vcatbridge

34 downloads this week 0 stars Extension descriptor

Add RLS to DuckDB

Compatibility Matrix

This table covers all DuckDB releases that have not reached end-of-life, including LTS releases, and shows the 2 most recent patch releases of each. Older patch releases are not listed, but the extension may be available for them as well.

Installing and Loading

INSTALL vcatbridge FROM community;
LOAD vcatbridge;

Example

-- On the SOURCE instance: register a bridge and grant tables.
LOAD vcatbridge;
SELECT vcatbridge_register_source('b1', 'source_catalog', 'my-secret');
SELECT vcatbridge_configure_policy('b1', '{
  "policy_version": 1,
  "tables": {
    "main.users": {"select": true, "update": "tenant_id = $tenant"}
  }
}');
SELECT vcatbridge_set_context('b1', 'tenant', 42);

-- On the TARGET instance (same process): redeem the token.
LOAD vcatbridge;
ATTACH '' AS my_bridge (TYPE vcatbridge, ID 'b1', TOKEN 'my-secret');
SELECT * FROM my_bridge.main.users;

About vcatbridge

Row-level security for DuckDB. A private source database shares selected tables with a target catalog in the same process, with per-table, per-verb grants and row rules.

Quack serves a DuckDB database over the network but can't limit which tables or rows clients see. Serve a vcatbridge catalog through Quack and clients only see what the policy allows.

Documentation: https://github.com/n6k-io/duckdb-virtual-catalog/blob/main/docs/vcatbridge.md

Added Functions

Overloaded Functions

This extension does not add any function overloads.

Added Types

This extension does not add any types.

Added Settings