storage

package
v0.1.0-alpha Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 27, 2026 License: Apache-2.0 Imports: 22 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrAuditHeadConflict       = errors.New("audit head changed concurrently")
	ErrAuditedMutationRequired = errors.New("a storage-issued audited mutation is required")
)
View Source 
var (
	ErrEnrollmentRequestNotFound = errors.New("enrollment request not found")
	ErrEnrollmentRequestDecided  = errors.New("enrollment request has already been decided")
	ErrEnrollmentRequestExpired  = errors.New("enrollment request has expired")
	ErrCredentialReused          = errors.New("node credential has already been admitted or proposed")
	ErrNodeIdentityUsed          = errors.New("node identity has already been admitted or proposed")
)
View Source 
var (
	ErrEventSequenceConflict = errors.New("event sequence conflicts with a different stored event")
	ErrEventSequenceGap      = errors.New("event sequence is not contiguous")
	ErrEventBootRegression   = errors.New("event boot id was already closed")
	ErrEventNotFound         = errors.New("event not found")
)
View Source 
var (
	ErrEnrollmentTokenInvalid = errors.New("enrollment token is invalid")
	ErrEnrollmentTokenExpired = errors.New("enrollment token has expired")
	ErrEnrollmentTokenUsed    = errors.New("enrollment token has already been used")
	ErrNodeNotFound           = errors.New("node not found")
	ErrNodeRevoked            = errors.New("revoked node must be re-enrolled with new credentials")
	ErrOperationConflict      = errors.New("operation id has already been used")
)
View Source 
var (
	ErrRetentionProjectionNotReady = errors.New("required projection has not durably processed events")
	ErrRetentionIntegrity          = errors.New("event retention tombstone chain failed verification")
)
View Source 
var (
	ErrSecureActionNotFound      = errors.New("secure action not found")
	ErrSecureActionConflict      = errors.New("secure action id was reused with different input")
	ErrSecureActionAuditConflict = errors.New("secure action audit event id was reused with different input")
	ErrOneTimeGrantConsumed      = errors.New("one-time authorization was already consumed or expired")
	ErrInvalidActionLifecycle    = errors.New("secure action lifecycle transition is invalid")
)
View Source 
var ErrProgramConflict = errors.New("node already admits a program with this digest")

ErrProgramConflict reports that a node already has an admitted program with this content digest. The table carries two uniqueness guarantees, so a replay can trip either one; SQLite checks (node_id, program_digest) first.

Functions

func CommitAuditedMutation 

func CommitAuditedMutation(ctx context.Context, mutation AuditedMutation, entry model.AuditEntry) error

Types

type AuditHead 

type AuditHead struct {
	Count    uint64
	Sequence uint64
	Hash     string
}

type AuditedMutation 

type AuditedMutation interface {
	// contains filtered or unexported methods
}

AuditedMutation is a closed capability: only this package can implement it. Each implementation commits one reviewed domain transition and the supplied signed audit entry in the same SQLite transaction. This prevents callers from acknowledging an audit entry after an unrelated mutation committed.

type DB 

type DB struct {
	// contains filtered or unexported fields
}

func Open 

func Open(ctx context.Context, path string) (*DB, error)

func (*DB) AppendEvent 

func (database *DB) AppendEvent(ctx context.Context, event model.EventEnvelope) (bool, error)

func (*DB) AppendSecureActionLifecycleMutation 

func (database *DB) AppendSecureActionLifecycleMutation(
	eventID string,
	expected SecureActionRecord,
	nodeID, lifecycle string,
	requestDigest []byte,
	occurredAt, now time.Time,
) AuditedMutation

func (*DB) AppendSecureActionLifecycleWithAudit 

func (database *DB) AppendSecureActionLifecycleWithAudit(
	ctx context.Context,
	eventID string,
	expected SecureActionRecord,
	nodeID, lifecycle string,
	requestDigest []byte,
	occurredAt, now time.Time,
	entry model.AuditEntry,
) error

AppendSecureActionLifecycleWithAudit makes lifecycle event idempotency and one-time grant consumption part of the same transaction as the signed audit entry. The SDK_ACTION_EXECUTION_STARTED transition is the authoritative single-use boundary until a dedicated token-bearing consume call is added.

func (*DB) ApproveEnrollmentRequestMutation 

func (database *DB) ApproveEnrollmentRequestMutation(
	enrollmentID, actorID, operationID, reasonCode string,
	tags []string,
	now time.Time,
	node model.Node,
) AuditedMutation

func (*DB) ApproveEnrollmentRequestWithAudit 

func (database *DB) ApproveEnrollmentRequestWithAudit(
	ctx context.Context,
	enrollmentID, actorID, operationID, reasonCode string,
	tags []string,
	now time.Time,
	node model.Node,
	entry model.AuditEntry,
) error

func (*DB) AuditEntryMutation 

func (database *DB) AuditEntryMutation() AuditedMutation

func (*DB) Close 

func (database *DB) Close() error

func (*DB) CompareAndSwapNanoCursor 

func (database *DB) CompareAndSwapNanoCursor(ctx context.Context, programDigest, nodeID string, previous, next NanoCursorRecord, now time.Time) (bool, error)

CompareAndSwapNanoCursor advances a cursor only if it still equals the evaluation input. This prevents concurrent Core requests from both exposing a proposal for one schedule tick.

func (*DB) CompareAndSwapSecureActionMutation 

func (database *DB) CompareAndSwapSecureActionMutation(expected, next SecureActionRecord) AuditedMutation

func (*DB) CompareAndSwapSecureActionWithAudit 

func (database *DB) CompareAndSwapSecureActionWithAudit(ctx context.Context, expected, next SecureActionRecord, entry model.AuditEntry) error

CompareAndSwapSecureActionWithAudit replaces only the decision projection and lifecycle timestamps when every mutable field still matches the record the caller read. The audit entry is committed in the same transaction. This prevents a delayed evaluator or authorizer from clearing a consumed grant.

func (*DB) CountSecureActionsByDecision 

func (database *DB) CountSecureActionsByDecision(ctx context.Context, decision string) (int, error)

func (*DB) CreateEnrollmentToken 

func (database *DB) CreateEnrollmentToken(ctx context.Context, token EnrollmentTokenRecord) error

func (*DB) CreateEnrollmentTokenMutation 

func (database *DB) CreateEnrollmentTokenMutation(token EnrollmentTokenRecord) AuditedMutation

func (*DB) CreateEnrollmentTokenWithAudit 

func (database *DB) CreateEnrollmentTokenWithAudit(ctx context.Context, token EnrollmentTokenRecord, entry model.AuditEntry) error

func (*DB) CreateNanoWatchdogProgramMutation 

func (database *DB) CreateNanoWatchdogProgramMutation(record NanoWatchdogProgramRecord) AuditedMutation

func (*DB) CreateNanoWatchdogProgramWithAudit 

func (database *DB) CreateNanoWatchdogProgramWithAudit(ctx context.Context, record NanoWatchdogProgramRecord, entry model.AuditEntry) error

func (*DB) CreateSecureActionMutation 

func (database *DB) CreateSecureActionMutation(record SecureActionRecord) AuditedMutation

func (*DB) CreateSecureActionWithAudit 

func (database *DB) CreateSecureActionWithAudit(ctx context.Context, record SecureActionRecord, entry model.AuditEntry) error

CreateSecureActionWithAudit commits the initial decision and its signed audit entry in one SQLite transaction.

func (*DB) DenyEnrollmentRequestMutation 

func (database *DB) DenyEnrollmentRequestMutation(
	enrollmentID, actorID, operationID, reasonCode string,
	now time.Time,
) AuditedMutation

func (*DB) DenyEnrollmentRequestWithAudit 

func (database *DB) DenyEnrollmentRequestWithAudit(
	ctx context.Context,
	enrollmentID, actorID, operationID, reasonCode string,
	now time.Time,
	entry model.AuditEntry,
) error

func (*DB) EnrollNode 

func (database *DB) EnrollNode(ctx context.Context, tokenHash []byte, now time.Time, node model.Node) error

func (*DB) EnrollNodeRequestWithAudit 

func (database *DB) EnrollNodeRequestWithAudit(ctx context.Context, tokenHash []byte, now time.Time, requestID string, requestDigest []byte, node model.Node, entry model.AuditEntry) error

func (*DB) EnrollNodeWithAudit 

func (database *DB) EnrollNodeWithAudit(ctx context.Context, tokenHash []byte, now time.Time, node model.Node, entry model.AuditEntry) error

func (*DB) GetAuditHead 

func (database *DB) GetAuditHead(ctx context.Context) (AuditHead, error)

func (*DB) GetEnrollmentRequest 

func (database *DB) GetEnrollmentRequest(ctx context.Context, id string) (EnrollmentRequestRecord, error)

func (*DB) GetEnrollmentRequestByToken 

func (database *DB) GetEnrollmentRequestByToken(ctx context.Context, tokenID string) (EnrollmentRequestRecord, error)

func (*DB) GetEnrollmentToken 

func (database *DB) GetEnrollmentToken(ctx context.Context, tokenHash []byte, now time.Time) (EnrollmentTokenRecord, error)

func (*DB) GetEnrollmentTokenByOperation 

func (database *DB) GetEnrollmentTokenByOperation(ctx context.Context, operationID string) (EnrollmentTokenRecord, error)

func (*DB) GetEvent 

func (database *DB) GetEvent(ctx context.Context, eventID string) (model.EventEnvelope, error)

func (*DB) GetNanoWatchdogProgram 

func (database *DB) GetNanoWatchdogProgram(ctx context.Context, id string) (NanoWatchdogProgramRecord, error)

func (*DB) GetNanoWatchdogProgramByOperation 

func (database *DB) GetNanoWatchdogProgramByOperation(ctx context.Context, operationID string) (NanoWatchdogProgramRecord, error)

func (*DB) GetNode 

func (database *DB) GetNode(ctx context.Context, id string) (model.Node, error)

func (*DB) GetNodeEventState 

func (database *DB) GetNodeEventState(ctx context.Context, nodeID string) (NodeEventState, error)

func (*DB) GetProjectionCursor 

func (database *DB) GetProjectionCursor(ctx context.Context, projection string) (ProjectionCursor, error)

func (*DB) GetSecureAction 

func (database *DB) GetSecureAction(ctx context.Context, id string) (SecureActionRecord, error)

func (*DB) GetSecureActionAuditEvent 

func (database *DB) GetSecureActionAuditEvent(ctx context.Context, eventID string) (SecureActionAuditEventRecord, error)

func (*DB) GetSecureActionByOperationID 

func (database *DB) GetSecureActionByOperationID(ctx context.Context, operationID string) (SecureActionRecord, error)

func (*DB) GetSecureActionByRequestID 

func (database *DB) GetSecureActionByRequestID(ctx context.Context, requestID string) (SecureActionRecord, error)

func (*DB) GetSecureActionExecutionState 

func (database *DB) GetSecureActionExecutionState(ctx context.Context, actionID string) (SecureActionExecutionState, error)

func (*DB) Health 

func (database *DB) Health(ctx context.Context) error

func (*DB) InsertAuditEntry 

func (database *DB) InsertAuditEntry(ctx context.Context, entry model.AuditEntry) error

func (*DB) LastAuditHash 

func (database *DB) LastAuditHash(ctx context.Context) (string, error)

func (*DB) ListAuditEntries 

func (database *DB) ListAuditEntries(ctx context.Context, limit int) ([]model.AuditEntry, error)

func (*DB) ListAuditEntriesAfter 

func (database *DB) ListAuditEntriesAfter(ctx context.Context, afterSequence uint64, limit int) ([]model.AuditEntry, error)

func (*DB) ListEvents 

func (database *DB) ListEvents(ctx context.Context, after time.Time, limit int) ([]model.EventEnvelope, error)

func (*DB) ListEventsFromOrdinal 

func (database *DB) ListEventsFromOrdinal(ctx context.Context, afterOrdinal uint64, limit int) ([]model.EventEnvelope, error)

func (*DB) ListEventsPage 

func (database *DB) ListEventsPage(ctx context.Context, after time.Time, afterEventID string, limit int) ([]model.EventEnvelope, error)

func (*DB) ListLatestEventsForNode 

func (database *DB) ListLatestEventsForNode(ctx context.Context, nodeID string, kinds []string) ([]model.EventEnvelope, error)

ListLatestEventsForNode returns at most one durable event per requested kind, choosing the greatest observed time and then the greatest ingest ordinal. It is intentionally a storage read, not a cache, so topology and path views cannot outlive retention or report facts that were never committed.

func (*DB) ListNanoWatchdogPrograms 

func (database *DB) ListNanoWatchdogPrograms(ctx context.Context, nodeID string) ([]NanoWatchdogProgramRecord, error)

func (*DB) ListNodes 

func (database *DB) ListNodes(ctx context.Context) ([]model.Node, error)

func (*DB) ListSecureActions 

func (database *DB) ListSecureActions(ctx context.Context, decision string, limit int) ([]SecureActionRecord, error)

func (*DB) LoadNanoCursor 

func (database *DB) LoadNanoCursor(ctx context.Context, programDigest, nodeID string) (NanoCursorRecord, error)

func (*DB) PruneEvents 

func (database *DB) PruneEvents(ctx context.Context, cutoff time.Time, requiredProjections []string, batchSize int) (RetentionResult, error)

PruneEvents deletes a bounded batch only after every required durable projection has advanced through the candidate. It never compacts audit data.

func (*DB) PruneEventsWithCutoffs 

func (database *DB) PruneEventsWithCutoffs(
	ctx context.Context,
	cutoffs EventRetentionCutoffs,
	requiredProjections []string,
	batchSize int,
) (RetentionResult, error)

PruneEventsWithCutoffs applies privacy-reducing class and sensitivity overrides while preserving the projection gate and a chained deletion receipt. Tombstone metadata is committed atomically with source deletion.

func (*DB) ResolveEnrollmentReplay 

func (database *DB) ResolveEnrollmentReplay(ctx context.Context, tokenHash []byte, requestID string, requestDigest []byte) (model.Node, error)

func (*DB) ResolveEnrollmentRequestReplay 

func (database *DB) ResolveEnrollmentRequestReplay(ctx context.Context, tokenHash []byte, requestID string, requestDigest []byte) (EnrollmentRequestRecord, error)

func (*DB) SaveNanoCursor 

func (database *DB) SaveNanoCursor(ctx context.Context, programDigest, nodeID string, record NanoCursorRecord, now time.Time) error

func (*DB) SetNodeStatus 

func (database *DB) SetNodeStatus(ctx context.Context, id string, status model.NodeStatus, now time.Time) error

func (*DB) SetNodeStatusMutation 

func (database *DB) SetNodeStatusMutation(nodeID string, status model.NodeStatus, now time.Time) AuditedMutation

func (*DB) SetNodeStatusWithAudit 

func (database *DB) SetNodeStatusWithAudit(ctx context.Context, id string, status model.NodeStatus, now time.Time, entry model.AuditEntry) error

func (*DB) SetProjectionCursor 

func (database *DB) SetProjectionCursor(ctx context.Context, cursor ProjectionCursor) error

func (*DB) SubmitEnrollmentRequestMutation 

func (database *DB) SubmitEnrollmentRequestMutation(tokenHash []byte, now time.Time, record EnrollmentRequestRecord) AuditedMutation

func (*DB) SubmitEnrollmentRequestWithAudit 

func (database *DB) SubmitEnrollmentRequestWithAudit(
	ctx context.Context,
	tokenHash []byte,
	now time.Time,
	record EnrollmentRequestRecord,
	entry model.AuditEntry,
) error

func (*DB) UpdateNodeMetadataMutation 

func (database *DB) UpdateNodeMetadataMutation(nodeID, name string, tags []string) AuditedMutation

func (*DB) UpdateNodeMetadataWithAudit 

func (database *DB) UpdateNodeMetadataWithAudit(ctx context.Context, id, name string, tags []string, entry model.AuditEntry) error

func (*DB) VerifyEventRetentionTombstones 

func (database *DB) VerifyEventRetentionTombstones(ctx context.Context) error

VerifyEventRetentionTombstones checks the complete local deletion-receipt chain and its transactionally maintained head. A separately protected witness is still required to detect coordinated rollback of the whole DB.

type EnrollmentRequestRecord 

type EnrollmentRequestRecord struct {
	ID                   string
	TokenID              string
	RequestID            string
	RequestDigest        []byte
	Status               string
	ProposedNodeID       string
	DisplayName          string
	NodeType             string
	Platform             string
	PlatformVersion      string
	PublicKey            []byte
	CapabilitiesJSON     json.RawMessage
	AllowedTags          []string
	RequestedAt          time.Time
	ExpiresAt            time.Time
	DecisionReasonCode   string
	DecisionOperationID  string
	DecidedByPrincipalID string
	DecidedAt            *time.Time
	ApprovedTags         []string
	NodeID               string
}

type EnrollmentTokenRecord 

type EnrollmentTokenRecord struct {
	ID                    string
	Hash                  []byte
	ScopeJSON             json.RawMessage
	CreatedByPrincipalID  string
	OperationID           string
	CreatedAt             time.Time
	ExpiresAt             time.Time
	ConsumedAt            *time.Time
	ConsumedByNodeID      string
	ConsumedRequestID     string
	ConsumedRequestDigest []byte
}

type EventRetentionCutoffs 

type EventRetentionCutoffs struct {
	DefaultBefore    time.Time
	ByClassification map[model.EvidenceClass]time.Time
	BySensitivity    map[model.Sensitivity]time.Time
}

EventRetentionCutoffs defines the oldest record each class may retain. Class and sensitivity cutoffs may only move forward from DefaultBefore, making overrides privacy-preserving reductions rather than covert extensions.

type NanoCursorRecord 

type NanoCursorRecord struct {
	Initialized bool
	NextDueUnix int64
}

NanoCursorRecord is the durable scheduling state for one admitted Nano watchdog program on one active node. It contains no program source or input.

type NanoWatchdogProgramRecord 

type NanoWatchdogProgramRecord struct {
	ID            string
	NodeID        string
	Name          string
	Source        string
	ProgramDigest string
	BindingID     string
	Status        NanoWatchdogStatus
	OperationID   string
	CreatedAt     time.Time
	UpdatedAt     time.Time
}

NanoWatchdogProgramRecord preserves the reviewed source and its canonical digest. It never stores a finding frame, provider secret, or proposed action.

type NanoWatchdogStatus 

type NanoWatchdogStatus string
const (
	NanoWatchdogAdmitted NanoWatchdogStatus = "ADMITTED"
	NanoWatchdogDisabled NanoWatchdogStatus = "DISABLED"
)

type NodeEventState 

type NodeEventState struct {
	NodeID                    string
	CurrentBootID             string
	HighestContiguousSequence uint64
	LastEventID               string
	UpdatedAt                 time.Time
}

type ProjectionCursor 

type ProjectionCursor struct {
	Projection        string
	LastIngestOrdinal uint64
	LastReceivedAt    time.Time
	LastEventID       string
	UpdatedAt         time.Time
}

type RetentionResult 

type RetentionResult struct {
	Deleted            int64
	SafeThroughOrdinal uint64
	SafeThroughAt      time.Time
	SafeThroughID      string
	TombstoneHash      string
}

type SecureActionAuditEventRecord 

type SecureActionAuditEventRecord struct {
	ActionID      string
	RequestDigest []byte
}

type SecureActionExecutionState 

type SecureActionExecutionState struct {
	Started  bool
	Terminal string
}

type SecureActionRecord 

type SecureActionRecord struct {
	ID              string
	RequestID       string
	ApplicationID   string
	OperationID     string
	Decision        string
	RequestJSON     []byte
	DecisionJSON    []byte
	CreatedAt       time.Time
	UpdatedAt       time.Time
	ReleasedAt      *time.Time
	BypassExpiresAt *time.Time
}

SecureActionRecord is the durable transport-neutral state for a protected application action. RequestJSON and DecisionJSON are canonical JSON; callers must never place application payloads or bearer credentials in either field.

func (SecureActionRecord) RequestMatches 

func (record SecureActionRecord) RequestMatches(canonical []byte) bool

RequestMatches reports whether a retry is byte-for-byte identical to the canonical request already committed for this action.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.