22281200145

Committed 22 Feb 2026 04:47PM UTC coverage: 52.1% (+0.2%) from 51.923%

Build # 22281200145

Build Type

Pull #2

github

Committed by

mostafa

Commit Message

Fix linter issues

Pull Request Pull Request #2: Authorization denial should result in error+ready-for-query

Coverage Stats

0 of 3 new or added lines in 1 file covered. (0.0%)

1 existing line in 1 file now uncovered.

459 of 881 relevant lines covered (52.1%)

5.1 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

60.47

/plugin/protocol.go

package plugin

import (
        "crypto/rand"
        "encoding/base64"
        "errors"
        "fmt"

        "github.com/gatewayd-io/gatewayd-plugin-sdk/databases/postgres"
        "github.com/jackc/pgx/v5/pgproto3"
        "github.com/spf13/cast"
)

var (
        // ErrNoParameters is returned when a startup message has no parameters.
        ErrNoParameters = errors.New("no parameters in startup message")
        // ErrNoUser is returned when a startup message has no user parameter.
        ErrNoUser = errors.New("no user in startup message")
)

// GenerateSalt generates a random salt of SaltSize bytes.
func GenerateSalt(_ int) ([SaltSize]byte, error) {
        var salt [SaltSize]byte
        if _, err := rand.Read(salt[:]); err != nil {
                return salt, fmt.Errorf("generating salt: %w", err)
        }
        return salt, nil
}

// BuildAuthFailResponse builds a Terminate+ErrorResponse for authentication failure.
func BuildAuthFailResponse(detail string) ([]byte, error) {
        return postgres.BuildTerminateWithError(
                ErrorMsgAuthFail,
                ErrorSeverity,
                ErrorCodeAuthFail,
                detail,
        )
}

// BuildAccessDeniedResponse builds an ErrorResponse+ReadyForQuery for authorization denial.
// Unlike auth failure, we use ReadyForQuery (not Terminate) so the client knows the
// server is ready for the next command — the session stays open after a denied query.
func BuildAccessDeniedResponse(detail string) ([]byte, error) {
        errResp := postgres.ErrorResponse(ErrorMsgDenied, ErrorSeverity, ErrorCodeDenied, detail)
        readyForQuery := &pgproto3.ReadyForQuery{TxStatus: 'I'}
        return readyForQuery.Encode(errResp)
}

// DecodeBase64Field decodes a base64-encoded string field from the request struct.
func DecodeBase64Field(encoded string) ([]byte, error) {
        return base64.StdEncoding.DecodeString(encoded)
}

// ParseStartupParams extracts user and database from a decoded startup message.
func ParseStartupParams(startupDecoded []byte) (string, string, error) {
        startupMap := cast.ToStringMap(string(startupDecoded))
        parameters := cast.ToStringMapString(startupMap["Parameters"])
        if parameters == nil {
                return "", "", ErrNoParameters
        }

        user := parameters[ParamUser]
        database := parameters[ParamDatabase]
        if user == "" {
                return "", "", ErrNoUser
        }

        return user, database, nil
}

// ParsePasswordMessage extracts the password from a decoded password message.
func ParsePasswordMessage(passwordDecoded []byte) map[string]string {
        return cast.ToStringMapString(string(passwordDecoded))
}

// GetClientRemote extracts the client remote address from the request fields.
func GetClientRemote(fields map[string]interface{}) string {
        if client, ok := fields["client"]; ok {
                clientMap := cast.ToStringMap(client)
                return cast.ToString(clientMap["remote"])
        }
        return ""
}

1	package plugin
2
3	import (
4	"crypto/rand"
5	"encoding/base64"
6	"errors"
7	"fmt"
8
9	"github.com/gatewayd-io/gatewayd-plugin-sdk/databases/postgres"
10	"github.com/jackc/pgx/v5/pgproto3"
11	"github.com/spf13/cast"
12	)
13
14	var (
15	// ErrNoParameters is returned when a startup message has no parameters.
16	ErrNoParameters = errors.New("no parameters in startup message")
17	// ErrNoUser is returned when a startup message has no user parameter.
18	ErrNoUser = errors.New("no user in startup message")
19	)
20
21	// GenerateSalt generates a random salt of SaltSize bytes.
22	func GenerateSalt(_ int) ([SaltSize]byte, error) {	3✔
23	var salt [SaltSize]byte	3✔
24	if _, err := rand.Read(salt[:]); err != nil {	3✔
25	return salt, fmt.Errorf("generating salt: %w", err)	×
26	}	×
27	return salt, nil	3✔
28	}
29
30	// BuildAuthFailResponse builds a Terminate+ErrorResponse for authentication failure.
31	func BuildAuthFailResponse(detail string) ([]byte, error) {	8✔
32	return postgres.BuildTerminateWithError(	8✔
33	ErrorMsgAuthFail,	8✔
34	ErrorSeverity,	8✔
35	ErrorCodeAuthFail,	8✔
36	detail,	8✔
37	)	8✔
38	}	8✔
39
40	// BuildAccessDeniedResponse builds an ErrorResponse+ReadyForQuery for authorization denial.
41	// Unlike auth failure, we use ReadyForQuery (not Terminate) so the client knows the
42	// server is ready for the next command — the session stays open after a denied query.
43	func BuildAccessDeniedResponse(detail string) ([]byte, error) {	×
NEW 44	errResp := postgres.ErrorResponse(ErrorMsgDenied, ErrorSeverity, ErrorCodeDenied, detail)	×
NEW 45	readyForQuery := &pgproto3.ReadyForQuery{TxStatus: 'I'}	×
NEW 46	return readyForQuery.Encode(errResp)	×
UNCOV 47	}	×
48
49	// DecodeBase64Field decodes a base64-encoded string field from the request struct.
50	func DecodeBase64Field(encoded string) ([]byte, error) {	11✔
51	return base64.StdEncoding.DecodeString(encoded)	11✔
52	}	11✔
53
54	// ParseStartupParams extracts user and database from a decoded startup message.
55	func ParseStartupParams(startupDecoded []byte) (string, string, error) {	7✔
56	startupMap := cast.ToStringMap(string(startupDecoded))	7✔
57	parameters := cast.ToStringMapString(startupMap["Parameters"])	7✔
58	if parameters == nil {	7✔
59	return "", "", ErrNoParameters	×
60	}	×
61
62	user := parameters[ParamUser]	7✔
63	database := parameters[ParamDatabase]	7✔
64	if user == "" {	7✔
65	return "", "", ErrNoUser	×
66	}	×
67
68	return user, database, nil	7✔
69	}
70
71	// ParsePasswordMessage extracts the password from a decoded password message.
72	func ParsePasswordMessage(passwordDecoded []byte) map[string]string {	4✔
73	return cast.ToStringMapString(string(passwordDecoded))	4✔
74	}	4✔
75
76	// GetClientRemote extracts the client remote address from the request fields.
77	func GetClientRemote(fields map[string]interface{}) string {	×
78	if client, ok := fields["client"]; ok {	×
79	clientMap := cast.ToStringMap(client)	×
80	return cast.ToString(clientMap["remote"])	×
81	}	×
82	return ""	×
83	}

gatewayd-io / gatewayd-plugin-auth / 22281200145

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous