Read-only Toggle #60
Open
Read-only Toggle #60
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
Greptile Summary
Confidence Score: 2/5
Important Files Changed
|
![greptile-apps[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
8 files reviewed, 5 comments
Edit Code Review Agent Settings | Greptile
React with 👍 or 👎 to share your feedback on this new summary format
fangpenlin
requested changes
Nov 19, 2025
Comment on lines
+38
to
+46
| if r.config.ReadOnlyMode { | ||
| isReadOnly, err := r.handleReadOnlyCheck(query) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| if !isReadOnly { | ||
| return nil, mysql.NewError(mysql.ER_OPTION_PREVENTS_STATEMENT, "Operation not allowed by policy in read-only mode.") | ||
| } | ||
| } |
Contributor
There was a problem hiding this comment.
Seems like repeating, extracted into some thing like
err = checkReadOnly(...)
if err != nil {
return ...
}instead?
Comment on lines
+151
to
+174
| dialect := sqi.DialectMySQL | ||
| strict := false | ||
| options := sqi.IdentifyOptions{ | ||
| Dialect: &dialect, | ||
| Strict: &strict, | ||
| } | ||
|
|
||
| identifiedQueries, err := sqi.Identify(query, options) | ||
| if err != nil { | ||
| log.Error(). | ||
| Str("sessionID", r.config.SessionID). | ||
| Str("query", query). | ||
| Err(err). | ||
| Msg("Failed to identify query; blocking in read-only mode.") | ||
| return false, err | ||
| } | ||
|
|
||
| // verify that every statement in the query is read-only | ||
| for _, identifiedQuery := range identifiedQueries { | ||
| if identifiedQuery.ExecutionType != sqi.ExecutionListing && identifiedQuery.ExecutionType != sqi.ExecutionInformation { | ||
| log.Warn(). | ||
| Str("sessionID", r.config.SessionID). | ||
| Str("query", query). | ||
| Str("executionType", string(identifiedQuery.ExecutionType)). |
Contributor
There was a problem hiding this comment.
There should be automatic unit test tests covering different SQL statements trying to see if it can parse them correctly and detect write syntax. One test case for mysql and another for postgresql.
Comment on lines
+786
to
+804
| for _, identifiedQuery := range identifiedQueries { | ||
| if identifiedQuery.ExecutionType != sqi.ExecutionListing && identifiedQuery.ExecutionType != sqi.ExecutionInformation { | ||
| log.Warn(). | ||
| Str("sessionID", p.config.SessionID). | ||
| Str("query", queryContent). | ||
| Str("executionType", string(identifiedQuery.ExecutionType)). | ||
| Msg("Write query blocked in read-only mode.") | ||
|
|
||
| errorResponse := &pgproto3.ErrorResponse{ | ||
| Severity: "ERROR", | ||
| Code: "42803", // insufficient_privilege | ||
| Message: "Operation not allowed by policy in read-only mode.", | ||
| } | ||
| clientBackend.Send(errorResponse) | ||
| _ = clientBackend.Flush() | ||
| errChan <- fmt.Errorf("write query blocked: %s (type: %s)", queryContent, identifiedQuery.ExecutionType) | ||
| return false | ||
| } | ||
| } |
Comment on lines
+73
to
+81
| if r.config.ReadOnlyMode { | ||
| isReadOnly, err := r.handleReadOnlyCheck(query) | ||
| if err != nil { | ||
| return 0, 0, nil, err | ||
| } | ||
| if !isReadOnly { | ||
| return 0, 0, nil, mysql.NewError(mysql.ER_OPTION_PREVENTS_STATEMENT, "Operation not allowed by policy in read-only mode.") | ||
| } | ||
| } |
Comment on lines
+91
to
+99
| if r.config.ReadOnlyMode { | ||
| isReadOnly, err := r.handleReadOnlyCheck(query) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| if !isReadOnly { | ||
| return nil, mysql.NewError(mysql.ER_OPTION_PREVENTS_STATEMENT, "Operation not allowed by policy in read-only mode.") | ||
| } | ||
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Read-only toggle for PAM DB