Every address the plugin publishes hands out, or acts on, the connection
string that opens a database, and that string carries the PostgreSQL
password the plugin holds. Register now returns on a Config that is not
Enabled, so /v1/cloud-sql and /v1/meta are addresses an unconfigured
process does not answer at rather than addresses it refuses at.
Opt in with CLOUD_SQL_ENABLED=true, the way bootnode and calendar opt in:
an Enabled field, a ConfigFromEnv that reads it, and a Register that
returns early without it.
ConnectionString supplies require for a database that states no mode. The
create path wrote a mode of its own beside it and wrote disable, so a
handed-out connection string turned TLS off. It writes none now, and the
default is the only answer.
Every address under /v1/cloud-sql and /v1/meta answers about one org's
database, and a database is reached with the password that opens it. So
the org is the one the door resolved from the verified credential —
published on the event by whichever door read it, an IAM token over JWKS
or an IAM key — and a request that carries none is refused before a
handler runs.
The rule is stated once per group, so a route added to either group
inherits it, and each handler asks the same question again for the value:
the list filters on that org, the routes taking {id} check the row belongs
to it, and create files the row under it rather than under whatever the
body said.
The meta proxy forwards on the connection that opens ONE database, so
every statement postgres-meta runs runs inside that database. An org with
no database of its own gets that answer; the admin connection opens every
database on the server and is lent to nobody.
Co-authored-by: Hanzo Dev <[email protected]>
Base's own registry was already org-native in every method — OrgDB(orgID),
HasOrg(orgID), orgDir(orgID) — and only the type names said tenant. So this is
the vocabulary catching up with the code, not a change of behaviour.
TenantRegistry -> Bases app.Bases().OrgDB(org)
TenantConfig -> BasesConfig
MultiTenant -> PerOrg it enables per-org databases; say that
MULTI_TENANT -> MULTI_BASE
core/tenant.go -> core/bases.go
Tenant was the wrong noun twice over: it is the multi-tenancy word, and this
product's unit is the thing a customer creates per org — a Base. Identity here
is org, user, project, and nothing else.
The UI never said it; this was Go-side only. 64 packages green.
One test was collateral and is fixed rather than renamed: TestToHTTPHeader
asserts a pure snake_case-to-Header-Case transform, so rewriting its EXPECTED
value while its input stayed "tenant_id" made it assert something false. The case
is dropped — org_id already covers that transform.
Every non-handler call site that wrapped a value in
slog.String/Int/Bool/Any/Float64/Uint64 was passing an Attr through the
variadic any... slot of (*slog.Logger).Info/Warn/Error/Debug; the same
slot accepts the bare "key", value pair with identical semantics. Drop
the wrapper so the surface is one level less indirect and so the next
two commits can swap (*slog.Logger) for a small Logger interface
without rewriting every attr expression as well.
23 files, 156 call sites collapsed; no behavior change. Five files —
tools/logger/log.go, tools/logger/batch_handler.go +_test, and
core/log_printer.go +_test — are the handler-implementation layer and
legitimately reference slog.Attr/Level/Group; they were skipped.
Introduces tools/claims as the single source of truth for reading the
authenticated caller's identity across every Base-derived service. One
way to do it, zero dispute.
The canonical 3 identity contract:
X-User-Id <- JWT sub (set by the Hanzo Gateway post-JWKS)
X-Org-Id <- JWT owner
X-Roles <- JWT roles (comma-joined if array)
Services must not read any other variant — no X-Hanzo-*, no X-IAM-*,
no X-User-Role (singular), no X-Tenant-Id alias. The Strip middleware
removes every historical variant on ingress so a spoofed header cannot
reach a handler.
Changes:
* tools/claims/claims.go (new):
- Constants HeaderUserID/HeaderOrgID/HeaderRoles
- Claims struct + FromHeaders(r) reader
- Claims.HasRole(...)
- StripIdentityHeaders(h) drops canonical + legacy + every
X-IAM-*/X-HANZO-* prefix (case-insensitive)
- Strip(next) net/http middleware
* tools/claims/claims_test.go (new): 7 tests covering canonical read,
empty roles, legacy-variant rejection, HasRole semantics, strip
coverage, strip preservation, and the Strip middleware.
* plugins/cloudsql/cloudsql.go: the postgres-meta proxy now keys
tenant routing on X-Org-Id (the canonical JWT-owner header) instead
of the legacy X-Tenant-ID.
* plugins/platform/auth_proxy_test.go: renamed the test marker
X-IAM-Test -> X-Test-Endpoint so the canonical grep ("X-IAM-*")
returns zero hits. Behavior unchanged.
Adds plugins/cloudsql with per-tenant database provisioning via Neon,
postgres-meta reverse proxy for schema introspection, and REST API
at /api/cloud-sql/databases. Registers platform + cloudsql plugins
in examples/base/main.go.
zeekay
