Warden

PostgreSQL Store

Production-grade PostgreSQL store using grove ORM with pgdriver.

The PostgreSQL store uses grove ORM with the pgdriver backend and includes Go-based migrations.

Usage

import (
    "github.com/xraph/grove"
    "github.com/xraph/grove/drivers/pgdriver"
    "github.com/xraph/warden/store/postgres"
)

db, err := grove.Open(pgdriver.New(
    pgdriver.WithDSN("postgres://user:pass@localhost:5432/warden"),
))
if err != nil {
    log.Fatal(err)
}

pgStore := postgres.New(db)
defer pgStore.Close()

// Run migrations (creates tables if they don't exist)
if err := pgStore.Migrate(ctx); err != nil {
    log.Fatal(err)
}

Migrations

The store includes Go-based migrations that create:

TablePurpose
warden_rolesRoles with hierarchy
warden_permissionsPermissions (resource + action)
warden_role_permissionsRole-permission attachments
warden_assignmentsRole assignments to subjects
warden_relationsReBAC relation tuples
warden_policiesABAC policies (JSONB conditions)
warden_resource_typesResource type definitions
warden_check_logsAuthorization check audit trail

All tables include:

  • tenant_id column for multi-tenant isolation
  • Appropriate indexes for query performance
  • Unique constraints to prevent duplicates

JSONB Fields

Complex fields are stored as JSONB:

  • warden_policies.subjects[]string
  • warden_policies.actions[]string
  • warden_policies.resources[]string
  • warden_policies.conditions[]Condition
  • warden_policies.metadatamap[string]any
  • warden_resource_types.relations[]RelationDef
  • warden_resource_types.permissions[]PermissionDef

When to Use

  • Production deployments
  • Multi-instance services (shared database)
  • When you need ACID transactions and durability

On this page