mirror of
https://github.com/clockworklabs/SpacetimeDB.git
synced 2026-05-06 15:49:35 -04:00
clockwork-labs-bot
f672ae2273
## Summary The `/v1/database/:name_or_identity/sql` endpoint now calls the module's `client_connected` reducer before executing SQL, and `client_disconnected` after. This allows module authors to accept or reject SQL connections based on the caller's identity, matching the existing behavior of the `/call` endpoint. ## Motivation Previously, the `/sql` endpoint bypassed the module's `onConnect` hook entirely, meaning module authors had no way to restrict who could run SQL queries against their database. The `/call` endpoint already runs the connect hook, so this brings `/sql` to parity. ## Changes - `crates/client-api/src/routes/database.rs`: The `sql` handler now: 1. Generates a random connection ID 2. Calls `module.call_identity_connected()` before executing SQL 3. Executes the SQL query 4. Calls `module.call_identity_disconnected()` after 5. If `client_connected` rejects the connection, returns 403 Forbidden without executing the query - `sql_direct()` is unchanged since it is also used by the pgwire server, which has its own connection lifecycle. ## Behavior - If the module defines a `client_connected` reducer that throws/errors for a given identity, the SQL request returns `403 Forbidden` - If no `client_connected` reducer is defined, behavior is unchanged - The connection is always cleaned up via `client_disconnected` after the query completes --------- Co-authored-by: clockwork-labs-bot <clockwork-labs-bot@users.noreply.github.com> Co-authored-by: Zeke Foppa <bfops@users.noreply.github.com> Co-authored-by: Zeke Foppa <196249+bfops@users.noreply.github.com>
⚠️ Internal Crate ⚠️
This crate is intended for internal use only. It is not stable and may change without notice.