sqlite

package
v1.8.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 18, 2026 License: Apache-2.0 Imports: 22 Imported by: 0

Documentation

Overview

Package sqlite provides a SQLite Store implementation for embedded/edge use.

Busy timeout

SQLite is single-writer: a second connection that tries to write while another holds the lock fails immediately with SQLITE_BUSY unless a busy_timeout is configured, in which case it retries for that long before giving up. busy_timeout is a per-connection setting, and grove's sqlite driver opens a pool of connections (default size 10), so setting it after the pool exists, as Store's WithBusyTimeout option does, only reaches whichever connection that call happens to land on.

For a setting that reliably reaches every connection the pool ever opens, set it in the DSN instead, using modernc.org/sqlite's _pragma query parameter, which is applied at connection-open time: 

file:warden.db?_pragma=busy_timeout(5000)

Combine with other pragmas by repeating the parameter: 

file:warden.db?_pragma=busy_timeout(5000)&_pragma=foreign_keys(1)

Index

Constants

This section is empty.

Variables

View Source 
var Migrations = migrate.NewGroup("warden")

Migrations is the grove migration group for the Warden store (SQLite).

Functions

This section is empty.

Types

type Option added in v1.7.0 

type Option func(*storeConfig)

Option configures a Store at construction time.

func WithBusyTimeout added in v1.7.0 

func WithBusyTimeout(d time.Duration) Option

WithBusyTimeout returns an Option that sets SQLite's busy_timeout (how long a writer waits on a locked database before returning SQLITE_BUSY) for the connection New acquires immediately to apply it.

This pragma is per-connection, and grove's sqlite driver hands out connections from a pool (default size 10; see sqlitedriver.SqliteDB.Open), so a single SET issued here is not guaranteed to reach every connection the pool later opens. For a guarantee that covers the whole pool, prefer the DSN form documented in this package's doc comment (file:foo.db?_pragma=busy_timeout(5000)), which modernc.org/sqlite applies to every physical connection at open time. WithBusyTimeout is a best-effort supplement for callers who only control the *grove.DB handle.

type Store 

type Store struct {
	// contains filtered or unexported fields
}

Store is a SQLite implementation of the composite Warden store.

func New 

func New(db *grove.DB, opts ...Option) *Store

New creates a new SQLite store. See WithBusyTimeout for the caveats of setting busy_timeout after the pool already exists.

func (*Store) AttachPermission 

func (s *Store) AttachPermission(ctx context.Context, tenantID string, roleID id.RoleID, ref permission.Ref) error

func (*Store) CheckDirectRelation 

func (s *Store) CheckDirectRelation(ctx context.Context, tenantID string, namespacePaths []string, objectType, objectID, rel, subjectType, subjectID string) (bool, error)

func (*Store) Close 

func (s *Store) Close() error

Close closes the database connection.

func (*Store) CountAssignments 

func (s *Store) CountAssignments(ctx context.Context, filter *assignment.ListFilter) (int64, error)

func (*Store) CountCheckLogs 

func (s *Store) CountCheckLogs(ctx context.Context, filter *checklog.QueryFilter) (int64, error)

func (*Store) CountPermissions 

func (s *Store) CountPermissions(ctx context.Context, filter *permission.ListFilter) (int64, error)

func (*Store) CountPolicies 

func (s *Store) CountPolicies(ctx context.Context, filter *policy.ListFilter) (int64, error)

func (*Store) CountRelations 

func (s *Store) CountRelations(ctx context.Context, filter *relation.ListFilter) (int64, error)

func (*Store) CountResourceTypes 

func (s *Store) CountResourceTypes(ctx context.Context, filter *resourcetype.ListFilter) (int64, error)

func (*Store) CountRoles 

func (s *Store) CountRoles(ctx context.Context, filter *role.ListFilter) (int64, error)

func (*Store) CreateAssignment 

func (s *Store) CreateAssignment(ctx context.Context, a *assignment.Assignment) error

func (*Store) CreateCheckLog 

func (s *Store) CreateCheckLog(ctx context.Context, e *checklog.Entry) error

func (*Store) CreatePermission 

func (s *Store) CreatePermission(ctx context.Context, p *permission.Permission) error

func (*Store) CreatePolicy 

func (s *Store) CreatePolicy(ctx context.Context, p *policy.Policy) error

func (*Store) CreateRelation 

func (s *Store) CreateRelation(ctx context.Context, t *relation.Tuple) error

func (*Store) CreateResourceType 

func (s *Store) CreateResourceType(ctx context.Context, rt *resourcetype.ResourceType) error

func (*Store) CreateRole 

func (s *Store) CreateRole(ctx context.Context, r *role.Role) error

func (*Store) DeleteAssignment 

func (s *Store) DeleteAssignment(ctx context.Context, tenantID string, assID id.AssignmentID) error

func (*Store) DeleteAssignmentsByRole 

func (s *Store) DeleteAssignmentsByRole(ctx context.Context, tenantID string, roleID id.RoleID) error

func (*Store) DeleteAssignmentsBySubject 

func (s *Store) DeleteAssignmentsBySubject(ctx context.Context, tenantID, subjectKind, subjectID string) error

func (*Store) DeleteAssignmentsByTenant 

func (s *Store) DeleteAssignmentsByTenant(ctx context.Context, tenantID string) error

func (*Store) DeleteCheckLogsBySubject added in v1.7.0 

func (s *Store) DeleteCheckLogsBySubject(ctx context.Context, tenantID, subjectKind, subjectID string) (int64, error)

func (*Store) DeleteCheckLogsByTenant 

func (s *Store) DeleteCheckLogsByTenant(ctx context.Context, tenantID string) error

func (*Store) DeleteExpiredAssignments 

func (s *Store) DeleteExpiredAssignments(ctx context.Context, now time.Time) (int64, error)

func (*Store) DeleteExpiredAssignmentsForTenant added in v1.7.0 

func (s *Store) DeleteExpiredAssignmentsForTenant(ctx context.Context, tenantID string, now time.Time) (int64, error)

func (*Store) DeletePermission 

func (s *Store) DeletePermission(ctx context.Context, tenantID string, permID id.PermissionID) error

func (*Store) DeletePermissionsByTenant 

func (s *Store) DeletePermissionsByTenant(ctx context.Context, tenantID string) error

func (*Store) DeletePoliciesByTenant 

func (s *Store) DeletePoliciesByTenant(ctx context.Context, tenantID string) error

func (*Store) DeletePolicy 

func (s *Store) DeletePolicy(ctx context.Context, tenantID string, polID id.PolicyID) error

func (*Store) DeleteRelation 

func (s *Store) DeleteRelation(ctx context.Context, tenantID string, relID id.RelationID) error

func (*Store) DeleteRelationTuple 

func (s *Store) DeleteRelationTuple(ctx context.Context, tenantID, namespacePath, objectType, objectID, rel, subjectType, subjectID, subjectRelation string) error

func (*Store) DeleteRelationsByObject 

func (s *Store) DeleteRelationsByObject(ctx context.Context, tenantID, objectType, objectID string) error

func (*Store) DeleteRelationsBySubject 

func (s *Store) DeleteRelationsBySubject(ctx context.Context, tenantID, subjectType, subjectID string) error

func (*Store) DeleteRelationsByTenant 

func (s *Store) DeleteRelationsByTenant(ctx context.Context, tenantID string) error

func (*Store) DeleteResourceType 

func (s *Store) DeleteResourceType(ctx context.Context, tenantID string, rtID id.ResourceTypeID) error

func (*Store) DeleteResourceTypesByTenant 

func (s *Store) DeleteResourceTypesByTenant(ctx context.Context, tenantID string) error

func (*Store) DeleteRole 

func (s *Store) DeleteRole(ctx context.Context, tenantID string, roleID id.RoleID) error

DeleteRole removes a role. Assignments and grants go with it via the foreign-key cascades in the schema.

func (*Store) DeleteRolesByTenant 

func (s *Store) DeleteRolesByTenant(ctx context.Context, tenantID string) error

func (*Store) DetachPermission 

func (s *Store) DetachPermission(ctx context.Context, tenantID string, roleID id.RoleID, ref permission.Ref) error

func (*Store) GetAssignment 

func (s *Store) GetAssignment(ctx context.Context, tenantID string, assID id.AssignmentID) (*assignment.Assignment, error)

func (*Store) GetCheckLog 

func (s *Store) GetCheckLog(ctx context.Context, tenantID string, logID id.CheckLogID) (*checklog.Entry, error)

func (*Store) GetPermission 

func (s *Store) GetPermission(ctx context.Context, tenantID string, permID id.PermissionID) (*permission.Permission, error)

func (*Store) GetPermissionByName 

func (s *Store) GetPermissionByName(ctx context.Context, tenantID, namespacePath, name string) (*permission.Permission, error)

func (*Store) GetPolicy 

func (s *Store) GetPolicy(ctx context.Context, tenantID string, polID id.PolicyID) (*policy.Policy, error)

func (*Store) GetPolicyByName 

func (s *Store) GetPolicyByName(ctx context.Context, tenantID, namespacePath, name string) (*policy.Policy, error)

func (*Store) GetRelation added in v1.7.0 

func (s *Store) GetRelation(ctx context.Context, tenantID string, relID id.RelationID) (*relation.Tuple, error)

func (*Store) GetResourceType 

func (s *Store) GetResourceType(ctx context.Context, tenantID string, rtID id.ResourceTypeID) (*resourcetype.ResourceType, error)

func (*Store) GetResourceTypeByName 

func (s *Store) GetResourceTypeByName(ctx context.Context, tenantID, namespacePath, name string) (*resourcetype.ResourceType, error)

func (*Store) GetRole 

func (s *Store) GetRole(ctx context.Context, tenantID string, roleID id.RoleID) (*role.Role, error)

func (*Store) GetRoleBySlug 

func (s *Store) GetRoleBySlug(ctx context.Context, tenantID, namespacePath, slug string) (*role.Role, error)

func (*Store) GetRoles added in v1.7.0 

func (s *Store) GetRoles(ctx context.Context, tenantID string, roleIDs []id.RoleID) ([]*role.Role, error)

func (*Store) ListActivePolicies 

func (s *Store) ListActivePolicies(ctx context.Context, tenantID string, namespacePaths []string) ([]*policy.Policy, error)

func (*Store) ListAssignments 

func (s *Store) ListAssignments(ctx context.Context, filter *assignment.ListFilter) ([]*assignment.Assignment, error)

func (*Store) ListCheckLogs 

func (s *Store) ListCheckLogs(ctx context.Context, filter *checklog.QueryFilter) ([]*checklog.Entry, error)

func (*Store) ListChildRoles 

func (s *Store) ListChildRoles(ctx context.Context, tenantID, parentSlug string) ([]*role.Role, error)

func (*Store) ListExpiringAssignments added in v1.7.0 

func (s *Store) ListExpiringAssignments(ctx context.Context, tenantID string, before time.Time, limit int) ([]*assignment.Assignment, error)

func (*Store) ListPermissions 

func (s *Store) ListPermissions(ctx context.Context, filter *permission.ListFilter) ([]*permission.Permission, error)

func (*Store) ListPermissionsByRole 

func (s *Store) ListPermissionsByRole(ctx context.Context, tenantID string, roleID id.RoleID) ([]*permission.Permission, error)

func (*Store) ListPermissionsBySubject 

func (s *Store) ListPermissionsBySubject(ctx context.Context, tenantID, subjectKind, subjectID string) ([]*permission.Permission, error)

func (*Store) ListPolicies 

func (s *Store) ListPolicies(ctx context.Context, filter *policy.ListFilter) ([]*policy.Policy, error)

func (*Store) ListRelationObjects 

func (s *Store) ListRelationObjects(ctx context.Context, tenantID, namespacePath, subjectType, subjectID, rel string, limit int) ([]*relation.Tuple, error)

func (*Store) ListRelationSubjects 

func (s *Store) ListRelationSubjects(ctx context.Context, tenantID string, namespacePaths []string, objectType, objectID, rel string, limit int) ([]*relation.Tuple, error)

func (*Store) ListRelations 

func (s *Store) ListRelations(ctx context.Context, filter *relation.ListFilter) ([]*relation.Tuple, error)

func (*Store) ListResourceTypes 

func (s *Store) ListResourceTypes(ctx context.Context, filter *resourcetype.ListFilter) ([]*resourcetype.ResourceType, error)

func (*Store) ListRolePermissions 

func (s *Store) ListRolePermissions(ctx context.Context, tenantID string, roleID id.RoleID) ([]*permission.Permission, error)

func (*Store) ListRolePermissionsForRoles added in v1.7.0 

func (s *Store) ListRolePermissionsForRoles(ctx context.Context, tenantID string, roleIDs []id.RoleID) (map[id.RoleID][]*permission.Permission, error)

func (*Store) ListRoles 

func (s *Store) ListRoles(ctx context.Context, filter *role.ListFilter) ([]*role.Role, error)

func (*Store) ListRolesForSubject 

func (s *Store) ListRolesForSubject(ctx context.Context, tenantID string, namespacePaths []string, subjectKind, subjectID string) ([]id.RoleID, error)

func (*Store) ListRolesForSubjectOnResource 

func (s *Store) ListRolesForSubjectOnResource(ctx context.Context, tenantID string, namespacePaths []string, subjectKind, subjectID, resourceType, resourceID string) ([]id.RoleID, error)

func (*Store) ListSubjectsForRole 

func (s *Store) ListSubjectsForRole(ctx context.Context, tenantID string, roleID id.RoleID) ([]*assignment.Assignment, error)

func (*Store) Migrate 

func (s *Store) Migrate(ctx context.Context) error

Migrate runs programmatic migrations via the grove orchestrator.

func (*Store) Ping 

func (s *Store) Ping(ctx context.Context) error

Ping verifies the database connection.

func (*Store) PurgeCheckLogs 

func (s *Store) PurgeCheckLogs(ctx context.Context, before time.Time) (int64, error)

func (*Store) PurgeCheckLogsForTenant added in v1.7.0 

func (s *Store) PurgeCheckLogsForTenant(ctx context.Context, tenantID string, before time.Time) (int64, error)

func (*Store) SetPolicyVersion 

func (s *Store) SetPolicyVersion(ctx context.Context, tenantID string, polID id.PolicyID, version int) error

func (*Store) SetRolePermissions 

func (s *Store) SetRolePermissions(ctx context.Context, tenantID string, roleID id.RoleID, refs []permission.Ref) error

func (*Store) UpdatePermission 

func (s *Store) UpdatePermission(ctx context.Context, p *permission.Permission) error

func (*Store) UpdatePolicy 

func (s *Store) UpdatePolicy(ctx context.Context, p *policy.Policy) error

func (*Store) UpdatePolicyIfVersion added in v1.7.0 

func (s *Store) UpdatePolicyIfVersion(ctx context.Context, p *policy.Policy, expected int) error

UpdatePolicyIfVersion writes p as UpdatePolicy does, only if the stored policy is at version expected. The version check is part of the UPDATE's WHERE clause, so the comparison and the write are one statement. When no row changes, a read picks the error: not found if the policy is absent from p's tenant, a version conflict otherwise. That read only chooses the error; the refusal itself was atomic.

p.UpdatedAt is set only once the write has happened, so a refused caller's struct does not claim a write that did not happen.

func (*Store) UpdateResourceType 

func (s *Store) UpdateResourceType(ctx context.Context, rt *resourcetype.ResourceType) error

func (*Store) UpdateRole 

func (s *Store) UpdateRole(ctx context.Context, r *role.Role) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.