snapshot of https://github.com/ory/keto.git (master, 2026-09-16; blobs > 131072B omitted)

oryx/crdbx/isolation.go

@@ -0,0 +1,32 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package crdbx
+
+import (
+	"github.com/ory/pop/v6"
+	"github.com/ory/x/dbal"
+	"github.com/ory/x/sqlcon"
+)
+
+// SetTransactionReadCommitted lowers the isolation of the current transaction
+// to READ COMMITTED on CockroachDB. Multi-statement read transactions at
+// SERIALIZABLE must refresh their whole read set when a concurrent write
+// bumps the transaction timestamp, and surface RETRY_SERIALIZABLE to the
+// client when the refresh fails; under READ COMMITTED every statement reads
+// at its own timestamp and those conflicts are absorbed server-side. Must be
+// called before the transaction runs its first query. Postgres already runs
+// statements at READ COMMITTED by default, and MySQL's SET TRANSACTION
+// applies to the next transaction rather than the current one, so every
+// other dialect is a no-op. YugabyteDB maps READ COMMITTED to snapshot
+// isolation unless yb_enable_read_committed_isolation is enabled, so it stays
+// on the normal transaction retry path instead of using this CockroachDB-only
+// override.
+func SetTransactionReadCommitted(c *pop.Connection) error {
+	if c.Dialect.Name() != dbal.DriverCockroachDB {
+		// Only CockroachDB supports and needs this.
+		return nil
+	}
+
+	return sqlcon.HandleError(c.RawQuery("SET TRANSACTION ISOLATION LEVEL READ COMMITTED").Exec())
+}

oryx/crdbx/readonly.go

@@ -0,0 +1,24 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package crdbx
+
+import (
+	"github.com/ory/pop/v6"
+
+	"github.com/ory/x/dbal"
+	"github.com/ory/x/sqlcon"
+)
+
+// SetTransactionReadOnly sets the current transaction to read only for
+// CockroachDB, PostgreSQL, and YugabyteDB, which all let the server skip
+// write-path bookkeeping and reject accidental writes. Must be called before the
+// transaction runs its first query. MySQL's SET TRANSACTION applies to the
+// next transaction rather than the current one, and SQLite has no
+// equivalent, so every other dialect is a no-op.
+func SetTransactionReadOnly(c *pop.Connection) error {
+	if dbal.IsPostgresCompatible(c.Dialect.Name()) {
+		return sqlcon.HandleError(c.RawQuery("SET TRANSACTION READ ONLY").Exec())
+	}
+	return nil
+}

oryx/crdbx/staleness.go

@@ -0,0 +1,110 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package crdbx
+
+import (
+	"net/http"
+
+	"github.com/ory/x/dbal"
+
+	"github.com/ory/pop/v6"
+
+	"github.com/ory/x/sqlcon"
+)
+
+// Control API consistency guarantees
+//
+// swagger:model consistencyRequestParameters
+type ConsistencyRequestParameters struct {
+	// Read Consistency Level (preview)
+	//
+	// The read consistency level determines the consistency guarantee for reads:
+	//
+	// - strong (slow): The read is guaranteed to return the most recent data committed at the start of the read.
+	// - eventual (very fast): The result will return data that is about 4.8 seconds old.
+	//
+	// The default consistency guarantee can be changed in the Ory Network Console or using the Ory CLI with
+	// `ory patch project --replace '/previews/default_read_consistency_level="strong"'`.
+	//
+	// Setting the default consistency level to `eventual` may cause regressions in the future as we add consistency
+	// controls to more APIs. Currently, the following APIs will be affected by this setting:
+	//
+	// - `GET /admin/identities`
+	//
+	// This feature is in preview and only available in Ory Network.
+	//
+	// required: false
+	// in: query
+	Consistency ConsistencyLevel `json:"consistency"`
+}
+
+// ConsistencyLevel is the consistency level.
+// swagger:enum ConsistencyLevel
+type ConsistencyLevel string
+
+const (
+	// ConsistencyLevelUnset is the unset / default consistency level.
+	ConsistencyLevelUnset ConsistencyLevel = ""
+	// ConsistencyLevelStrong is the strong consistency level.
+	ConsistencyLevelStrong ConsistencyLevel = "strong"
+	// ConsistencyLevelEventual is the eventual consistency level using follower read timestamps.
+	ConsistencyLevelEventual ConsistencyLevel = "eventual"
+)
+
+// ConsistencyLevelFromRequest extracts the consistency level from a request.
+func ConsistencyLevelFromRequest(r *http.Request) ConsistencyLevel {
+	return ConsistencyLevelFromString(r.URL.Query().Get("consistency"))
+}
+
+// ConsistencyLevelFromString converts a string to a ConsistencyLevel.
+// If the string is not recognized or unset, ConsistencyLevelStrong is returned.
+func ConsistencyLevelFromString(in string) ConsistencyLevel {
+	switch in {
+	case string(ConsistencyLevelStrong):
+		return ConsistencyLevelStrong
+	case string(ConsistencyLevelEventual):
+		return ConsistencyLevelEventual
+	case string(ConsistencyLevelUnset):
+		return ConsistencyLevelUnset
+	}
+	return ConsistencyLevelStrong
+}
+
+// SetTransactionConsistency sets the transaction consistency level for CockroachDB.
+func SetTransactionConsistency(c *pop.Connection, level ConsistencyLevel, fallback ConsistencyLevel) error {
+	q := getTransactionConsistencyQuery(c.Dialect.Name(), level, fallback)
+	if len(q) == 0 {
+		return nil
+	}
+
+	return sqlcon.HandleError(c.RawQuery(q).Exec())
+}
+
+const transactionFollowerReadTimestamp = "SET TRANSACTION AS OF SYSTEM TIME follower_read_timestamp()"
+
+func getTransactionConsistencyQuery(dialect string, level ConsistencyLevel, fallback ConsistencyLevel) string {
+	if dialect != dbal.DriverCockroachDB {
+		// Only CockroachDB supports this.
+		return ""
+	}
+
+	switch level {
+	case ConsistencyLevelStrong:
+		// Nothing to do
+		return ""
+	case ConsistencyLevelEventual:
+		// Jumps to end of function
+	case ConsistencyLevelUnset:
+		fallthrough
+	default:
+		if fallback != ConsistencyLevelEventual {
+			// Nothing to do
+			return ""
+		}
+
+		// Jumps to end of function
+	}
+
+	return transactionFollowerReadTimestamp
+}