security

Documentation

Overview

Package security provides SQL injection prevention, parameter validation, and query security features for Relica.

Index

• func GetClientIP(ctx context.Context) string
• func GetRequestID(ctx context.Context) string
• func GetUser(ctx context.Context) string
• func WithClientIP(ctx context.Context, clientIP string) context.Context
• func WithRequestID(ctx context.Context, requestID string) context.Context
• func WithUser(ctx context.Context, user string) context.Context
• type AuditEvent
• type AuditLevel
• type Auditor
  • func NewAuditor(logger *slog.Logger, level AuditLevel) *Auditor
  • func (a *Auditor) LogOperation(ctx context.Context, operation, query string, args []any, result sql.Result, ...)
  • func (a *Auditor) LogSecurityEvent(ctx context.Context, eventType, query string, err error)
• type Validator
  • func NewValidator(opts ...ValidatorOption) *Validator
  • func (v *Validator) ValidateParams(params []any) error
  • func (v *Validator) ValidateQuery(query string) error
• type ValidatorOption
  • func WithStrict(strict bool) ValidatorOption

Functions

func GetClientIP

func GetClientIP(ctx context.Context) string

GetClientIP retrieves client IP from context (for testing/debugging).

func GetRequestID

func GetRequestID(ctx context.Context) string

GetRequestID retrieves request ID from context (for testing/debugging).

func GetUser

func GetUser(ctx context.Context) string

GetUser retrieves user from context (for testing/debugging).

func WithClientIP

func WithClientIP(ctx context.Context, clientIP string) context.Context

WithClientIP adds client IP to the context for audit logging.

func WithRequestID

func WithRequestID(ctx context.Context, requestID string) context.Context

WithRequestID adds request ID to the context for audit logging.

func WithUser

func WithUser(ctx context.Context, user string) context.Context

WithUser adds user information to the context for audit logging.

Types

type AuditEvent

type AuditEvent struct {
	Timestamp    time.Time `json:"timestamp"`
	User         string    `json:"user,omitempty"`        // User from context
	Operation    string    `json:"operation"`             // SELECT, INSERT, UPDATE, DELETE
	Table        string    `json:"table,omitempty"`       // Target table (if detectable)
	AffectedRows int64     `json:"affected_rows"`         // Number of rows affected
	SQL          string    `json:"sql"`                   // Query string
	ParamsHash   string    `json:"params_hash,omitempty"` // SHA256 hash of parameters
	ClientIP     string    `json:"client_ip,omitempty"`   // Client IP from context
	RequestID    string    `json:"request_id,omitempty"`  // Request ID from context
	Success      bool      `json:"success"`               // Whether operation succeeded
	Error        string    `json:"error,omitempty"`       // Error message if failed
	Duration     int64     `json:"duration_ms,omitempty"` // Query execution time in milliseconds
}

AuditEvent represents a single database operation for audit logging.

type AuditLevel

type AuditLevel int

AuditLevel defines the level of audit logging.

const (
	// AuditNone disables audit logging.
	AuditNone AuditLevel = iota
	// AuditWrites logs only write operations (INSERT, UPDATE, DELETE).
	AuditWrites
	// AuditReads logs read operations (SELECT) in addition to writes.
	AuditReads
	// AuditAll logs all database operations including utility commands.
	AuditAll
)

type Auditor

type Auditor struct {
	// contains filtered or unexported fields
}

Auditor handles audit logging of database operations.

func NewAuditor

func NewAuditor(logger *slog.Logger, level AuditLevel) *Auditor

NewAuditor creates a new audit logger.

func (*Auditor) LogOperation

func (a *Auditor) LogOperation(ctx context.Context, operation, query string, args []any, result sql.Result, err error, duration time.Duration)

LogOperation logs a database operation to the audit log.

func (*Auditor) LogSecurityEvent

func (a *Auditor) LogSecurityEvent(ctx context.Context, eventType, query string, err error)

LogSecurityEvent logs a security-related event (blocked query, validation failure, etc.).

type Validator

type Validator struct {
	// contains filtered or unexported fields
}

Validator validates SQL queries and parameters against dangerous patterns.

func NewValidator

func NewValidator(opts ...ValidatorOption) *Validator

NewValidator creates a new SQL injection validator with default dangerous patterns.

func (*Validator) ValidateParams

func (v *Validator) ValidateParams(params []any) error

ValidateParams checks query parameters for SQL injection attempts. Looks for suspicious string patterns that may bypass prepared statements.

func (*Validator) ValidateQuery

func (v *Validator) ValidateQuery(query string) error

ValidateQuery checks if a query contains dangerous SQL injection patterns. Returns an error if a dangerous pattern is detected.

type ValidatorOption

type ValidatorOption func(*Validator)

ValidatorOption configures the Validator.

func WithStrict

func WithStrict(strict bool) ValidatorOption

WithStrict enables strict validation mode (more aggressive).