Module public_http 

Transport-neutral policy and JSON bodies shared by the two /v1/sql/* HTTP hosts.

The hosts still own header extraction, project fencing, body limits, sockets, routing, and command admission. This module owns only decisions and bytes that must stay identical between rindle-replicator and standalone rindled.

Structs

SqlAuthorizationError

Enums

SqlIngressAuth

Authentication posture for the versioned public SQL surface.

Constants

RINDLE_REQUEST_ID_HEADER

Functions

authorize_sql_ingress

Apply the two-token authority rule after a host has supplied its header matcher.

cursor_history_lost

execute_public_read

Execute the shared public read path on a host-owned read connection. The host supplies its current committed cursor lookup; connection ownership stays outside.

refresh_generation_bound

Replace a generation-bound resource only after its successor opens successfully. Failed refreshes retain a healthy predecessor and stay retryable.

sql_success_body

Wrap statement results in the common write-authority success envelope. served_by names the authority role that actually answered — "master" on the replicator, "standalone" on a source-less daemon — so observability keyed on routing never invents a replication plane that isn’t there.

validate_public_request_id

Validate the optional public request-id header and build the shared typed rejection body.

validated_request_id

Return the one canonical request id, rejecting absent, duplicate, and malformed values alike. Callers use this only for response echo; absence therefore maps to None.