Two shared wasm-boundary fixes surfaced by the messenger port (WZ-013):
1. uuid[] DbValue variant. bnwasm had no uuid-array bind/scan, so every
ANY($1::uuid[]) query broke in the guest ("unsupported argument type
[]uuid.UUID") and messenger worked around it with a ::text[]::uuid[] cast.
Adds a dedicated DbValue.uuid_array_value (abiv1.UuidArray) — distinct from
text[] so the host binds a native uuid[] param (queries keep ::uuid[]) and
scans a uuid[] column straight into []uuid.UUID. Guest toDbValue marshals
[]uuid.UUID; naturalValue/assign parse the canonical strings back into
[]uuid.UUID (nil→NULL, empty stays empty). Pinned by the uuid_array entry in
the shared DbValueFixtures contract (round-trip + driver-value tests green).
2. Trusted identity headers (auth/trustedheaders.go). Context does not cross
the ABI, so guests cannot see the host's verified principal. The SECURE
contract: the host runs its RBAC guard against the signature-verified JWT,
strips any client-supplied copy of the X-Bn-Verified-* headers, and sets
them itself from auth.Get{Public,}UserFromContext; the guest reconstructs
context via auth.TrustedHeaderMiddleware and trusts ONLY those headers.
Guests MUST NOT decode a client cookie/Bearer token for identity — that is a
privilege-escalation bug (a verified public user forging an admin JWT the
guest would honour on a RolePublic method). Documented in docs/wasm-abi.md,
replacing the ambiguous "auth context reaches the guest via HttpRequest
headers" line that invited the insecure decode.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
120 lines
3.2 KiB
Protocol Buffer
120 lines
3.2 KiB
Protocol Buffer
// db.proto — DB driver messages (WO-WZ-001).
|
|
//
|
|
// The guest SDK ships a database/sql driver that marshals query text + args
|
|
// out through these messages and rows back, so sqlc-generated plugin code
|
|
// works unchanged. The host executes on a connection under the per-plugin
|
|
// Postgres role. Transactions map to a host-side handle held per guest call
|
|
// chain, with a hard deadline so a guest can never pin a connection.
|
|
|
|
syntax = "proto3";
|
|
|
|
package abi.v1;
|
|
|
|
import "google/protobuf/timestamp.proto";
|
|
|
|
option go_package = "git.dev.alexdunmow.com/block/core/abi/v1;abiv1";
|
|
|
|
// DbValue is one pgx-mappable parameter or column value.
|
|
message DbValue {
|
|
oneof kind {
|
|
// SQL NULL (the bool carries no information; true by convention).
|
|
bool null = 1;
|
|
bool bool_value = 2;
|
|
int64 int64_value = 3;
|
|
double float64_value = 4;
|
|
string string_value = 5;
|
|
bytes bytes_value = 6;
|
|
google.protobuf.Timestamp timestamp_value = 7;
|
|
// UUID in canonical string form.
|
|
string uuid_value = 8;
|
|
// JSON/JSONB payload bytes.
|
|
bytes jsonb_value = 9;
|
|
// NUMERIC in decimal string form (lossless).
|
|
string numeric_value = 10;
|
|
// text[] array.
|
|
TextArray text_array_value = 11;
|
|
// uuid[] array (each element canonical string form). Distinct from
|
|
// text_array so the host binds a native uuid[] parameter (letting a query
|
|
// keep `ANY($1::uuid[])` with no text[]-cast workaround) and scans a uuid[]
|
|
// column straight into []uuid.UUID.
|
|
UuidArray uuid_array_value = 12;
|
|
}
|
|
}
|
|
|
|
// TextArray is a Postgres text[] value.
|
|
message TextArray {
|
|
repeated string values = 1;
|
|
}
|
|
|
|
// UuidArray is a Postgres uuid[] value; each element is a canonical UUID
|
|
// string (matching DbValue.uuid_value's single-UUID encoding).
|
|
message UuidArray {
|
|
repeated string values = 1;
|
|
}
|
|
|
|
// DbRow is one result row; values align with DbRowsResponse.columns.
|
|
message DbRow {
|
|
repeated DbValue values = 1;
|
|
}
|
|
|
|
// DbError carries a database failure back to the guest driver.
|
|
message DbError {
|
|
// Postgres SQLSTATE when available (e.g. "23505"); empty otherwise.
|
|
string code = 1;
|
|
string message = 2;
|
|
}
|
|
|
|
// DbQueryRequest executes a rows-returning statement.
|
|
message DbQueryRequest {
|
|
string sql = 1;
|
|
repeated DbValue args = 2;
|
|
// Transaction handle from DbTxBeginResponse; 0 = no transaction
|
|
// (autocommit).
|
|
uint64 tx_handle = 3;
|
|
}
|
|
|
|
// DbRowsResponse returns the full buffered result set.
|
|
message DbRowsResponse {
|
|
repeated string columns = 1;
|
|
repeated DbRow rows = 2;
|
|
DbError error = 3;
|
|
}
|
|
|
|
// DbExecRequest executes a statement without returning rows.
|
|
message DbExecRequest {
|
|
string sql = 1;
|
|
repeated DbValue args = 2;
|
|
// Transaction handle from DbTxBeginResponse; 0 = no transaction.
|
|
uint64 tx_handle = 3;
|
|
}
|
|
|
|
message DbExecResponse {
|
|
int64 rows_affected = 1;
|
|
DbError error = 2;
|
|
}
|
|
|
|
// DbTxBeginRequest opens a host-side transaction for this call chain.
|
|
message DbTxBeginRequest {}
|
|
|
|
message DbTxBeginResponse {
|
|
// Opaque handle referencing the host-side transaction; never 0 on success.
|
|
uint64 tx_handle = 1;
|
|
DbError error = 2;
|
|
}
|
|
|
|
message DbTxCommitRequest {
|
|
uint64 tx_handle = 1;
|
|
}
|
|
|
|
message DbTxCommitResponse {
|
|
DbError error = 1;
|
|
}
|
|
|
|
message DbTxRollbackRequest {
|
|
uint64 tx_handle = 1;
|
|
}
|
|
|
|
message DbTxRollbackResponse {
|
|
DbError error = 1;
|
|
}
|