cli

type ProductionApprovalDependency ¶

type ProductionApprovalDependency interface {
	ProductionHealthDependency
	ApprovalHTTP() *handler.ApprovalHTTPHandler
	PolicyEpoch() uint64
	ApprovalClaimResolver() activation.ApprovalClaimResolver
}

ProductionApprovalDependency is the complete production approval boundary. The handler and policy epoch are part of the contract so a healthy but incomplete approval fake cannot reach the request-serving layer.

type ProductionCRP ¶ added in v0.4.0

type ProductionCRP struct {
	// contains filtered or unexported fields
}

ProductionCRP owns the production CRP handler, outbound mTLS adapters, activation service and authorization listener. Runtime and fence source lifetimes remain owned by the caller so the same durable runtime can be shared with CWEDP without opening a second store.

func OpenProductionCRP(ctx context.Context, opts ProductionCRPOptions) (*ProductionCRP, error)

func (p *ProductionCRP) Close() error

func (p *ProductionCRP) ControlPlane() *activation.HTTPControlPlaneClient

func (p *ProductionCRP) Endpoint() string

func (p *ProductionCRP) Handler() *activation.ControlPlaneHandler

func (p *ProductionCRP) Runtime() *crp.RuntimeStore

func (p *ProductionCRP) Service() *activation.Service

func (p *ProductionCRP) Shutdown(ctx context.Context) error

func (p *ProductionCRP) SidecarEndpoint() string

func (p *ProductionCRP) SidecarHandler() *activation.SidecarLauncherHandler

func (p *ProductionCRP) Sidecars() *activation.HTTPSidecarManager

func (p *ProductionCRP) Start() error

func (p *ProductionCRP) Wait(ctx context.Context) error

type ProductionCRPActivationExecutor ¶ added in v0.4.0

type ProductionCRPActivationExecutor struct {
	// contains filtered or unexported fields
}

ProductionCRPActivationExecutor adapts the process-owned activation service to the management API. Authority remains owned by the service: the adapter neither accepts nor synthesizes approval claims, confirmations, fences, or any other authorization material.

func NewProductionCRPActivationExecutor(service *activation.Service) (*ProductionCRPActivationExecutor, error)

func (e *ProductionCRPActivationExecutor) ExecuteCRPActivation(ctx context.Context, request activation.AsyncRequest) (activation.ActivationResult, error)

type ProductionCRPCompositionOptions ¶ added in v0.4.0

type ProductionCRPCompositionOptions struct {
	CRP                   ProductionCRPOptions
	AuthorizationDSN      string
	Consensus             ProductionConsensusDependency
	Runtime               *crp.RuntimeStore
	ApprovalClaimResolver activation.ApprovalClaimResolver
	ActivationPolicy      activation.Policy
}

ProductionCRPCompositionOptions joins the already-bootstrapped consensus, durable approval runtime and exact CWEDP RuntimeStore with runtime-only mTLS transport configuration. None of these values are serialized into the tracked YAML template.

type ProductionCRPDependency ¶ added in v0.4.0

type ProductionCRPDependency interface {
	Start() error
	Wait(context.Context) error
	Shutdown(context.Context) error
	Close() error
	Runtime() *crp.RuntimeStore
	ActivationExecutor() handler.CRPActivationExecutor
}

ProductionCRPDependency is the process-owned CRP lifecycle exposed to the main serve loop. The management API receives only ActivationExecutor; it cannot reach the authorization store, fence source or mTLS transports.

type ProductionCRPFenceSource ¶ added in v0.4.0

type ProductionCRPFenceSource struct {
	// contains filtered or unexported fields
}

ProductionCRPFenceSource projects the exact live native-raft fence into the CRP activation contract. The token is a deterministic digest of every native-raft fencing field, rather than a locally minted capability.

CurrentFence requires the local consensus dependency to establish the current fence. A follower, unavailable raft runtime, or inconsistent snapshot therefore fails closed instead of issuing a CRP authorization.

func NewProductionCRPFenceSource(consensus ProductionConsensusDependency) (*ProductionCRPFenceSource, error)

func (s *ProductionCRPFenceSource) CurrentFence(ctx context.Context, request activation.AuthorizationRequest) (activation.Fence, error)

func (s *ProductionCRPFenceSource) ValidateFence(ctx context.Context, authorization activation.Authorization, observed activation.Fence) error

type ProductionCRPOptions ¶ added in v0.4.0

type ProductionCRPOptions struct {
	ListenEndpoint        string
	SidecarListenEndpoint string
	ControlEndpoint       string
	SidecarEndpoint       string
	CAFile                string
	ServerCertFile        string
	ServerKeyFile         string
	ClientCertFile        string
	ClientKeyFile         string
	ControlServerName     string
	SidecarServerName     string
	SidecarRegistryFile   string

	ClusterID        string
	NodeID           string
	TransportTimeout time.Duration

	Runtime               *crp.RuntimeStore
	State                 activation.AuthorizationState
	Provider              activation.AuthorizationProvider
	Audit                 activation.DurableAuthorizationAudit
	FenceSource           activationpostgres.FenceSource
	SidecarBackend        activation.SidecarLauncherBackend
	SidecarMaxSlots       int
	ApprovalClaimResolver activation.ApprovalClaimResolver
	Policy                activation.Policy
	Clock                 func() time.Time
	AsyncQueueSize        int
	AsyncWorkers          int
	OperationTimeout      time.Duration
}

ProductionCRPOptions is runtime-only process configuration. The paths and endpoints are intentionally not derived from the tracked YAML template. Runtime, Provider, State, Audit and FenceSource are opened by the owning production launcher and are never replaced with process-local fallbacks.

func ProductionCRPOptionsFromEnvironment(opts ProductionCRPOptions) ProductionCRPOptions

type ProductionCWEDPAdmission ¶ added in v0.4.0

type ProductionCWEDPAdmission struct {
	Registry       transport.Registry
	IntentVerifier cwedp.IntentSignatureVerifier
	ImportOptions  crp.ImportOptions
}

type ProductionCWEDPConsumerOptions ¶ added in v0.4.0

type ProductionCWEDPConsumerOptions struct {
	ResumeStore           *cwedppostgres.ResumeStore
	Registry              transport.Registry
	IntentVerifier        cwedp.IntentSignatureVerifier
	CRPImportOptions      crp.ImportOptions
	Runtime               *crp.RuntimeStore
	PolicyEpoch           uint64
	MinIndependentSources int
}

ProductionCWEDPConsumerOptions deliberately contains runtime-owned trust objects rather than YAML fields. A deployment launcher must supply a signed intent verifier, immutable endpoint registry, CRP trust/admission context, PostgreSQL resume store and staging runtime as one reviewed composition.

type ProductionCWEDPDownloadCloser ¶ added in v0.4.0

type ProductionCWEDPDownloadCloser interface {
	consumer.Executor
	Close() error
}

ProductionCWEDPDownloadCloser is the optional lifecycle contract for an explicitly injected CWEDP consumer. The factory keeps returning the consumer.Executor compatibility interface, while composition roots that open durable resources (for example a PostgreSQL ResumeStore) can return a consumer that releases those resources here.

type ProductionCWEDPLeaseRequest ¶ added in v0.4.0

type ProductionCWEDPLeaseRequest struct {
	Identity       netlease.AdministratorIdentity
	Password       string
	PluginID       string
	PluginVersion  string
	Target         netlease.Target
	TLSFingerprint string
	PolicyEpoch    uint64
	TTL            time.Duration
	MaxBytes       int64
}

ProductionCWEDPLeaseRequest is the request-scoped capability needed to obtain one CWEDP HTTP adapter. The caller supplies the authenticated management identity and fresh password confirmation; no identity, session, lease, or adapter is retained in production startup state.

type ProductionCWEDPOptions ¶ added in v0.4.0

type ProductionCWEDPOptions struct {
	ResumeDSN             string
	RegistryPath          string
	TrustRootsPath        string
	SourcesPath           string
	IntentKeysPath        string
	RuntimeDir            string
	MinIndependentSources int
}

ProductionCWEDPOptions names runtime-owned admission and state snapshots. These files are deliberately outside the tracked source config. A missing file, empty registry, or invalid key is a hard startup failure.

type ProductionConsensusDependency ¶

type ProductionConsensusDependency interface {
	controlplane.ConsensusBootstrap
	controlplane.FenceBootstrap
	Machine() *controlplane.StateMachine
	Close() error
}

ProductionConsensusDependency combines native-raft consensus and fencing. Machine is required so Bootstrap can install the verified snapshot into the exact state machine owned by the consensus runtime.

type ProductionControlDependency ¶

type ProductionControlDependency interface {
	controlplane.DurableBootstrap
	Close() error
}

ProductionControlDependency is the control-plane PostgreSQL adapter. It is intentionally not storage.Store: control-plane desired-state commits have a different contract from management sites, users, sessions, and reviews.

type ProductionDependencies ¶

type ProductionDependencies struct {
	Management       storage.Store
	Control          ProductionControlDependency
	Consensus        ProductionConsensusDependency
	Redis            ProductionHealthDependency
	Approval         ProductionApprovalDependency
	ApprovalHTTP     *handler.ApprovalHTTPHandler
	TemporaryNetwork *ProductionTemporaryNetworkWiring
	CWEDPDownload    consumer.Executor
	CRP              ProductionCRPDependency
	Startup          controlplane.StartupResult
	CWEDP            ProductionCWEDPOptions
	Serve            ProductionServeWiring
	Ready            bool
	// contains filtered or unexported fields
}

ProductionDependencies owns every resource opened by one production startup attempt. Close is idempotent and always runs in reverse dependency order, including when Bootstrap or final serve wiring fails.

func OpenProductionDependencies(ctx context.Context, opts ProductionStartupOptions, factory ProductionDependencyFactory) (*ProductionDependencies, error)

func (d *ProductionDependencies) Close() error

func (d *ProductionDependencies) ServeWiring() (ProductionServeWiring, error)

type ProductionDependencyFactory ¶

type ProductionDependencyFactory struct {
	OpenManagement func(context.Context, config.ManagementPostgreSQLConfig) (storage.Store, error)
	OpenControl    func(context.Context, config.ManagementPostgreSQLConfig) (ProductionControlDependency, error)
	OpenConsensus  func(context.Context, nativeraft.Options) (ProductionConsensusDependency, error)
	OpenRedis      func(context.Context, redis.Config) (ProductionHealthDependency, error)
	OpenApproval   func(context.Context, ProductionStartupOptions) (ProductionApprovalDependency, error)
	// OpenTemporaryNetwork creates the session-bound provider used by the main
	// serve composition root. Callers embedding this factory may replace it,
	// but must preserve the same management-store and policy-epoch binding.
	OpenTemporaryNetwork func(context.Context, ProductionTemporaryNetworkOptions) (*ProductionTemporaryNetworkWiring, error)
	// OpenCWEDPDownload supplies the complete durable CWEDP/CRP consumer. If it
	// is omitted the corresponding management route remains absent; if present,
	// startup rejects a failed or nil consumer rather than exposing a partial
	// download path.
	OpenCWEDPDownload func(context.Context, ProductionServeWiring) (consumer.Executor, error)
	// The following openers are the runtime-owned CWEDP composition seams used
	// by the default download opener. They are separate so deployment launchers
	// can bind durable control-plane adapters without weakening admission.
	OpenCWEDPAdmission   func(context.Context, ProductionCWEDPOptions) (ProductionCWEDPAdmission, error)
	OpenCWEDPResumeStore func(context.Context, ProductionCWEDPOptions) (*cwedppostgres.ResumeStore, error)
	OpenCWEDPRuntime     func(context.Context, ProductionCWEDPOptions, ProductionCWEDPAdmission) (*crp.RuntimeStore, error)
	OpenCRP              func(context.Context, ProductionCRPCompositionOptions) (ProductionCRPDependency, error)
	// WireServe is the legacy production composition hook. Keep it for
	// embedding launchers compiled against the original API.
	WireServe func(context.Context, *ProductionDependencies) error
	// WireServeWithWiring is the preferred hook. It receives a validated,
	// lifecycle-bound handoff and cannot be configured together with WireServe.
	WireServeWithWiring func(context.Context, ProductionServeWiring) error
}

ProductionDependencyFactory opens each production dependency. Every opener is injected so tests and embedding launchers can prove ordering and cleanup without pretending that a fake backend is a production deployment.

func DefaultProductionDependencyFactory() ProductionDependencyFactory

func NewProductionDependencyFactory() ProductionDependencyFactory

type ProductionHealthDependency ¶

type ProductionHealthDependency interface {
	Health(context.Context) error
	Close() error
}

ProductionHealthDependency is the common boundary for short-lived runtime dependencies such as Redis and the approval service.

type ProductionServeWiring ¶ added in v0.4.0

type ProductionServeWiring struct {
	ManagementStore       storage.Store
	Startup               controlplane.StartupResult
	ApprovalHTTP          *handler.ApprovalHTTPHandler
	SessionValidator      middleware.SessionValidator
	PolicyEpoch           uint64
	TemporaryHTTPExecutor netlease.TemporaryHTTPExecutor
	TemporaryNetwork      ProductionTemporaryNetworkProvider
	CWEDPDownload         consumer.Executor
	CRPActivation         handler.CRPActivationExecutor
	CWEDP                 ProductionCWEDPOptions
}

ProductionServeWiring is the validated composition-root handoff consumed by the request-serving layer. It binds the management store, control-plane readiness snapshot, and approval HTTP transport to one policy epoch.

type ProductionStartupOptions ¶

type ProductionStartupOptions struct {
	Profile              string
	ClusterID            string
	ManagementPostgreSQL config.ManagementPostgreSQLConfig
	ControlPostgreSQL    config.ManagementPostgreSQLConfig
	NativeRaft           nativeraft.Options
	Redis                redis.Config
	RedisEnabled         bool
	// ManagementStore and ApprovalEpoch are populated only after the
	// control-plane Bootstrap succeeds. They keep the production approval
	// opener explicitly bound to the same management store and current durable
	// fencing generation; they are not serialized configuration fields.
	ManagementStore storage.Store
	ApprovalEpoch   uint64
	// DataDir is the runtime-owned root for durable temporary-network audit
	// records. It is never read from or written to the tracked config template.
	DataDir string
	// CWEDP carries only runtime-owned paths and the control PostgreSQL DSN
	// needed by the production download composition. It is never serialized in
	// the tracked YAML config; missing admission files fail closed.
	CWEDP ProductionCWEDPOptions
	// CRP contains runtime-only transport endpoints and certificate paths. The
	// composition root fills durable authority, the exact CWEDP runtime, live
	// consensus fence and approval resolver after bootstrap.
	CRP ProductionCRPOptions
}

ProductionStartupOptions is deliberately separate from the serializable Config. It prevents an incomplete production startup contract from being enabled merely by adding a YAML key. A deployment launcher must provide both PostgreSQL roles, explicit native-raft options, and a Redis identity.

type ProductionTemporaryNetworkOptions ¶ added in v0.4.0

type ProductionTemporaryNetworkOptions struct {
	ManagementStore storage.Store
	PolicyEpoch     uint64
	DataDir         string
}

ProductionTemporaryNetworkOptions is the narrow input contract for the production temporary-network provider. The provider receives the durable management store and current fence, then obtains identity/session/lease state from each request rather than startup options.

type ProductionTemporaryNetworkProvider ¶ added in v0.4.0

type ProductionTemporaryNetworkProvider interface {
	netlease.TemporaryHTTPExecutor
	CWEDPAdapter(context.Context, ProductionCWEDPLeaseRequest) (transport.LeaseBoundAdapter, error)
	Close() error
}

ProductionTemporaryNetworkProvider is the request-level temporary-egress boundary. ExecuteTemporaryHTTP and CWEDPAdapter must independently validate the current management session, confirmation, fence, expiry, and cleanup.

type ProductionTemporaryNetworkWiring ¶ added in v0.4.0

type ProductionTemporaryNetworkWiring struct {
	Provider ProductionTemporaryNetworkProvider
	// contains filtered or unexported fields
}

ProductionTemporaryNetworkWiring owns the only network capabilities that production serve may receive. It exposes neither a broker, socket, nor a reusable HTTP client. Close is idempotent and owned by ProductionDependencies.

func NewProductionTemporaryNetworkWiring(provider ProductionTemporaryNetworkProvider, closeFn func() error) (*ProductionTemporaryNetworkWiring, error)

func (w *ProductionTemporaryNetworkWiring) Close() error

type ServiceStatusSnapshot ¶

type ServiceStatusSnapshot struct {
	RuntimeDir string
	PIDPath    string
	PID        int
	HasPIDFile bool
	Running    bool
	Stale      bool
}

ServiceStatusSnapshot is the CLI/GUI-visible process state for CheeseWAF. GUI and TUI must use this rather than inventing a second status model.

func InspectServiceStatus() (ServiceStatusSnapshot, error)

func StopRunningService() (ServiceStatusSnapshot, error)