mirror of
https://github.com/clockworklabs/SpacetimeDB.git
synced 2026-07-23 10:36:53 -04:00
clockwork-labs-bot
f672ae2273
## Summary The `/v1/database/:name_or_identity/sql` endpoint now calls the module's `client_connected` reducer before executing SQL, and `client_disconnected` after. This allows module authors to accept or reject SQL connections based on the caller's identity, matching the existing behavior of the `/call` endpoint. ## Motivation Previously, the `/sql` endpoint bypassed the module's `onConnect` hook entirely, meaning module authors had no way to restrict who could run SQL queries against their database. The `/call` endpoint already runs the connect hook, so this brings `/sql` to parity. ## Changes - `crates/client-api/src/routes/database.rs`: The `sql` handler now: 1. Generates a random connection ID 2. Calls `module.call_identity_connected()` before executing SQL 3. Executes the SQL query 4. Calls `module.call_identity_disconnected()` after 5. If `client_connected` rejects the connection, returns 403 Forbidden without executing the query - `sql_direct()` is unchanged since it is also used by the pgwire server, which has its own connection lifecycle. ## Behavior - If the module defines a `client_connected` reducer that throws/errors for a given identity, the SQL request returns `403 Forbidden` - If no `client_connected` reducer is defined, behavior is unchanged - The connection is always cleaned up via `client_disconnected` after the query completes --------- Co-authored-by: clockwork-labs-bot <clockwork-labs-bot@users.noreply.github.com> Co-authored-by: Zeke Foppa <bfops@users.noreply.github.com> Co-authored-by: Zeke Foppa <196249+bfops@users.noreply.github.com>
24 lines
599 B
TOML
24 lines
599 B
TOML
[package]
|
|
name = "spacetimedb-pg"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license-file = "LICENSE"
|
|
description = "Postgres wire protocol Server support for SpacetimeDB"
|
|
|
|
[dependencies]
|
|
spacetimedb-auth.workspace = true
|
|
spacetimedb-client-api-messages.workspace = true
|
|
spacetimedb-client-api.workspace = true
|
|
spacetimedb-lib.workspace = true
|
|
|
|
anyhow.workspace = true
|
|
async-trait.workspace = true
|
|
axum.workspace = true
|
|
futures.workspace = true
|
|
http.workspace = true
|
|
log.workspace = true
|
|
pgwire.workspace = true
|
|
thiserror.workspace = true
|
|
tokio.workspace = true
|