One request, from host to commit

One request, from host to commit A sequence diagram generated by Archify. GET /api/v1/task/tasks Host: tenant.example · Cookie: platformkit_session host → tenant (hosts cache, Tenants lister) headers · requestID · respond · csrf — X-Request-ID kept or minted, body held until commit cookie → tenancy.Principal db.Lazy: no transaction yet authorized call httpx.Auth: Public · SignedIn · Permission · OperatorPermission httpx.TxFrom(ctx) opens Tx[Tenant] set_config('platformkit.tenant_id', id, true) SELECT … (rows another tenant cannot see) rows on a write: events.Publish(ctx, tx, "task.task.created", …) same transaction: the outbox row commits with the task or not at all re-read settings · COMMIT 200 + body released refusal → ROLLBACK · application/problem+json · instance = request id Edge and identity Tenant transaction Commit and respond Browser · tenant.example · Sequence participant Browser tenant.example httpx root · kit/httpx/httpx.go · Sequence participant httpx root kit/httpx/httpx.go httpx tenant · + transaction · Sequence participant httpx tenant + transaction authenticate · + authorize · Sequence participant authenticate + authorize Handler · rest.Spec route · Sequence participant Handler rest.Spec route crud · kit/crud · Sequence participant crud kit/crud PostgreSQL · ROW LEVEL SECURITY · Sequence participant PostgreSQL ROW LEVEL SECURITY Outbox · events.Publish · Sequence participant Outbox events.Publish Legend request return security async trace default message

Lazy transaction

  • • db.Lazy: the tenant transaction opens on the first httpx.TxFrom(ctx), not in middleware
  • • A request that never queries never opens a transaction, so a dead database is not a failed page.

Row-level security

  • • db.Run sets set_config('platformkit.tenant_id', id, true); tenant tables carry FORCE ROW LEVEL SECURITY
  • • Only kit/db writes a platformkit.* setting; scripts/check_gucs.sh proves it.

Buffered response

  • • httpx root runs a.headers, a.requestID, a.respond, a.csrf; a.respond holds the body until COMMIT
  • • A refusal rolls back and answers application/problem+json with the request id as instance (kit/problem)