sqlite

package
v0.1.5-0...-b5400da Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 22, 2026 License: MIT Imports: 21 Imported by: 0

Documentation

Overview

Package sqlite owns Plumtree's root-internal SQLCipher boundary.

The package intentionally does not select a repository or know the control schema. Later storage work can depend on this boundary without exposing a database driver through the SDK or command protocols.

Index

Constants

View Source 
const (
	KeySize            = 32
	DefaultBusyTimeout = 5 * time.Second
)

Variables

View Source 
var (
	// ErrSQLCipherUnavailable means that a keyed database was requested but the
	// binary was not built with the SQLCipher variant of the engine.
	ErrSQLCipherUnavailable = errors.New("sqlite: SQLCipher engine is unavailable")

	// ErrKeyRequired is returned when an encrypted database is opened without a
	// key. The database file is never inspected before this check.
	ErrKeyRequired = errors.New("sqlite: encryption key is required")

	// ErrInvalidKey means that the supplied raw key is not the required size.
	ErrInvalidKey = errors.New("sqlite: encryption key must be exactly 32 bytes")

	// ErrKeyRejected covers missing, wrong, and tampered SQLCipher keys without
	// echoing key material or a DSN in the error.
	ErrKeyRejected = errors.New("sqlite: encryption key rejected")
)
View Source 
var (
	ErrInvalid   = errors.New("sqlite repository: invalid input")
	ErrNotFound  = errors.New("sqlite repository: not found")
	ErrConflict  = errors.New("sqlite repository: conflict")
	ErrQuota     = errors.New("sqlite repository: quota exceeded")
	ErrSuspended = errors.New("sqlite repository: suspended")

	ErrInjectedStatement = errors.New("sqlite repository: injected statement failure")
	ErrInjectedCommit    = errors.New("sqlite repository: injected commit failure")
)

Functions

func Backup 

func Backup(ctx context.Context, destination, source *DB) error

Backup performs SQLite's online backup between two already validated pools. Source and destination must use matching plaintext/encrypted modes; mode conversion belongs to sqlcipher_export and is intentionally not implicit.

func EnsureSchema 

func EnsureSchema(ctx context.Context, db *DB) error

EnsureSchema creates the selected repository schema.

func Rekey 

func Rekey(ctx context.Context, db *DB, newKey []byte) error

Rekey changes the key of an already encrypted SQLCipher database. Empty to empty is a deliberate plaintext no-op; changing encryption mode requires a SQLCipher export and is not silently attempted by the engine boundary.

func SchemaStatements 

func SchemaStatements() []string

SchemaStatements returns a copy for inspection and qualification tooling.

func SchemaVersion 

func SchemaVersion() int

SchemaVersion is the current clean-break repository schema version.

func Verify 

func Verify(ctx context.Context, db *DB) error

Verify checks integrity without returning database contents.

func VerifyDigestBytes 

func VerifyDigestBytes(digest string, wasm []byte) bool

VerifyDigestBytes is used by deployment callers before entering a write transaction and by tests to prove that deduplicated bytes cannot change.

Types

type AccessKey 

type AccessKey struct {
	ID, AppID, Name, PublicKey, Fingerprint, AddedByDeviceID string
	CreatedAt                                                time.Time
}

AccessKey is an app-scoped public key. Private key material is never stored.

type AccessKeyInput 

type AccessKeyInput struct {
	ID, AppID, Name, PublicKey, Fingerprint, AddedByDeviceID string
	CreatedAt                                                time.Time
}

type App 

type App struct {
	ID, AuthorID, Name, Kind, AccessMode string
	Suspended                            bool
	CreatedAt, UpdatedAt                 time.Time
}

type AppInput 

type AppInput struct {
	ID, AuthorID, Name, Kind, AccessMode string
	CreatedByDeviceID                    string
	CreatedAt                            time.Time
}

AppInput describes an app owned by an author.

type ApplicationDeployment 

type ApplicationDeployment struct {
	App        App
	Deployment Deployment
	Artifact   ArtifactMetadata
}

type ApplicationDeploymentInput 

type ApplicationDeploymentInput struct {
	AuthorID, DeviceID, AppName, Kind, AccessMode, SourceDigest string
	PreviousDeploymentID                                        string
	Artifact                                                    ArtifactInput
}

ApplicationDeploymentInput is the authenticated, server-validated input to an atomic application replacement. Artifact identity is derived from WASM bytes by the repository; callers cannot choose its digest or size.

type ArtifactInput 

type ArtifactInput struct {
	ID, Digest    string
	WASM          []byte
	ABIVersion    int
	CreatedAt     time.Time
	BuildMetadata map[string]string
}

type ArtifactMetadata 

type ArtifactMetadata struct {
	ID, Digest string
	SizeBytes  int64
	ABIVersion int
	CreatedAt  time.Time
}

type AuditEvent 

type AuditEvent struct {
	ID, ScopeAuthorID, ActorKind, ActorAuthorID, ActorDeviceID               string
	Action, TargetKind, TargetID, ActorSnapshot, TargetSnapshot, DetailsJSON string
	OccurredAt                                                               time.Time
}

type AuditFilter 

type AuditFilter struct {
	ScopeAuthorID string
	Action        string
	TargetKind    string
	Before        time.Time
	Limit         int
}

type AuditInput 

type AuditInput struct {
	ID, ScopeAuthorID, ActorKind, ActorAuthorID, ActorDeviceID               string
	Action, TargetKind, TargetID, ActorSnapshot, TargetSnapshot, DetailsJSON string
}

type Author 

type Author struct {
	ID, Handle string
	Suspended  bool
	CreatedAt  time.Time
	UpdatedAt  time.Time
}

Author, Device, App, ArtifactMetadata, and Runnable are intentionally metadata-oriented DTOs. Runnable is the explicit exception that includes the validated artifact bytes.

type BootstrapAuthority 

type BootstrapAuthority struct {
	ID, Handle, DeviceName string
	Salt, Verifier         []byte
	FailedAttempts         int
	CreatedAt, ExpiresAt   time.Time
	ConsumedAt             *time.Time
}

BootstrapAuthority is local operator authority for one first-author registration. Verifier is internal proof material and must not be printed.

type BootstrapAuthorityInput 

type BootstrapAuthorityInput struct {
	ID, Handle, DeviceName string
	Salt, Verifier         []byte
	ExpiresAt              time.Time
}

type Budget 

type Budget struct {
	MaxElapsed        time.Duration
	MaxHeapBytes      uint64
	MaxRSSBytes       uint64
	MaxCPUTime        time.Duration
	MaxDatabaseBytes  int64
	MaxWALBytes       int64
	MaxDiskBytes      int64
	MaxDiskWriteBytes int64
	MaxBusyErrors     int
}

type CapabilityEntry 

type CapabilityEntry struct {
	Capability, Key string
	Value           []byte
	UpdatedAt       time.Time
}

type CommitEvent 

type CommitEvent struct {
	Operation string
	Kind      string
	ID        string
}

CommitEvent is published only after the corresponding transaction commits.

type Config 

type Config struct {
	Path                   string
	Key                    []byte
	BusyTimeout            time.Duration
	MaxOpenConns           int
	MaxIdleConns           int
	CacheSizeKB            int
	WALAutoCheckpointPages int
	Trace                  TraceFunc
}

Config controls one database handle. Key is a raw 32-byte key; it is copied when the handle is opened and is never included in the DSN.

func ProfileConfig 

func ProfileConfig(path string, key []byte, profile Profile, trace TraceFunc) (Config, error)

func (Config) String 

func (Config) String() string

String is intentionally non-diagnostic so configs can be included in structured logs without exposing a raw key or a caller-supplied DSN.

type DB 

type DB struct {
	*sql.DB
	// contains filtered or unexported fields
}

DB is a configured database pool. The embedded database handle is useful to the future repository while keeping the driver and its keying policy internal to the root module.

func Open 

func Open(path string, key []byte) (*DB, error)

Open opens and eagerly validates a database. A non-empty key always requires the SQLCipher build; ordinary SQLite can therefore never accidentally be used for production state.

func OpenWithConfig 

func OpenWithConfig(cfg Config) (*DB, error)

OpenWithConfig creates a private driver for this key policy, opens the pool, and pings it so key and tamper failures happen before the handle is returned.

func (*DB) Close 

func (db *DB) Close() error

Close releases the pool and clears the copied raw key.

func (*DB) Info 

func (db *DB) Info(ctx context.Context) (EngineInfo, error)

Info returns the engine identity and connection policy without exposing secrets. Callers can use this at release qualification time.

func (*DB) String 

func (*DB) String() string

String keeps the key and driver details out of fmt/log output.

type Deployment 

type Deployment struct {
	ID, AppID, ArtifactID, DeployedByDeviceID string
	CreatedAt                                 time.Time
}

type DeploymentInput 

type DeploymentInput struct {
	ID, AppID, ArtifactID, DeployedByDeviceID string
	CreatedAt                                 time.Time
}

type Device 

type Device struct {
	ID, AuthorID, Name, PublicKey, Fingerprint string
	CreatedAt                                  time.Time
	RevokedAt                                  *time.Time
}

type DeviceEnrollmentInput 

type DeviceEnrollmentInput struct {
	TokenID, DeviceID, PublicKey, Fingerprint string
	Verifier                                  []byte
}

DeviceEnrollmentInput contains only the public material for the new device; verifier bytes are compared and discarded inside the transaction.

type EngineInfo 

type EngineInfo struct {
	CipherVersion  string
	CompileOptions []string
	JournalMode    string
	Encrypted      bool
}

EngineInfo is a non-secret identity and capability description of the opened engine. It intentionally contains no path, DSN, or key data.

type EnrollmentToken 

type EnrollmentToken struct {
	ID, AuthorID, Purpose, IssuedByKind, IssuedByDeviceID, IntendedDeviceName string
	Salt, Verifier                                                            []byte
	FailedAttempts                                                            int
	CreatedAt, ExpiresAt                                                      time.Time
	ConsumedAt                                                                *time.Time
}

type EnrollmentTokenInput 

type EnrollmentTokenInput struct {
	ID, AuthorID, Purpose, IssuedByKind, IssuedByDeviceID, IntendedDeviceName string
	Salt, Verifier                                                            []byte
	ExpiresAt                                                                 time.Time
}

type Faults 

type Faults struct {
	Statement func(operation string) error
	Commit    func(operation string) error
}

Faults allows tests to fail a named mutation before a statement or commit. It is intentionally an internal test seam, not a production retry policy.

type GCResult 

type GCResult struct {
	AuditEvents, Sessions, Artifacts, Blobs int64
}

type GateResult 

type GateResult struct {
	Profile  Profile  `json:"profile"`
	Passed   bool     `json:"passed"`
	Failures []string `json:"failures,omitempty"`
}

func Evaluate 

func Evaluate(measurement Measurement, budget Budget) GateResult

type Measurement 

type Measurement struct {
	Profile          Profile       `json:"profile"`
	Operations       int           `json:"operations"`
	Elapsed          time.Duration `json:"elapsed"`
	HeapBytes        uint64        `json:"heapBytes"`
	RSSBytes         uint64        `json:"rssBytes"`
	CPUTime          time.Duration `json:"cpuTime"`
	DatabaseBytes    int64         `json:"databaseBytes"`
	WALBytes         int64         `json:"walBytes"`
	DiskBytes        int64         `json:"diskBytes"`
	DiskWriteBytes   int64         `json:"diskWriteBytes"`
	BusyErrors       int           `json:"busyErrors"`
	MetadataBlobRead bool          `json:"metadataBlobRead"`
}

func RunCorpus 

func RunCorpus(ctx context.Context, db *DB, profile Profile) (Measurement, error)

RunCorpus runs a deterministic metadata/blob workload. Metadata reads select only size and digest columns; blobs are written for deduplication but never selected by the qualification read path.

type MutationTx 

type MutationTx struct {
	// contains filtered or unexported fields
}

MutationTx exposes only guarded transaction operations. All writes use the driver's BEGIN IMMEDIATE mode configured by the engine DSN.

func (*MutationTx) ExecContext 

func (m *MutationTx) ExecContext(ctx context.Context, query string, args ...any) (sql.Result, error)

func (*MutationTx) QueryContext 

func (m *MutationTx) QueryContext(ctx context.Context, query string, args ...any) (*sql.Rows, error)

func (*MutationTx) QueryRowContext 

func (m *MutationTx) QueryRowContext(ctx context.Context, query string, args ...any) (*sql.Row, error)

type PairingCredential 

type PairingCredential struct {
	AuthorID, Handle, DeviceName string
	Salt, Verifier               []byte
	Generation                   int
}

type Profile 

type Profile string
const (
	ProfileTiny      Profile = "tiny"
	ProfilePR        Profile = "pr"
	ProfileScheduled Profile = "scheduled-stress"
)

type ProfileSettings 

type ProfileSettings struct {
	Operations             int
	BusyTimeout            time.Duration
	MaxOpenConns           int
	CacheSizeKB            int
	WALAutoCheckpointPages int
	Budget                 Budget
}

func Settings 

func Settings(profile Profile) (ProfileSettings, error)

type Quota 

type Quota struct {
	AuthorID                                        string
	MaxApps, MaxDeploymentsPerApp, MaxSecretsPerApp int
	MaxSessions                                     int
}

type RecoveryInput 

type RecoveryInput struct {
	AuthorID, DeviceID, DeviceName, PublicKey, Fingerprint string
	CurrentVerifier, NextSalt, NextVerifier                []byte
	RevokeOldDevices                                       bool
}

type RegistrationInput 

type RegistrationInput struct {
	AuthorID, Handle                             string
	DeviceID, DeviceName, PublicKey, Fingerprint string
	RecoverySalt, RecoveryVerifier               []byte
	CreatedAt                                    time.Time
	Quota                                        *Quota
}

type Repository 

type Repository struct {
	// contains filtered or unexported fields
}

Repository is a concrete local repository. It is deliberately not wired to the current control server until the later clean-break cutover.

func NewRepository 

func NewRepository(db *DB, options ...RepositoryOption) (*Repository, error)

NewRepository initializes schema v1 on an already opened engine.

func OpenRepository 

func OpenRepository(path string, key []byte, options ...RepositoryOption) (*Repository, error)

OpenRepository opens the configured engine and initializes schema v1.

func (*Repository) ActivateDeployment 

func (r *Repository) ActivateDeployment(ctx context.Context, appID, deploymentID string) error

func (*Repository) AddAccessKey 

func (r *Repository) AddAccessKey(ctx context.Context, input AccessKeyInput) (AccessKey, error)

func (*Repository) App 

func (r *Repository) App(ctx context.Context, appID string) (App, error)

App returns an app metadata record without deployment bytes.

func (*Repository) Author 

func (r *Repository) Author(ctx context.Context, authorID string) (Author, error)

Author returns an author without recovery material.

func (*Repository) BootstrapAuthorityCredential 

func (r *Repository) BootstrapAuthorityCredential(ctx context.Context, id string) (BootstrapAuthority, error)

BootstrapAuthorityCredential returns the bounded proof record used by the pairing subsystem. The completion transaction still rechecks all fields.

func (*Repository) CapabilityConfig 

func (r *Repository) CapabilityConfig(ctx context.Context, appID string) ([]CapabilityEntry, error)

func (*Repository) CapabilityValues 

func (r *Repository) CapabilityValues(ctx context.Context, appID string) ([]CapabilityEntry, error)

func (*Repository) Close 

func (r *Repository) Close() error

func (*Repository) CompleteBootstrapRegistration 

func (r *Repository) CompleteBootstrapRegistration(ctx context.Context, authorityID string, verifier []byte, input RegistrationInput) (Author, Device, error)

CompleteBootstrapRegistration consumes the local authority in the same immediate transaction that creates the author, recovery verifier, device, quota, and audit event.

func (*Repository) CompleteDeviceEnrollment 

func (r *Repository) CompleteDeviceEnrollment(ctx context.Context, input DeviceEnrollmentInput) (Device, error)

CompleteDeviceEnrollment verifies and consumes an add-device token while inserting the device in the same immediate transaction. Failed proofs only advance the bounded attempt counter; they never reveal token ownership.

func (*Repository) CompleteRecovery 

func (r *Repository) CompleteRecovery(ctx context.Context, input RecoveryInput) (Device, error)

CompleteRecovery enrolls the replacement key, rotates recovery material, invalidates invitations, and optionally revokes old devices in one write.

func (*Repository) CreateApp 

func (r *Repository) CreateApp(ctx context.Context, input AppInput) (App, error)

func (*Repository) CreateBootstrapAuthority 

func (r *Repository) CreateBootstrapAuthority(ctx context.Context, input BootstrapAuthorityInput) (BootstrapAuthority, error)

func (*Repository) CreateDeployment 

func (r *Repository) CreateDeployment(ctx context.Context, input DeploymentInput) (Deployment, error)

func (*Repository) CreateEnrollmentToken 

func (r *Repository) CreateEnrollmentToken(ctx context.Context, input EnrollmentTokenInput) (EnrollmentToken, error)

func (*Repository) CurrentDeployment 

func (r *Repository) CurrentDeployment(ctx context.Context, appID string) (Deployment, ArtifactMetadata, error)

func (*Repository) DB 

func (r *Repository) DB() *DB

func (*Repository) DeployApplication 

func (r *Repository) DeployApplication(ctx context.Context, input ApplicationDeploymentInput) (ApplicationDeployment, error)

DeployApplication performs app creation/reconciliation, deduplicated blob storage, deployment insertion, active-pointer replacement, and redacted audit in one immediate transaction. Replaced deployments remain when an open session references them and are collected after that session ends.

func (*Repository) Deployment 

func (r *Repository) Deployment(ctx context.Context, deploymentID string) (Deployment, App, error)

func (*Repository) Device 

func (r *Repository) Device(ctx context.Context, deviceID string) (Device, error)

Device returns a device without exposing recovery or enrollment material.

func (*Repository) DeviceByFingerprint 

func (r *Repository) DeviceByFingerprint(ctx context.Context, fingerprint string) (Device, error)

DeviceByFingerprint resolves one active device for SSH public-key authentication. Revoked devices remain auditable through Device and ListDevices but can never authenticate the control transport.

func (*Repository) EndSession 

func (r *Repository) EndSession(ctx context.Context, sessionID string) (*time.Time, error)

func (*Repository) EnrollmentCredential 

func (r *Repository) EnrollmentCredential(ctx context.Context, tokenID string) (PairingCredential, error)

EnrollmentCredential returns active add-device proof material to the bounded SSH pairing handler. It is never part of the control API response.

func (*Repository) EnrollmentSalt 

func (r *Repository) EnrollmentSalt(ctx context.Context, tokenID string) ([]byte, error)

EnrollmentSalt returns only the non-secret salt for an unconsumed token.

func (*Repository) GarbageCollect 

func (r *Repository) GarbageCollect(ctx context.Context, before time.Time) (GCResult, error)

GarbageCollect removes only unreferenced blobs/artifacts and expired operational history. The complete cleanup is one immediate transaction.

func (*Repository) ListAccessKeys 

func (r *Repository) ListAccessKeys(ctx context.Context, authorID, appID string) ([]AccessKey, error)

ListAccessKeys returns only public-key metadata for an author's app.

func (*Repository) ListApps 

func (r *Repository) ListApps(ctx context.Context, authorID string) ([]App, error)

func (*Repository) ListArtifactMetadata 

func (r *Repository) ListArtifactMetadata(ctx context.Context, limit int) ([]ArtifactMetadata, error)

func (*Repository) ListAudit 

func (r *Repository) ListAudit(ctx context.Context, scopeAuthorID string, limit int) ([]AuditEvent, error)

func (*Repository) ListAuditFiltered 

func (r *Repository) ListAuditFiltered(ctx context.Context, filter AuditFilter) ([]AuditEvent, error)

ListAuditFiltered keeps filtering in SQL so a caller cannot bypass the scope or accidentally truncate a large author's history in memory.

func (*Repository) ListDevices 

func (r *Repository) ListDevices(ctx context.Context, authorID string) ([]Device, error)

ListDevices lists all devices for an author, including revoked records, so local audit and recovery tooling can explain the complete lifecycle.

func (*Repository) ListEgressHosts 

func (r *Repository) ListEgressHosts(ctx context.Context, appID string) ([]string, error)

func (*Repository) ListSecrets 

func (r *Repository) ListSecrets(ctx context.Context, appID string) ([]SecretMetadata, error)

func (*Repository) ListSessions 

func (r *Repository) ListSessions(ctx context.Context, appID string, limit int) ([]Session, error)

func (*Repository) PruneAudit 

func (r *Repository) PruneAudit(ctx context.Context, before time.Time) (int64, error)

PruneAudit removes only audit rows. It deliberately does not invoke the broader repository garbage collector, so audit retention cannot remove sessions or unreferenced artifacts as a side effect.

func (*Repository) PutArtifact 

func (r *Repository) PutArtifact(ctx context.Context, input ArtifactInput) (ArtifactMetadata, error)

func (*Repository) RecordSessionLog 

func (r *Repository) RecordSessionLog(ctx context.Context, sessionID, log string, truncated bool) error

func (*Repository) RecoveryCredential 

func (r *Repository) RecoveryCredential(ctx context.Context, handle string) (PairingCredential, error)

RecoveryCredential resolves an author handle to the current recovery proof material for the pairing handler. The material never leaves the server.

func (*Repository) RecoverySalt 

func (r *Repository) RecoverySalt(ctx context.Context, authorID string) ([]byte, error)

RecoverySalt returns only the non-secret salt needed to verify caller-held recovery material. The stored verifier is never returned.

func (*Repository) RegisterAuthor 

func (r *Repository) RegisterAuthor(ctx context.Context, input RegistrationInput) (Author, Device, error)

RegisterAuthor atomically creates author, recovery, first device, and audit state. Recovery material is accepted only as verifier bytes and is never copied into the audit record.

func (*Repository) RemoveAccessKey 

func (r *Repository) RemoveAccessKey(ctx context.Context, authorID, appID, keyID, actorDeviceID string) error

RemoveAccessKey authorizes the actor and removes one app-scoped key in the same transaction, returning not-found for another author's key.

func (*Repository) RenameAuthor 

func (r *Repository) RenameAuthor(ctx context.Context, authorID, newHandle string, reserveUntil time.Time) error

RenameAuthor reserves the former handle before changing the active handle. Both writes are in one immediate transaction, so handle reuse cannot race.

func (*Repository) ResolveRunnable 

func (r *Repository) ResolveRunnable(ctx context.Context, authorID, appName string) (Runnable, error)

func (*Repository) RetireAuthor 

func (r *Repository) RetireAuthor(ctx context.Context, authorID string, verifier []byte, reserveUntil time.Time) error

RetireAuthor removes an author and cascades owned state while retaining a delayed handle tombstone. A non-empty verifier is required for recovery; the local operator form intentionally passes nil and is not network-exposed.

func (*Repository) RevokeDevice 

func (r *Repository) RevokeDevice(ctx context.Context, deviceID, byKind, byID string) error

func (*Repository) RevokeDeviceAuthorized 

func (r *Repository) RevokeDeviceAuthorized(ctx context.Context, authorID, actorDeviceID, targetDeviceID string) error

RevokeDeviceAuthorized performs equal-device revocation and last-device protection inside one immediate transaction, closing the check-then-act race that a service-side device count would otherwise leave.

func (*Repository) RevokeDeviceWithRecovery 

func (r *Repository) RevokeDeviceWithRecovery(ctx context.Context, authorID string, verifier []byte, targetDeviceID string) error

RevokeDeviceWithRecovery is the offline recovery equivalent of equal-device revocation. Recovery may revoke a device but cannot remove the last one.

func (*Repository) RotateRecovery 

func (r *Repository) RotateRecovery(ctx context.Context, authorID string, currentVerifier, newSalt, newVerifier []byte) error

RotateRecovery atomically checks the current verifier and replaces recovery material. The verifier itself is never returned or written to audit.

func (*Repository) Secret 

func (r *Repository) Secret(ctx context.Context, appID, key string) (SecretMetadata, []byte, error)

func (*Repository) ServerIdentity 

func (r *Repository) ServerIdentity(ctx context.Context) (ServerIdentity, error)

func (*Repository) SetCapabilityConfig 

func (r *Repository) SetCapabilityConfig(ctx context.Context, appID, capability, key, value string) error

func (*Repository) SetCapabilityValue 

func (r *Repository) SetCapabilityValue(ctx context.Context, appID, capability, key string, value []byte) error

func (*Repository) SetDeploymentSuspended 

func (r *Repository) SetDeploymentSuspended(ctx context.Context, deploymentID string, suspended bool) error

func (*Repository) SetEgressHost 

func (r *Repository) SetEgressHost(ctx context.Context, appID, host string, allowed bool) error

func (*Repository) SetQuota 

func (r *Repository) SetQuota(ctx context.Context, q Quota) error

func (*Repository) SetSecret 

func (r *Repository) SetSecret(ctx context.Context, appID, key string, value []byte) (SecretMetadata, error)

func (*Repository) SetSecretDelete 

func (r *Repository) SetSecretDelete(ctx context.Context, appID, key string) error

func (*Repository) SetServerIdentity 

func (r *Repository) SetServerIdentity(ctx context.Context, identity ServerIdentity) error

func (*Repository) StartSession 

func (r *Repository) StartSession(ctx context.Context, s Session) error

func (*Repository) VerifyEnrollmentToken 

func (r *Repository) VerifyEnrollmentToken(ctx context.Context, tokenID string, verifier []byte) (EnrollmentToken, error)

VerifyEnrollmentToken atomically consumes only a correct, unexpired token. Wrong proofs increment the bounded failure counter without revealing token existence to an unauthorised caller.

type RepositoryOption 

type RepositoryOption func(*Repository)

RepositoryOption configures the SQLite repository.

func WithCommitListener 

func WithCommitListener(listener func(CommitEvent) error) RepositoryOption

func WithRepositoryClock 

func WithRepositoryClock(now func() time.Time) RepositoryOption

func WithRepositoryFaults 

func WithRepositoryFaults(faults Faults) RepositoryOption

type Runnable 

type Runnable struct {
	App          App
	DeploymentID string
	Artifact     ArtifactMetadata
	WASM         []byte
}

type SecretMetadata 

type SecretMetadata struct {
	AppID, Key string
	Version    int
	CreatedAt  time.Time
	UpdatedAt  time.Time
}

type ServerIdentity 

type ServerIdentity struct {
	ID                    string
	SSHHostKeyAlgorithm   string
	SSHHostKeyFingerprint string
	CreatedAt             time.Time
}

ServerIdentity is the persisted stable server identity and host-key pin.

type Session 

type Session struct {
	ID, AppID, DeploymentID, ArtifactDigest, Log, LeafIdentitySummary string
	StartedAt                                                         time.Time
	EndedAt                                                           *time.Time
	LogTruncated                                                      bool
}

type TraceEvent 

type TraceEvent struct {
	Kind      string
	Statement string
	Duration  time.Duration
}

TraceEvent is deliberately statement-only: expanded SQL is never captured, so bound secrets and artifact values cannot enter qualification logs.

type TraceFunc 

type TraceFunc func(TraceEvent)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.