wdevs/ResolveSpec
5
0
Fork 0
mirror of https://github.com/bitechdev/ResolveSpec.git synced 2026-10-01 12:31:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(security): stamp transaction-local settings on OnTxBegin in all specs

Browse Source
This commit is contained in:
warkanum
2026-09-30 22:55:26 +02:00
parent 3b93802a25
commit ff76eb8e1f
13 changed files with 386 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/funcspec/security_adapter.go
+6
View File
@@ -12,6 +12,12 @@ import (
// Note: funcspec operates on SQL queries directly, so row-level security is not directly applicable
// We provide auth enforcement and audit logging for data access tracking
func RegisterSecurityHooks(handler *Handler, securityList *security.SecurityList) {
// OnTxBegin: stamp transaction-local settings (e.g. RLS GUCs) before any SQL.
// Looked up per call so SetTxSettings may come after registration.
handler.Hooks().Register(OnTxBegin, func(hookCtx *HookContext) error {
return security.StampTxSettings(newFuncSpecSecurityContext(hookCtx), securityList, hookCtx.Tx)
})
// Hook 0: BeforeQueryList - Auth check before list query execution
handler.Hooks().Register(BeforeQueryList, func(hookCtx *HookContext) error {
if hookCtx.UserContext == nil || hookCtx.UserContext.UserID == 0 {