maskedfields

Documentation

Overview

Package maskedfields tells a REST caller which columns in a response may have been masked.

Postgres cannot omit a column: the result-set shape is fixed by the target list and identical for every row, so a column the caller may not read comes back as NULL — and on the wire that is indistinguishable from a value that is genuinely null. The masking is correct; the ambiguity is what this closes.

Advisory only. Nothing here is an authorization input: the enforcement is the security labels and the planner rewrite in `supatype_mask`, and a caller who tampers with or ignores this header changes nothing about what they can read.

Index

• Constants
• func Middleware(next http.Handler) http.Handler

Constants

const Header = "X-Supatype-Masked-Fields"

Header names the columns on the requested table that carry a read restriction.

Each entry is `column=identity` or `column=row`:

X-Supatype-Masked-Fields: salary=row, ssn=identity

`identity` means the verdict is the same for every row in the response, so a null in that column is explicable by masking for the whole result set. `row` means it varies row by row, so only some nulls are masked values — honest imprecision rather than a claim the header cannot support.

Absent header means "not stated": either the table has no restricted columns or the classification could not be read. It never means "nothing is masked".

Functions

func Middleware

func Middleware(next http.Handler) http.Handler

Middleware annotates `/rest/v1` responses with the masked-field header.

Mounted outside the response cache deliberately, so the header is present on hits as well as misses. That is safe because the value is caller-independent — it describes the schema's restrictions, not one caller's verdicts — so a shared cache entry carrying it cannot disclose anything about the caller who happened to populate it.