core/abi/proto/v1/db.proto
Alex Dunmow 314a25353d feat(abi,auth): first-class uuid[] DbValue + trusted identity headers (WZ-016)
Two shared wasm-boundary fixes surfaced by the messenger port (WZ-013):

1. uuid[] DbValue variant. bnwasm had no uuid-array bind/scan, so every
   ANY($1::uuid[]) query broke in the guest ("unsupported argument type
   []uuid.UUID") and messenger worked around it with a ::text[]::uuid[] cast.
   Adds a dedicated DbValue.uuid_array_value (abiv1.UuidArray) — distinct from
   text[] so the host binds a native uuid[] param (queries keep ::uuid[]) and
   scans a uuid[] column straight into []uuid.UUID. Guest toDbValue marshals
   []uuid.UUID; naturalValue/assign parse the canonical strings back into
   []uuid.UUID (nil→NULL, empty stays empty). Pinned by the uuid_array entry in
   the shared DbValueFixtures contract (round-trip + driver-value tests green).

2. Trusted identity headers (auth/trustedheaders.go). Context does not cross
   the ABI, so guests cannot see the host's verified principal. The SECURE
   contract: the host runs its RBAC guard against the signature-verified JWT,
   strips any client-supplied copy of the X-Bn-Verified-* headers, and sets
   them itself from auth.Get{Public,}UserFromContext; the guest reconstructs
   context via auth.TrustedHeaderMiddleware and trusts ONLY those headers.
   Guests MUST NOT decode a client cookie/Bearer token for identity — that is a
   privilege-escalation bug (a verified public user forging an admin JWT the
   guest would honour on a RolePublic method). Documented in docs/wasm-abi.md,
   replacing the ambiguous "auth context reaches the guest via HttpRequest
   headers" line that invited the insecure decode.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-04 00:43:13 +08:00

120 lines
3.2 KiB
Protocol Buffer

// db.proto — DB driver messages (WO-WZ-001).
//
// The guest SDK ships a database/sql driver that marshals query text + args
// out through these messages and rows back, so sqlc-generated plugin code
// works unchanged. The host executes on a connection under the per-plugin
// Postgres role. Transactions map to a host-side handle held per guest call
// chain, with a hard deadline so a guest can never pin a connection.
syntax = "proto3";
package abi.v1;
import "google/protobuf/timestamp.proto";
option go_package = "git.dev.alexdunmow.com/block/core/abi/v1;abiv1";
// DbValue is one pgx-mappable parameter or column value.
message DbValue {
oneof kind {
// SQL NULL (the bool carries no information; true by convention).
bool null = 1;
bool bool_value = 2;
int64 int64_value = 3;
double float64_value = 4;
string string_value = 5;
bytes bytes_value = 6;
google.protobuf.Timestamp timestamp_value = 7;
// UUID in canonical string form.
string uuid_value = 8;
// JSON/JSONB payload bytes.
bytes jsonb_value = 9;
// NUMERIC in decimal string form (lossless).
string numeric_value = 10;
// text[] array.
TextArray text_array_value = 11;
// uuid[] array (each element canonical string form). Distinct from
// text_array so the host binds a native uuid[] parameter (letting a query
// keep `ANY($1::uuid[])` with no text[]-cast workaround) and scans a uuid[]
// column straight into []uuid.UUID.
UuidArray uuid_array_value = 12;
}
}
// TextArray is a Postgres text[] value.
message TextArray {
repeated string values = 1;
}
// UuidArray is a Postgres uuid[] value; each element is a canonical UUID
// string (matching DbValue.uuid_value's single-UUID encoding).
message UuidArray {
repeated string values = 1;
}
// DbRow is one result row; values align with DbRowsResponse.columns.
message DbRow {
repeated DbValue values = 1;
}
// DbError carries a database failure back to the guest driver.
message DbError {
// Postgres SQLSTATE when available (e.g. "23505"); empty otherwise.
string code = 1;
string message = 2;
}
// DbQueryRequest executes a rows-returning statement.
message DbQueryRequest {
string sql = 1;
repeated DbValue args = 2;
// Transaction handle from DbTxBeginResponse; 0 = no transaction
// (autocommit).
uint64 tx_handle = 3;
}
// DbRowsResponse returns the full buffered result set.
message DbRowsResponse {
repeated string columns = 1;
repeated DbRow rows = 2;
DbError error = 3;
}
// DbExecRequest executes a statement without returning rows.
message DbExecRequest {
string sql = 1;
repeated DbValue args = 2;
// Transaction handle from DbTxBeginResponse; 0 = no transaction.
uint64 tx_handle = 3;
}
message DbExecResponse {
int64 rows_affected = 1;
DbError error = 2;
}
// DbTxBeginRequest opens a host-side transaction for this call chain.
message DbTxBeginRequest {}
message DbTxBeginResponse {
// Opaque handle referencing the host-side transaction; never 0 on success.
uint64 tx_handle = 1;
DbError error = 2;
}
message DbTxCommitRequest {
uint64 tx_handle = 1;
}
message DbTxCommitResponse {
DbError error = 1;
}
message DbTxRollbackRequest {
uint64 tx_handle = 1;
}
message DbTxRollbackResponse {
DbError error = 1;
}