wdevs/ResolveSpec
5
0
Fork 0
mirror of https://github.com/bitechdev/ResolveSpec.git synced 2026-10-05 04:51:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(security): stamp transaction-local settings on OnTxBegin in all specs

Browse Source
This commit is contained in:
warkanum
2026-09-30 22:55:26 +02:00
parent 3b93802a25
commit ff76eb8e1f
13 changed files with 386 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/resolvemcp/security_hooks.go
+6
View File
@@ -19,6 +19,12 @@ import (
// - Column-level security: sensitive columns masked/hidden in read results.
// - Audit logging after each read.
func RegisterSecurityHooks(handler *Handler, securityList *security.SecurityList) {
// OnTxBegin: stamp transaction-local settings (e.g. RLS GUCs) before any SQL.
// Looked up per call so SetTxSettings may come after registration.
handler.Hooks().Register(OnTxBegin, func(hookCtx *HookContext) error {
return security.StampTxSettings(newSecurityContext(hookCtx), securityList, hookCtx.Tx)
})
// BeforeHandle: enforce model-level operation rules (auth check).
handler.Hooks().Register(BeforeHandle, func(hookCtx *HookContext) error {
if err := security.CheckModelAuthAllowed(newSecurityContext(hookCtx), hookCtx.Operation); err != nil {