skor - Now part of Hasura GraphQL Engine. Listen to postg

项目说明

Skor

New and impro of Skor is now part of Hasura GraphQL 引擎

A few months ago, we built the open 源码 GraphQL 引擎 that gives you instant GraphQL APIs over any Postgres 数据库. We ha all of Skor's existing features and even more to make it production ready:

1) Reliable: We capture every relevant action on the 数据库 as an event, even when Hasura is down! The events are delivered to your webhook as soon as possible with an atleast-once guarantee.

2) Scalable: What more, it e horizontally. If you are processing millions of events, just add more instances of GraphQL 引擎.

3) Use with Ser: If you are using Skor, then avoid the pain of managing your webhook by moving to Ser infrastructure. Check out these blog posts to get started

Use Hasura GraphQL 引擎 for production use cases

---

skor is a utility for Postgres which calls a webhook with row changes as JSON whenever an INSERT, UPDATE or DELETE event occurs on a particular table.
You can drop the docker image next to your Postgres 数据库 instance and configure a webhook that will be called.

It works using a pg_notify trigger function and a tiny C program skor that listens to the notifications and calls the configured webhook with a JSON payload.

When to use

When you want to trigger an action in an external application when a table row is modified.

When you want a lightweight notification system for changes in the 数据库.

When you want to send the changes to a message queue such as AMQP, Kafka etc.

How it works

A PostgreSQL stored procedure is set up as a trigger on the required table(s). This trigger uses PostgreSQL's LISTEN and NOTIFY to publish change events as JSON to a notification channel. Skor watches this channel for messages and when a message is received, it makes an HTTP POST call to the webhook with the JSON payload. The webhook can then decide to take an action on this.

!Skor Architecture Diagram

Caveats

Events are only captured when skor is running.

If a call to the webhook fails, it is not retried.

Getting started

1) Set up the triggers:

We need to setup triggers on the tables that we we are interested in. Create a triggers.json file (see sample.triggers.json) with the required tables and events.

Note: This command requires python3.

2) Run Skor:

Run the skor Docker image (that has the skor binary baked in):

Make sure you use the appropriate 数据库 parameters and webhook URL above.

Examples

INSERT

Query:

JSON webhook payload:

UPDATE

Query:

JSON webhook payload:

DELETE

Query:

JSON webhook payload:

Uninstalling

To remove the skor related functions and triggers that were added to Postgres, run this in psql:

Deploying Skor on Hasura

The pre-built Docker image with the skor binary is a at hasura/skor and can be deployed as a microservice with the sample k8s.yaml in this repo.
The webhook can be another microservice that exposes an endpoint.

To learn more on deploying microservices on Hasura you may check out the documentation.

Build Skor:

Requirements:

PostgreSQL 9+

gcc

libcurl (libcurl4-openssl-dev)

libppq (libpq-dev)

Build:

Run:

Test

1. Install the requirements specified in tests/requirements.txt
2. The tests assume that you have a local postgres instance at localhost:5432 and a database called skor_test which can be accessed by an admin user.
3. Run skor on this 数据库 with the webhook url set to
4. run run_tests.sh script in the tests directory.

Contributing

Contributions are welcome!

Please check out the contributing guide to learn about setting up the de en and building the project. Also look at the issues page and help us in improving Skor!

项目信息

开发语言：C

Star 数：1242

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Now part of Hasura GraphQL 引擎. Listen to postgres events and forward them as JSON payloads to a webhook展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。