RomanNum3ral
/
claw-code
mirror of https://github.com/instructkr/claw-code.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
claw-code/.guardrails/mcp-server/internal/database/DATABASE_REVIEW.md

7.3 KiB
Raw Blame History

Database Layer Review Summary

Review Date: 2026-02-07

Reviewer: PostgreSQL Expert Agent

Critical Issues Fixed

1. SQL Injection Vulnerabilities (CRITICAL)

Problem: Dynamic query building using fmt.Sprintf with user input in List methods:

  • documents.go: List() method
  • rules.go: List() method
  • failures.go: List() method

Solution: Replaced string concatenation with type-safe query building using explicit parameter positions.

Files Modified:

  • /mcp-server/internal/database/documents.go
  • /mcp-server/internal/database/rules.go
  • /mcp-server/internal/database/failures.go

2. Missing Transaction Support (HIGH)

Problem: Write operations (Create, Update, Delete) were not wrapped in transactions, risking data inconsistency on failures.

Solution: Added transaction wrapping for all write operations with proper commit/rollback handling.

Files Modified:

  • /mcp-server/internal/database/documents.go
  • /mcp-server/internal/database/rules.go
  • /mcp-server/internal/database/projects.go
  • /mcp-server/internal/database/failures.go

3. Inconsistent Error Handling (MEDIUM)

Problem:

  • Raw errors returned without wrapping
  • Using err == sql.ErrNoRows instead of errors.Is()
  • Missing context in error messages

Solution:

  • Added errors import
  • Replaced err == sql.ErrNoRows with errors.Is(err, sql.ErrNoRows)
  • All errors now wrapped with fmt.Errorf("...: %w", err)

Schema Improvements

Migration 003: Automatic Timestamps and Search Vector

File: migrations/003_add_triggers.up.sql

  • Added update_updated_at_column() trigger function
  • Added update_document_search_vector() trigger function
  • Triggers automatically maintain:
    • updated_at timestamp on all tables
    • Full-text search vector on documents table

Migration 004: Index Optimization

File: migrations/004_fix_indexes.up.sql

  • Removed redundant idx_documents_slug (slug is UNIQUE)
  • Added missing idx_rules_rule_id index
  • Added composite idx_rules_enabled_severity for active rule queries
  • Added idx_documents_created for time-based queries
  • Added idx_failures_status_severity for dashboard queries
  • Added idx_rules_pattern_hash for pattern lookups

Migration 005: Schema Versioning

File: migrations/005_schema_versioning.up.sql

  • Created schema_migrations table for tracking applied migrations
  • Supports checksum validation for migration integrity

Migration 006: Partition Management

File: migrations/006_partition_management.up.sql

  • Added create_monthly_partition() function
  • Added ensure_future_partitions() function
  • Automatically creates partitions for upcoming months
  • Supports both failure_registry and audit_log tables

Connection Pool Enhancements

File: /mcp-server/internal/database/postgres.go

Changes:

  1. Retry Logic: Added pingWithRetry() with exponential backoff
  2. Health Check Enhancement: Added pool capacity monitoring
  3. Pool Stats: Added PoolStats() method for metrics
  4. Constants: Extracted magic numbers to named constants

New File: Transaction Helper

File: /mcp-server/internal/database/tx.go

  • WithTransaction(): Standard transaction wrapper with panic recovery
  • WithTransactionReadOnly(): Read-only transaction wrapper
  • Error type checking functions:
    • IsUniqueViolation()
    • IsForeignKeyViolation()
    • IsSerializationFailure()
    • IsDeadlockDetected()

Model Validation

Document Model

File: /mcp-server/internal/models/document.go

Added Validate() method checking:

  • Required fields (slug, title, content, category, path)
  • Field length limits
  • Valid category values
  • Version defaults

Prevention Rule Model

File: /mcp-server/internal/models/rule.go

Added Validate() method checking:

  • Required fields (rule_id, name, pattern, message)
  • Field length limits
  • Valid severity values

Project Model

File: /mcp-server/internal/models/project.go

Added Validate() method checking:

  • Required fields (name, slug)
  • Field length limits
  • Valid slug format (alphanumeric, hyphens, underscores)

Failure Entry Model

File: /mcp-server/internal/models/failure.go

Added Validate() method checking:

  • Required fields (failure_id, category, severity, error_message)
  • Valid severity values (critical, high, medium, low)
  • Valid status values
  • Field length limits

Security Improvements

Search Query Sanitization

File: /mcp-server/internal/database/documents.go

  • Added sanitizeSearchQuery() function
  • Validates query length (max 200 chars)
  • Removes dangerous characters
  • Prevents FTS operator injection
  • Checks for balanced parentheses

Performance Optimizations

  1. Covering Indexes: Added covering indexes for common queries to avoid table lookups
  2. Partial Indexes: Added partial indexes on enabled = true for active rules
  3. GIN Indexes: Maintained GIN indexes for JSONB and array columns
  4. Composite Indexes: Added composite indexes for multi-column filters

Files Created

  1. /mcp-server/internal/database/migrations/003_add_triggers.up.sql
  2. /mcp-server/internal/database/migrations/003_add_triggers.down.sql
  3. /mcp-server/internal/database/migrations/004_fix_indexes.up.sql
  4. /mcp-server/internal/database/migrations/004_fix_indexes.down.sql
  5. /mcp-server/internal/database/migrations/005_schema_versioning.up.sql
  6. /mcp-server/internal/database/migrations/005_schema_versioning.down.sql
  7. /mcp-server/internal/database/migrations/006_partition_management.up.sql
  8. /mcp-server/internal/database/migrations/006_partition_management.down.sql
  9. /mcp-server/internal/database/tx.go

Files Modified

  1. /mcp-server/internal/database/postgres.go - Connection pool and retry logic
  2. /mcp-server/internal/database/documents.go - SQL injection fix, transactions, error handling
  3. /mcp-server/internal/database/rules.go - SQL injection fix, transactions, error handling
  4. /mcp-server/internal/database/projects.go - Transactions, error handling
  5. /mcp-server/internal/database/failures.go - SQL injection fix, transactions, error handling
  6. /mcp-server/internal/models/document.go - Added validation
  7. /mcp-server/internal/models/rule.go - Added validation
  8. /mcp-server/internal/models/project.go - Added validation
  9. /mcp-server/internal/models/failure.go - Added validation

Compliance Status

  • SQL injection vulnerabilities fixed
  • Transaction support added for all write operations
  • Error handling standardized with proper wrapping
  • Database indexes optimized
  • Automatic timestamp maintenance via triggers
  • Full-text search vector auto-updates
  • Schema versioning implemented
  • Partition management automated
  • Model validation added
  • Connection pool metrics available
  • Transaction helper utilities created

Recommendations for Future Work

  1. Add Database Tests: Create comprehensive unit tests for all store methods
  2. Query Logging: Add slow query logging for performance monitoring
  3. Connection Pool Tuning: Monitor pool metrics and adjust based on load
  4. Migration Tooling: Consider using a migration framework like golang-migrate
  5. Prepared Statements: Consider using prepared statements for frequently executed queries
  6. Read Replicas: If scaling requires, add support for read replica connections