFilter) ([]*resourcetype.ResourceType, error)

func (*Store) ListRolePermissions 

func (s *Store) ListRolePermissions(ctx context.Context, tenantID string, roleID id.RoleID) ([]*permission.Permission, error)

func (*Store) ListRolePermissionsForRoles added in v1.7.0 

func (s *Store) ListRolePermissionsForRoles(ctx context.Context, tenantID string, roleIDs []id.RoleID) (map[id.RoleID][]*permission.Permission, error)

func (*Store) ListRoles 

func (s *Store) ListRoles(ctx context.Context, filter *role.ListFilter) ([]*role.Role, error)

func (*Store) ListRolesForSubject 

func (s *Store) ListRolesForSubject(ctx context.Context, tenantID string, namespacePaths []string, subjectKind, subjectID string) ([]id.RoleID, error)

func (*Store) ListRolesForSubjectOnResource 

func (s *Store) ListRolesForSubjectOnResource(ctx context.Context, tenantID string, namespacePaths []string, subjectKind, subjectID, resourceType, resourceID string) ([]id.RoleID, error)

func (*Store) ListSubjectsForRole 

func (s *Store) ListSubjectsForRole(ctx context.Context, tenantID string, roleID id.RoleID) ([]*assignment.Assignment, error)

func (*Store) Migrate 

func (s *Store) Migrate(ctx context.Context) error

Migrate runs programmatic migrations via the grove orchestrator.

func (*Store) Ping 

func (s *Store) Ping(ctx context.Context) error

Ping verifies the database connection.

func (*Store) PurgeCheckLogs 

func (s *Store) PurgeCheckLogs(ctx context.Context, before time.Time) (int64, error)

func (*Store) PurgeCheckLogsForTenant added in v1.7.0 

func (s *Store) PurgeCheckLogsForTenant(ctx context.Context, tenantID string, before time.Time) (int64, error)

PurgeCheckLogsForTenant is a DELETE, which warden_check_logs allows: its append-only trigger refuses UPDATE only.

func (*Store) SetPolicyVersion 

func (s *Store) SetPolicyVersion(ctx context.Context, tenantID string, polID id.PolicyID, version int) error

func (*Store) SetRolePermissions 

func (s *Store) SetRolePermissions(ctx context.Context, tenantID string, roleID id.RoleID, refs []permission.Ref) error

func (*Store) UpdatePermission 

func (s *Store) UpdatePermission(ctx context.Context, p *permission.Permission) error

func (*Store) UpdatePolicy 

func (s *Store) UpdatePolicy(ctx context.Context, p *policy.Policy) error

func (*Store) UpdatePolicyIfVersion added in v1.7.0 

func (s *Store) UpdatePolicyIfVersion(ctx context.Context, p *policy.Policy, expected int) error

UpdatePolicyIfVersion writes p as UpdatePolicy does, only if the stored policy is at version expected. The version check is part of the UPDATE's WHERE clause, so the comparison and the write are one statement: under READ COMMITTED a second writer blocks on the row lock, then re-checks the WHERE against the committed row and matches nothing. When no row changes, a read picks the error: not found if the policy is absent from p's tenant, a version conflict otherwise. That read only chooses the error; the refusal itself was atomic.

p.UpdatedAt is set only once the write has happened, so a refused caller's struct does not claim a write that did not happen.

func (*Store) UpdateResourceType 

func (s *Store) UpdateResourceType(ctx context.Context, rt *resourcetype.ResourceType) error

func (*Store) UpdateRole 

func (s *Store) UpdateRole(ctx context.Context, r *role.Role) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.