Documentation
¶
Overview ¶
Package migration exposes the local CLI wrapper for the protected temporary-to-production migration contract.
Index ¶
- Variables
- func CheckPendingCutover(dataDir string) error
- func CollectConfirmation(ctx context.Context, in io.Reader, out io.Writer, opts PromptOptions) (setupmigration.ConfirmationRequest, error)
- func Execute(ctx context.Context, in io.Reader, out io.Writer, runner Runner, ...) (setupmigration.Result, error)
- func NewCommand(runner Runner) *cobra.Command
- func NewRuntimeCommand(opts RuntimeOptions) *cobra.Command
- type ProductionHandoff
- type PromptOptions
- type RecoveryConfirmation
- type RecoveryDirection
- type RecoveryPromptOptions
- type Runner
- type RuntimeOptions
- type RuntimeRecoveryPlan
Constants ¶
This section is empty.
Variables ¶
var ( ErrInvalidPromptOptions = errors.New("invalid migration prompt options") ErrConfirmationPhrase = errors.New("migration confirmation phrase is invalid") ErrSecondConfirmation = errors.New("migration second confirmation is required") ErrPasswordConfirmation = errors.New("migration password or TOTP confirmation is required") )
var ( ErrCutoverLedger = errors.New("migration cutover ledger is unavailable") ErrCutoverAmbiguous = errors.New("migration cutover state is ambiguous") ErrCutoverTokenMetadataUnverified = errors.New("migration cutover token metadata is unverified from a v1 ledger") ErrRecoveryInProgress = errors.New("migration recovery is already in progress") ErrRecoveryConsumed = errors.New("migration recovery confirmation was already consumed") )
var ( ErrRuntimeConfiguration = errors.New("migration runtime configuration is invalid") ErrRuntimeConfigCopy = errors.New("migration requires a runtime configuration copy") ErrCredentialMode = errors.New("exactly one credential stdin mode is required") ErrCredentialRejected = errors.New("administrator credential or session was rejected") ErrCutoverPending = errors.New("a temporary-to-production cutover is pending recovery") )
var ErrProductionHandoff = errors.New("production migration handoff is invalid")
Functions ¶
func CheckPendingCutover ¶
CheckPendingCutover rejects startup whenever a cutover marker exists. A malformed or insecure marker is also pending: serve must never guess that a partially committed migration is safe.
func CollectConfirmation ¶
func CollectConfirmation(ctx context.Context, in io.Reader, out io.Writer, opts PromptOptions) (setupmigration.ConfirmationRequest, error)
CollectConfirmation prints each warning and requires a complete warning delay for every warning. It then reads the exact server phrase and a second confirmation from input. The phrase is never trimmed or case-folded.
func Execute ¶
func Execute(ctx context.Context, in io.Reader, out io.Writer, runner Runner, opts PromptOptions) (setupmigration.Result, error)
Execute runs the prompt and then the injected migration runner.
func NewCommand ¶
NewCommand returns the injected contract command used by focused tests and embedding callers. The root CLI registers NewRuntimeCommand instead.
func NewRuntimeCommand ¶
func NewRuntimeCommand(opts RuntimeOptions) *cobra.Command
NewRuntimeCommand returns the production command tree exposed as `cheesewaf migration temporary-to-production`.
Types ¶
type ProductionHandoff ¶ added in v0.4.0
type ProductionHandoff struct {
Version int `json:"version"`
SnapshotID string `json:"snapshot_id"`
TemporaryConfigDigest string `json:"temporary_config_digest"`
ProductionConfigDigest string `json:"production_config_digest"`
CandidateDigest string `json:"candidate_digest"`
InitialStateHash string `json:"initial_state_hash"`
TokenMetadataDigest string `json:"token_metadata_digest"`
ClusterID string `json:"cluster_id"`
Actor string `json:"actor"`
CommittedAt time.Time `json:"committed_at"`
SessionsInvalidated bool `json:"sessions_invalidated"`
SetupInvalidated bool `json:"setup_invalidated"`
JoinInvalidated bool `json:"join_invalidated"`
CAPTCHAInvalidated bool `json:"captcha_invalidated"`
LocksInvalidated bool `json:"locks_invalidated"`
}
ProductionHandoff is metadata-only proof that the migration transaction committed and invalidated every temporary security artifact. It never contains credentials, DSNs, management snapshots, or token contents.
func ReadProductionHandoff ¶ added in v0.4.0
func ReadProductionHandoff(dataDir string) (ProductionHandoff, error)
ReadProductionHandoff returns the owner-only runtime handoff. Missing or malformed evidence is distinct from a pending cutover and must fail closed.
func ValidateProductionHandoff ¶ added in v0.4.0
func ValidateProductionHandoff(dataDir string, cfg *config.Config) (ProductionHandoff, error)
ValidateProductionHandoff checks that the running config is the exact production candidate recorded by migration. The caller separately verifies the ledger in the durable management store.
func (ProductionHandoff) Complete ¶ added in v0.4.0
func (h ProductionHandoff) Complete() bool
func (ProductionHandoff) Evidence ¶ added in v0.4.0
func (h ProductionHandoff) Evidence() storage.MigrationHandoffEvidence
Evidence converts the file proof into the storage-owned verification contract without exposing any private migration payload.
type PromptOptions ¶
type PromptOptions struct {
Actor string
SessionID string
Language string
ConfirmationID string
PasswordConfirmed bool
TOTPConfirmed bool
Local bool
Warnings []string
Now func() time.Time
Wait func(context.Context, time.Duration) error
}
PromptOptions carries non-secret identity and adapter proof into the CLI prompt. Password/TOTP verification is performed by the injected provider in setup/migration; this layer records only the completed proof.
type RecoveryConfirmation ¶
type RecoveryConfirmation struct {
Actor string
Language string
Phrase string
ConfirmationID string
WarningReadAt time.Time
SecondConfirmation bool
}
func CollectRecoveryConfirmation ¶
func CollectRecoveryConfirmation(ctx context.Context, in io.Reader, out io.Writer, opts RecoveryPromptOptions) (RecoveryConfirmation, error)
type RecoveryDirection ¶
type RecoveryDirection string
const ( RecoveryRollbackTemporary RecoveryDirection = "rollback-temporary" RecoveryCompleteProduction RecoveryDirection = "complete-production" )
type RecoveryPromptOptions ¶
type Runner ¶
type Runner interface {
Run(context.Context, setupmigration.ConfirmationRequest) (setupmigration.Result, error)
}
Runner is the narrow setup/migration execution seam used by the CLI.
type RuntimeOptions ¶
type RuntimeOptions struct {
ConfigPath func() string
DataDir func() string
ApplyDataDir func(*config.Config, string) error
AcquireExclusive func(string) (io.Closer, error)
Now func() time.Time
Random io.Reader
Wait func(context.Context, time.Duration) error
// contains filtered or unexported fields
}
RuntimeOptions wires the root CLI to process-owned paths and its exclusive service lease. Functions are evaluated after Cobra parses persistent flags.
type RuntimeRecoveryPlan ¶
type RuntimeRecoveryPlan interface {
Direction() RecoveryDirection
Recover(context.Context, RecoveryConfirmation) error
}
Source Files