Built for teams with more than one database, more than one person touching them, and an obligation to explain afterwards who ran what and under which rules.
Each trade-off below has a source in the code or in an architecture decision record — that is the line underneath it.
When a gate itself breaks, the outcome falls to the stricter side: an unreadable rule table, a user with no roles at all — the verdict is refusal at the highest risk class. The code even numbers this principle, ED3. It is not unconditional — two places deliberately do not fail closed, and the security page spells both out.
gateway/risk.go:946 · bootstrap/script_scan_engine_test.go:13 · exceptions on the security page
Six entry points land on the same decision chain and the same audit chain, the open API included. This principle was taught by an incident: the asynchronous channel once let anyone blocked in the terminal resubmit the identical statement as a background job.
service/async_exec.go:48 · handler/openapi.go:19 · ADR 0006 / ADR 0012
A verdict returns a machine-readable rule reference rather than the word "refused": which rule matched, which class it belongs to, where it came from. The 87 built-in review rules work the same way: the ones lifted from the company standards each cite their clause.
review/builtin.go:13-33 · review/review.go:307 · model/rule_ref.go:103
The system judges and the system records, but the one who presses execute is always a specific human being — and terminal, release and window tickets each take a different shape, so they cannot be collapsed into one sentence. Terminal tickets: approval only authorises, someone still has to press execute, and every gate is recomputed against whoever actually presses the button (ADR 0010). Releases: execution belongs to the pipeline's execute stage, which waits until someone confirms, and the re-judgement then runs against the raiser's roles — the other way round. Execution-window and export tickets have no executable command at all.
ADR 0010 · service/approval_execute.go:68 · service/pipeline.go:752
| Console frontend | React 19 · TypeScript 5.7 · Vite 6 · Zustand 5 · TanStack Query 5 · React Router 7 · react-i18next 15 · xterm.js 5.5 · lucide-react |
|---|---|
| Backend | Go 1.25 · Gin v1.10.0 · GORM v1.25.12 · gorilla/websocket v1.5.3 |
| Cryptography | bcrypt · AES-256-GCM · HMAC-SHA256 · TOTP |
| The gateway’s own store | PostgreSQL 16 — the same store in development and production |
| Target databases | MySQL / PolarDB / TiDB / MariaDB · PostgreSQL / GaussDB (DWS) · Oracle |
The numbers below were measured against main, not copied out of the README — the README’s hard numbers have fallen behind the code.
| Backend tests | 311 test files and 993 test functions, of which 183 sit under internal/bootstrap as black-box httptest regressions |
|---|---|
| Console frontend tests | 291 unit cases in 36 files, 116 end-to-end cases in 10 files |
| Architecture decision records | 17 of them, under docs/adr/ |
This page used to announce an open-source licence, and that sentence had no source. Checking it: the db-gateway repository has no LICENSE file, the README has no licence section, and the git history contains no deleted one either. A repository with no LICENSE file is not, legally, one you may freely use — so this page leaves the question open.
The repository is on GitHub. Tickets and PRDs travel with the code as local markdown, defects found in code review are filed as GitHub Issues, and architecture decisions live in docs/adr/, 17 of them so far. Said up front: the repository has no CONTRIBUTING and no issue templates.
Open the repository