$ show prest/prest
pREST is a production-grade Go HTTP server that automatically exposes PostgreSQL databases as RESTful and MCP (Model Context Protocol) APIs without requiring hand-written backend code. It provides instant CRUD endpoints for any table, custom SQL template execution with parameterized queries, and a built-in Studio web UI for exploring and managing APIs. The system is architected around a hexagonal pattern with a clean adapter interface supporting multiple databases (PostgreSQL, TimescaleDB), dependency injection for controllers, and a layered middleware stack for authentication (JWT), authorization (table/field-level ACL), caching, and CORS. Security is a primary concern: SQL injection is mitigated through strict identifier validation, template parameter screening, and bound parameter binding, while credential leakage in logs is prevented by a dedicated redaction package. The codebase is well-tested with both unit tests (using sqlmock) and integration tests (against real PostgreSQL in Docker), and includes OpenTelemetry integration for observability. It is not a data research or analytics project; it is a pure application for building low-code database APIs.
The LLM identified 3 files worth highlighting for reuse:
Provides strict SQL identifier validation and quoting with character allow-lists, length limits (128 characters), and rejection of keywords/special sequences. The `IsValid` and `Quote` functions are self-contained and reusable in any Go project that needs to safely handle database object names, preventing SQL injection through identifier manipulation. Demonstrates a defensive security pattern that is easy to extract and apply.
Implements a set of custom Go template functions (`sqlVal`, `sqlList`, `ident`) that safely bind user-supplied values into SQL templates while isolating raw values from the template execution context. The registry removes raw value maps from template dot before rendering, preventing accidental exposure of security-sensitive data. This pattern is reusable for any project using Go's text/template to construct SQL statements with parameterized inputs.
A file-based cache implementation (using BuntDB) that prevents cross-user data leakage by deriving cache keys with SHA-256 of the authenticated username. This ensures that cached responses for one user cannot be served to another, even if the underlying cache store is shared. The pattern is self-contained, demonstrates a security-conscious caching design, and can be extracted for use in applications requiring per-identity cache isolation.