Expand description
What makes a transaction run as the caller.
A request does nothing as itself. Its statements run on a pooled
connection logged in as the authenticator, and it is a handful of
statements at the top of the transaction that turn that connection into
the caller’s: the role row-level security and grants are checked against,
the claims a policy reads back with current_setting, the facts about the
request a function may want, and the configuration’s own pre-request
check. Get one of them wrong, or send it outside the transaction, and the
query runs as the authenticator with nothing set – which is to say with
no security at all, and no error to say so.
Session is those statements, worked out once. It knows nothing about
HTTP or about JWTs: the role and the claims come in as plain values, so it
serves a REST request, a GraphQL operation, or a hand-written route that
has a user and no request at all. It runs nothing itself either.
Session::statements says what would be sent, which is what the tests
look at, and Session::apply queues it on a Tx.
Structs§
- Session
- The statements that make a transaction run as a caller.
- Session
Statement - One statement a
Sessionsends, with its parameters.