Struct RlsGuc 

pub struct RlsGuc {
    pub tenant: String,
    pub session: Option<String>,
    pub all_marker: Option<String>,
}

Operator-configured SQL session-context GUC names carrying the host-resolved tenant (and the anonymous session) to an app’s Postgres RLS, so its policies (current_setting(name, true)) mirror boatramp’s injected tenancy predicate as a defense-in-depth backstop. Set on a managed / external SQL binding (the rls_session flag + these names, e.g. app.tenant_id). Postgres only — the backstop is the current_setting RLS pattern; a libsql/MySQL backend leaves these unset. The guest can NEVER set them itself (the reserved-write guard blocks the configured names, reject_reserved_session_writes); the host derives the value from the SAME resolution the injected predicate uses (own / target / session) or, for a posture-vetted all write, from the row/statement being written — the DB’s WITH CHECK / USING is the final arbiter of a mismatch.

Fields

tenant: String

The GUC carrying the resolved TENANT (e.g. app.tenant_id).

session: Option<String>

The GUC carrying the anonymous SESSION id (e.g. app.session_id), if the operator uses one.

all_marker: Option<String>

A reserved, host-controlled sentinel written to Self::tenant on an all-scoped READ (v0.4.21) — a value the operator guarantees can never be a real tenant id, so a table that opts in with USING (tenant_id = current_setting(name, true) OR current_setting(name, true) = '<marker>') opens cross-tenant for the audited all twins while every other table (and every write) stays strict. None ⇒ all reads leave the GUC untouched (v0.4.20 behavior: fail-closed). The guest can never set it — the whole Self::tenant namespace is reserved.

Implementations

impl RlsGuc

pub fn reserved_names(&self) -> Vec<String>

The configured GUC names, lowercased — the EXTRA reserved keys a guest may not set (on top of the always-reserved boatramp.* / @boatramp_*), so a guest can’t forge the RLS backstop.

Trait Implementations

impl Clone for RlsGuc

fn clone(&self) -> RlsGuc

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RlsGuc

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.