store

package
v0.2.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 10, 2026 License: MIT Imports: 20 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// MaxWebAuthnCredentialsPerUser caps how many passkeys one operator may
	// register. It bounds both storage and the allow/exclude lists sent to the
	// browser; a generous ceiling that still refuses runaway growth. Exported so
	// the server can fail a registration fast (before starting a ceremony) with
	// the same limit the store enforces on write.
	MaxWebAuthnCredentialsPerUser = 10
)

Variables

View Source 
var (
	ErrTaskNotFound      = errors.New("task not found")
	ErrTaskNotCancelable = errors.New("only queued tasks can be cancelled")
)

Task management sentinel errors so handlers can map store outcomes to HTTP status codes without string matching.

View Source 
var ErrGuardVersionConflict = errors.New("guard record version conflict")

ErrGuardVersionConflict is returned when an optimistic-concurrency upsert carries a stale Version. Security groups and node guard bindings require the caller to echo the current version so two operators cannot silently clobber each other's firewall edits (design-13, closing the NFTInputs upsert gap).

View Source 
var ErrWebAuthnCredentialLimit = errors.New("passkey limit reached for this account")

ErrWebAuthnCredentialLimit is returned when a user is already at the passkey cap. The server surfaces it as a clear client error.

Functions

func ExportBoltToJSON added in v0.2.0 

func ExportBoltToJSON(boltPath, jsonPath string, cph secret.Cipher, opts MigrationOptions) error

func MigrateJSONToBolt added in v0.2.0 

func MigrateJSONToBolt(jsonPath, boltPath string, cph secret.Cipher, opts MigrationOptions) error

func WriteJSONState added in v0.2.0 

func WriteJSONState(path string, st State, cph secret.Cipher, opts MigrationOptions) error

Types

type BoltStateStore added in v0.2.0 

type BoltStateStore struct {
	// contains filtered or unexported fields
}

BoltStateStore is the first bbolt-backed persistence boundary. It stores each State collection in its own bucket so the future Store migration can move from whole-state rewrites to record-level writes without changing handlers.

This type is intentionally not wired into server startup yet: it is the tested import/export foundation for the Phase C migration.

EXPERIMENTAL — do not enable as the runtime backend until the Phase C entry gates are met (security-audit iter-016 D12/D3): (1) a backup/restore command + drill exist; (2) record-level pruning no longer decrypts every record to read non-secret timestamps (D3); (3) this store is round-trip/fuzz-validated for semantic parity against the JSON store. Until then its method set can silently drift from the JSON store, so changes here MUST be mirrored and tested against internal/store/store.go.

func OpenBoltState added in v0.2.0 

func OpenBoltState(path string, cph secret.Cipher) (*BoltStateStore, error)

func (*BoltStateStore) AddMonitorResult added in v0.2.0 

func (bs *BoltStateStore) AddMonitorResult(r model.MonitorResult) error

func (*BoltStateStore) AddTaskResult added in v0.2.0 

func (bs *BoltStateStore) AddTaskResult(r model.TaskResult) error

func (*BoltStateStore) AllNFTInputs added in v0.2.0 

func (bs *BoltStateStore) AllNFTInputs() ([]model.NFTInputs, error)

func (*BoltStateStore) AppendAudit added in v0.2.0 

func (bs *BoltStateStore) AppendAudit(ev model.AuditEvent) error

func (*BoltStateStore) ApplyProxyUsageUpdate added in v0.2.0 

func (bs *BoltStateStore) ApplyProxyUsageUpdate(users []model.ProxyUser, profile *model.ProxyNodeProfile, snapshot *model.ProxyUsageSnapshot) error

func (*BoltStateStore) Approval added in v0.2.0 

func (bs *BoltStateStore) Approval(id string) (model.Approval, bool, error)

func (*BoltStateStore) Approvals added in v0.2.0 

func (bs *BoltStateStore) Approvals() ([]model.Approval, error)

func (*BoltStateStore) AuditEvents added in v0.2.0 

func (bs *BoltStateStore) AuditEvents() ([]model.AuditEvent, error)

func (*BoltStateStore) Close added in v0.2.0 

func (bs *BoltStateStore) Close() error

func (*BoltStateStore) ConsumeOIDCAuthState added in v0.2.0 

func (bs *BoltStateStore) ConsumeOIDCAuthState(state string) (auth.OIDCAuthState, bool, error)

func (*BoltStateStore) ConsumeRecoveryCode added in v0.2.0 

func (bs *BoltStateStore) ConsumeRecoveryCode(userID, code string) (bool, error)

func (*BoltStateStore) ConsumeTOTPChallenge added in v0.2.0 

func (bs *BoltStateStore) ConsumeTOTPChallenge(id string) error

func (*BoltStateStore) CreateTask added in v0.2.0 

func (bs *BoltStateStore) CreateTask(t model.Task) error

func (*BoltStateStore) DDNSProfile added in v0.2.0 

func (bs *BoltStateStore) DDNSProfile(id string) (model.DDNSProfile, bool, error)

func (*BoltStateStore) DDNSProfiles added in v0.2.0 

func (bs *BoltStateStore) DDNSProfiles() ([]model.DDNSProfile, error)

func (*BoltStateStore) DDNSProfilesForNode added in v0.2.0 

func (bs *BoltStateStore) DDNSProfilesForNode(nodeID string) ([]model.DDNSProfile, error)

func (*BoltStateStore) DNSDeployment added in v0.2.0 

func (bs *BoltStateStore) DNSDeployment(id string) (model.DNSDeployment, bool, error)

func (*BoltStateStore) DNSDeployments added in v0.2.0 

func (bs *BoltStateStore) DNSDeployments() ([]model.DNSDeployment, error)

func (*BoltStateStore) DNSDeploymentsForNode added in v0.2.0 

func (bs *BoltStateStore) DNSDeploymentsForNode(nodeID string) ([]model.DNSDeployment, error)

func (*BoltStateStore) DeleteDDNSProfile added in v0.2.0 

func (bs *BoltStateStore) DeleteDDNSProfile(id string) error

func (*BoltStateStore) DeleteDNSDeployment added in v0.2.0 

func (bs *BoltStateStore) DeleteDNSDeployment(id string) error

func (*BoltStateStore) DeleteGroup added in v0.2.0 

func (bs *BoltStateStore) DeleteGroup(id string) error

func (*BoltStateStore) DeleteGroupPolicy added in v0.2.0 

func (bs *BoltStateStore) DeleteGroupPolicy(id string) error

func (*BoltStateStore) DeleteMachineProfile added in v0.2.0 

func (bs *BoltStateStore) DeleteMachineProfile(id string) error

func (*BoltStateStore) DeleteMonitor added in v0.2.0 

func (bs *BoltStateStore) DeleteMonitor(id string) error

func (*BoltStateStore) DeleteNFTInputs added in v0.2.0 

func (bs *BoltStateStore) DeleteNFTInputs(nodeID string) error

func (*BoltStateStore) DeleteNetPolicy added in v0.2.0 

func (bs *BoltStateStore) DeleteNetPolicy(nodeID string) error

func (*BoltStateStore) DeleteNotifyChannel added in v0.2.0 

func (bs *BoltStateStore) DeleteNotifyChannel(id string) error

func (*BoltStateStore) DeleteNotifyRule added in v0.2.0 

func (bs *BoltStateStore) DeleteNotifyRule(id string) error

func (*BoltStateStore) DeleteOIDCProvider added in v0.2.0 

func (bs *BoltStateStore) DeleteOIDCProvider(id string) error

func (*BoltStateStore) DeleteProxyInbound added in v0.2.0 

func (bs *BoltStateStore) DeleteProxyInbound(id string) error

func (*BoltStateStore) DeleteProxyNodeProfile added in v0.2.0 

func (bs *BoltStateStore) DeleteProxyNodeProfile(nodeID string) error

func (*BoltStateStore) DeleteProxyUsageSnapshot added in v0.2.0 

func (bs *BoltStateStore) DeleteProxyUsageSnapshot(nodeID string) error

func (*BoltStateStore) DeleteProxyUser added in v0.2.0 

func (bs *BoltStateStore) DeleteProxyUser(id string) error

func (*BoltStateStore) DeleteSession added in v0.2.0 

func (bs *BoltStateStore) DeleteSession(id string) error

func (*BoltStateStore) DeleteToken added in v0.2.0 

func (bs *BoltStateStore) DeleteToken(id string) (model.Token, bool, error)

func (*BoltStateStore) DeleteTunnel added in v0.2.0 

func (bs *BoltStateStore) DeleteTunnel(id string) error

func (*BoltStateStore) EnabledNotifyChannels added in v0.2.0 

func (bs *BoltStateStore) EnabledNotifyChannels() ([]model.NotifyChannel, error)

func (*BoltStateStore) EnabledNotifyRules added in v0.2.0 

func (bs *BoltStateStore) EnabledNotifyRules() ([]model.NotifyRule, error)

func (*BoltStateStore) EnabledOIDCProviders added in v0.2.0 

func (bs *BoltStateStore) EnabledOIDCProviders() ([]model.OIDCProvider, error)

func (*BoltStateStore) ExportState added in v0.2.0 

func (bs *BoltStateStore) ExportState() (State, error)

ExportState reads every bbolt bucket and returns a decrypted, initialized State. Values returned by bbolt are decoded inside the transaction.

func (*BoltStateStore) FailTOTPChallenge added in v0.2.0 

func (bs *BoltStateStore) FailTOTPChallenge(id string, maxAttempts int) error

func (*BoltStateStore) Group added in v0.2.0 

func (bs *BoltStateStore) Group(id string) (model.Group, bool, error)

func (*BoltStateStore) GroupPolicies added in v0.2.0 

func (bs *BoltStateStore) GroupPolicies() ([]model.GroupNetPolicy, error)

func (*BoltStateStore) GroupPolicy added in v0.2.0 

func (bs *BoltStateStore) GroupPolicy(id string) (model.GroupNetPolicy, bool, error)

func (*BoltStateStore) Groups added in v0.2.0 

func (bs *BoltStateStore) Groups() ([]model.Group, error)

func (*BoltStateStore) ImportState added in v0.2.0 

func (bs *BoltStateStore) ImportState(st State) error

ImportState replaces the entire bbolt state atomically. Secret-bearing fields are encrypted before they are written; the input State is not mutated.

func (*BoltStateStore) KV added in v0.2.0 

func (bs *BoltStateStore) KV(bucket string) ([]model.KVEntry, error)

func (*BoltStateStore) LastMonitorResultForNode added in v0.2.0 

func (bs *BoltStateStore) LastMonitorResultForNode(monitorID, nodeID string) (model.MonitorResult, bool, error)

func (*BoltStateStore) LeaseTasks added in v0.2.0 

func (bs *BoltStateStore) LeaseTasks(nodeID string, limit int) ([]model.Task, error)

func (*BoltStateStore) MachineProfile added in v0.2.0 

func (bs *BoltStateStore) MachineProfile(id string) (model.MachineProfile, bool, error)

func (*BoltStateStore) MachineProfileForNode added in v0.2.0 

func (bs *BoltStateStore) MachineProfileForNode(nodeID string) (model.MachineProfile, bool, error)

func (*BoltStateStore) MachineProfiles added in v0.2.0 

func (bs *BoltStateStore) MachineProfiles() ([]model.MachineProfile, error)

func (*BoltStateStore) Monitor added in v0.2.0 

func (bs *BoltStateStore) Monitor(id string) (model.Monitor, bool, error)

func (*BoltStateStore) MonitorResults added in v0.2.0 

func (bs *BoltStateStore) MonitorResults(monitorID string) ([]model.MonitorResult, error)

func (*BoltStateStore) Monitors added in v0.2.0 

func (bs *BoltStateStore) Monitors() ([]model.Monitor, error)

func (*BoltStateStore) MonitorsForNode added in v0.2.0 

func (bs *BoltStateStore) MonitorsForNode(nodeID string) ([]model.Monitor, error)

func (*BoltStateStore) NFTInputs added in v0.2.0 

func (bs *BoltStateStore) NFTInputs(nodeID string) (model.NFTInputs, bool, error)

func (*BoltStateStore) NetPolicies added in v0.2.0 

func (bs *BoltStateStore) NetPolicies() ([]model.NetPolicy, error)

func (*BoltStateStore) NetPolicy added in v0.2.0 

func (bs *BoltStateStore) NetPolicy(nodeID string) (model.NetPolicy, bool, error)

func (*BoltStateStore) Node added in v0.2.0 

func (bs *BoltStateStore) Node(id string) (model.Node, bool, error)

func (*BoltStateStore) Nodes added in v0.2.0 

func (bs *BoltStateStore) Nodes() ([]model.Node, error)

func (*BoltStateStore) NotifyChannels added in v0.2.0 

func (bs *BoltStateStore) NotifyChannels() ([]model.NotifyChannel, error)

func (*BoltStateStore) NotifyRules added in v0.2.0 

func (bs *BoltStateStore) NotifyRules() ([]model.NotifyRule, error)

func (*BoltStateStore) OIDCIdentity added in v0.2.0 

func (bs *BoltStateStore) OIDCIdentity(providerID, subject string) (model.OIDCIdentity, bool, error)

func (*BoltStateStore) OIDCProvider added in v0.2.0 

func (bs *BoltStateStore) OIDCProvider(id string) (model.OIDCProvider, bool, error)

func (*BoltStateStore) OIDCProviders added in v0.2.0 

func (bs *BoltStateStore) OIDCProviders() ([]model.OIDCProvider, error)

func (*BoltStateStore) PluginInstallation added in v0.2.0 

func (bs *BoltStateStore) PluginInstallation(id string) (model.PluginInstallation, bool, error)

func (*BoltStateStore) PluginInstallations added in v0.2.0 

func (bs *BoltStateStore) PluginInstallations() ([]model.PluginInstallation, error)

func (*BoltStateStore) ProxyInbound added in v0.2.0 

func (bs *BoltStateStore) ProxyInbound(id string) (model.ProxyInbound, bool, error)

func (*BoltStateStore) ProxyInbounds added in v0.2.0 

func (bs *BoltStateStore) ProxyInbounds() ([]model.ProxyInbound, error)

func (*BoltStateStore) ProxyNodeProfile added in v0.2.0 

func (bs *BoltStateStore) ProxyNodeProfile(nodeID string) (model.ProxyNodeProfile, bool, error)

func (*BoltStateStore) ProxyNodeProfiles added in v0.2.0 

func (bs *BoltStateStore) ProxyNodeProfiles() ([]model.ProxyNodeProfile, error)

func (*BoltStateStore) ProxyUsageSnapshot added in v0.2.0 

func (bs *BoltStateStore) ProxyUsageSnapshot(nodeID string) (model.ProxyUsageSnapshot, bool, error)

func (*BoltStateStore) ProxyUsageSnapshots added in v0.2.0 

func (bs *BoltStateStore) ProxyUsageSnapshots() ([]model.ProxyUsageSnapshot, error)

func (*BoltStateStore) ProxyUser added in v0.2.0 

func (bs *BoltStateStore) ProxyUser(id string) (model.ProxyUser, bool, error)

func (*BoltStateStore) ProxyUsers added in v0.2.0 

func (bs *BoltStateStore) ProxyUsers() ([]model.ProxyUser, error)

func (*BoltStateStore) ProxyUsersForInbound added in v0.2.0 

func (bs *BoltStateStore) ProxyUsersForInbound(inboundID string) ([]model.ProxyUser, error)

func (*BoltStateStore) PutKV added in v0.2.0 

func (bs *BoltStateStore) PutKV(entry model.KVEntry) error

func (*BoltStateStore) PutOIDCAuthState added in v0.2.0 

func (bs *BoltStateStore) PutOIDCAuthState(st auth.OIDCAuthState) error

func (*BoltStateStore) PutOIDCIdentity added in v0.2.0 

func (bs *BoltStateStore) PutOIDCIdentity(idn model.OIDCIdentity) error

func (*BoltStateStore) PutSession added in v0.2.0 

func (bs *BoltStateStore) PutSession(sess auth.Session) error

func (*BoltStateStore) PutStatic added in v0.2.0 

func (bs *BoltStateStore) PutStatic(obj model.StaticObject) error

func (*BoltStateStore) PutTOTPChallenge added in v0.2.0 

func (bs *BoltStateStore) PutTOTPChallenge(c auth.TOTPChallenge) error

func (*BoltStateStore) Results added in v0.2.0 

func (bs *BoltStateStore) Results() ([]model.TaskResult, error)

func (*BoltStateStore) Session added in v0.2.0 

func (bs *BoltStateStore) Session(id string) (auth.Session, bool, error)

func (*BoltStateStore) SetPluginStatus added in v0.2.0 

func (bs *BoltStateStore) SetPluginStatus(id, status string) error

func (*BoltStateStore) Static added in v0.2.0 

func (bs *BoltStateStore) Static(bucket string) ([]model.StaticObject, error)

func (*BoltStateStore) TOTPChallenge added in v0.2.0 

func (bs *BoltStateStore) TOTPChallenge(id string) (auth.TOTPChallenge, bool, error)

func (*BoltStateStore) Task added in v0.2.0 

func (bs *BoltStateStore) Task(id string) (model.Task, bool, error)

func (*BoltStateStore) Tasks added in v0.2.0 

func (bs *BoltStateStore) Tasks() ([]model.Task, error)

func (*BoltStateStore) Token added in v0.2.0 

func (bs *BoltStateStore) Token(id string) (model.Token, bool, error)

func (*BoltStateStore) Tokens added in v0.2.0 

func (bs *BoltStateStore) Tokens() ([]model.Token, error)

func (*BoltStateStore) TouchNodeToken added in v0.2.0 

func (bs *BoltStateStore) TouchNodeToken(nodeID string, at time.Time, minInterval time.Duration) (bool, error)

func (*BoltStateStore) Tunnel added in v0.2.0 

func (bs *BoltStateStore) Tunnel(id string) (model.TunnelProfile, bool, error)

func (*BoltStateStore) Tunnels added in v0.2.0 

func (bs *BoltStateStore) Tunnels() ([]model.TunnelProfile, error)

func (*BoltStateStore) UpdateMetrics added in v0.2.0 

func (bs *BoltStateStore) UpdateMetrics(nodeID string, metrics model.Metrics, version, publicIP, publicIPv6, internalIP, internalIPv6, wgIP string, hostFacts model.HostFacts) error

func (*BoltStateStore) UpdateNodeGeo added in v0.2.0 

func (bs *BoltStateStore) UpdateNodeGeo(nodeID string, geo *model.NodeGeo) (model.Node, bool, error)

func (*BoltStateStore) UpsertApproval added in v0.2.0 

func (bs *BoltStateStore) UpsertApproval(a model.Approval) error

func (*BoltStateStore) UpsertDDNSProfile added in v0.2.0 

func (bs *BoltStateStore) UpsertDDNSProfile(p model.DDNSProfile) error

func (*BoltStateStore) UpsertDNSDeployment added in v0.2.0 

func (bs *BoltStateStore) UpsertDNSDeployment(dep model.DNSDeployment) error

func (*BoltStateStore) UpsertGroup added in v0.2.0 

func (bs *BoltStateStore) UpsertGroup(g model.Group) error

func (*BoltStateStore) UpsertGroupPolicy added in v0.2.0 

func (bs *BoltStateStore) UpsertGroupPolicy(p model.GroupNetPolicy) error

func (*BoltStateStore) UpsertMachineProfile added in v0.2.0 

func (bs *BoltStateStore) UpsertMachineProfile(p model.MachineProfile) error

func (*BoltStateStore) UpsertMonitor added in v0.2.0 

func (bs *BoltStateStore) UpsertMonitor(m model.Monitor) error

func (*BoltStateStore) UpsertNFTInputs added in v0.2.0 

func (bs *BoltStateStore) UpsertNFTInputs(inputs model.NFTInputs) error

func (*BoltStateStore) UpsertNetPolicy added in v0.2.0 

func (bs *BoltStateStore) UpsertNetPolicy(policy model.NetPolicy) error

func (*BoltStateStore) UpsertNode added in v0.2.0 

func (bs *BoltStateStore) UpsertNode(n model.Node) error

func (*BoltStateStore) UpsertNotifyChannel added in v0.2.0 

func (bs *BoltStateStore) UpsertNotifyChannel(c model.NotifyChannel) error

func (*BoltStateStore) UpsertNotifyRule added in v0.2.0 

func (bs *BoltStateStore) UpsertNotifyRule(rule model.NotifyRule) error

func (*BoltStateStore) UpsertOIDCProvider added in v0.2.0 

func (bs *BoltStateStore) UpsertOIDCProvider(p model.OIDCProvider) error

func (*BoltStateStore) UpsertPluginInstallation added in v0.2.0 

func (bs *BoltStateStore) UpsertPluginInstallation(p model.PluginInstallation) error

func (*BoltStateStore) UpsertProxyInbound added in v0.2.0 

func (bs *BoltStateStore) UpsertProxyInbound(in model.ProxyInbound) error

func (*BoltStateStore) UpsertProxyNodeProfile added in v0.2.0 

func (bs *BoltStateStore) UpsertProxyNodeProfile(profile model.ProxyNodeProfile) error

func (*BoltStateStore) UpsertProxyUsageSnapshot added in v0.2.0 

func (bs *BoltStateStore) UpsertProxyUsageSnapshot(snapshot model.ProxyUsageSnapshot) error

func (*BoltStateStore) UpsertProxyUser added in v0.2.0 

func (bs *BoltStateStore) UpsertProxyUser(u model.ProxyUser) error

func (*BoltStateStore) UpsertToken added in v0.2.0 

func (bs *BoltStateStore) UpsertToken(t model.Token) error

func (*BoltStateStore) UpsertTunnel added in v0.2.0 

func (bs *BoltStateStore) UpsertTunnel(t model.TunnelProfile) error

func (*BoltStateStore) UpsertUser added in v0.2.0 

func (bs *BoltStateStore) UpsertUser(u model.User) error

func (*BoltStateStore) UpsertWorker added in v0.2.0 

func (bs *BoltStateStore) UpsertWorker(w model.WorkerScript) error

func (*BoltStateStore) User added in v0.2.0 

func (bs *BoltStateStore) User(id string) (model.User, bool, error)

func (*BoltStateStore) UserByUsername added in v0.2.0 

func (bs *BoltStateStore) UserByUsername(username string) (model.User, bool, error)

func (*BoltStateStore) Workers added in v0.2.0 

func (bs *BoltStateStore) Workers() ([]model.WorkerScript, error)

type MigrationOptions added in v0.2.0 

type MigrationOptions struct {
	Overwrite bool
}

type NodeCascadeReport added in v0.2.0 

type NodeCascadeReport struct {
	NodeID          string `json:"node_id"`
	TasksStripped   int    `json:"tasks_stripped"` // nodeID removed from Targets, task kept
	TasksDeleted    int    `json:"tasks_deleted"`  // task deleted (sole target)
	TaskResults     int    `json:"task_results"`
	DDNSProfiles    int    `json:"ddns_profiles"`
	MachineProfiles int    `json:"machine_profiles"`
	NFTInputs       int    `json:"nft_inputs"`
	DNSDeployments  int    `json:"dns_deployments"`
	NetPolicies     int    `json:"net_policies"`
	// NetPeerRulesStripped / GroupPolicyRulesStripped count node-reference rules
	// removed from OTHER nodes' net policies and from group policies (SHARED:
	// strip the dangling Remote.NodeID rule, keep the owner's policy).
	NetPeerRulesStripped     int `json:"net_peer_rules_stripped"`
	GroupPolicyRulesStripped int `json:"group_policy_rules_stripped"`
	GeoRoutingStripped       int `json:"geo_routing_stripped"` // SHARED: stripped, kept
	GeoRoutingDeleted        int `json:"geo_routing_deleted"`  // became empty -> deleted
	AgentUpdatePolicies      int `json:"agent_update_policies"`
	ProxyNodeProfiles        int `json:"proxy_node_profiles"`
	ProxyUsageSnapshots      int `json:"proxy_usage_snapshots"`
	MonitorsStripped         int `json:"monitors_stripped"` // SHARED: stripped from Monitor.NodeIDs
	MonitorResults           int `json:"monitor_results"`
	LogSources               int `json:"log_sources"`
	Groups                   int `json:"groups"`    // Members/LeaderID edited
	Approvals                int `json:"approvals"` // NO existing primitive
	Tunnels                  int `json:"tunnels"`
	// RemovedLogSourceIDs lists the log-source IDs whose records this delete
	// removed from the JSON store. The SERVER must call logStore.PurgeSource on
	// each (the log lines live in a separate bbolt db the store cannot reach).
	RemovedLogSourceIDs []string `json:"-"`
}

NodeCascadeReport tallies what a node hard-delete removed (or, in plan mode, would remove) from the JSON store. It is a server-LOCAL plain report: the store cannot import internal/server (that would be an import cycle), so it returns this struct and the server layer maps it onto the wire DTO.

SHARED resources (GeoRouting, Monitors, Groups) are stripped of the gone node rather than deleted, because deleting them would also affect other still-live nodes. Node-owned resources are deleted outright.

type State 

type State struct {
	Users           map[string]model.User               `json:"users"`
	Tokens          map[string]model.Token              `json:"tokens"`
	Nodes           map[string]model.Node               `json:"nodes"`
	Tasks           map[string]model.Task               `json:"tasks"`
	Results         []model.TaskResult                  `json:"results"`
	Audit           []model.AuditEvent                  `json:"audit"`
	KV              map[string]model.KVEntry            `json:"kv"`
	Static          map[string]model.StaticObject       `json:"static"`
	StorageBuckets  map[string]model.StorageBucket      `json:"storage_buckets"`
	StorageBindings map[string]model.StorageBinding     `json:"storage_bindings"`
	StorageTokens   map[string]model.StorageAccessToken `json:"storage_tokens"`
	Workers         map[string]model.WorkerScript       `json:"workers"`
	Plugins         map[string]model.PluginInstallation `json:"plugins"`
	Approvals       map[string]model.Approval           `json:"approvals"`
	Sessions        map[string]auth.Session             `json:"sessions"`
	DDNS            map[string]model.DDNSProfile        `json:"ddns"`
	Monitors        map[string]model.Monitor            `json:"monitors"`
	MonResults      map[string][]model.MonitorResult    `json:"monitor_results"`
	LogSources      map[string]model.LogSource          `json:"log_sources"`
	NotifyChannels  map[string]model.NotifyChannel      `json:"notify_channels"`
	NotifyRules     map[string]model.NotifyRule         `json:"notify_rules"`
	Tunnels         map[string]model.TunnelProfile      `json:"tunnels"`
	MachineProfiles map[string]model.MachineProfile     `json:"machine_profiles"`
	MachineVendors  map[string]model.MachineVendor      `json:"machine_vendors"`
	NFTInputs       map[string]model.NFTInputs          `json:"nft_inputs"`
	SecurityGroups  map[string]model.SecurityGroup      `json:"security_groups"`
	GuardZones      map[string]model.GuardZone          `json:"guard_zones"`
	GuardBindings   map[string]model.NodeGuardBinding   `json:"guard_bindings"`
	DNSDeployments  map[string]model.DNSDeployment      `json:"dns_deployments"`
	NetPolicies     map[string]model.NetPolicy          `json:"net_policies"`
	Groups          map[string]model.Group              `json:"groups"`
	GroupPolicies   map[string]model.GroupNetPolicy     `json:"group_policies"`
	GeoRouting      map[string]model.GeoRouting         `json:"geo_routing"`
	AgentUpdates    map[string]model.AgentUpdatePolicy  `json:"agent_updates"`
	ProxyInbounds   map[string]model.ProxyInbound       `json:"proxy_inbounds"`
	ProxyUsers      map[string]model.ProxyUser          `json:"proxy_users"`
	ProxyProfiles   map[string]model.ProxyNodeProfile   `json:"proxy_profiles"`
	ProxyUsage      map[string]model.ProxyUsageSnapshot `json:"proxy_usage"`
	TOTPChallenges  map[string]auth.TOTPChallenge       `json:"totp_challenges"`
	OIDCProviders   map[string]model.OIDCProvider       `json:"oidc_providers"`
	OIDCIdentities  map[string]model.OIDCIdentity       `json:"oidc_identities"`
	OIDCAuthStates  map[string]auth.OIDCAuthState       `json:"oidc_auth_states"`
	// WebAuthnCreds holds registered passkeys keyed by store record id. The public
	// keys and credential ids are non-secret, so this map is persisted as-is (no
	// at-rest envelope like Users/Sessions carry).
	WebAuthnCreds map[string]auth.WebAuthnCredential `json:"webauthn_credentials"`
	// WebAuthnChallenges holds pending, short-lived passkey ceremony challenges,
	// mirroring TOTPChallenges.
	WebAuthnChallenges map[string]auth.WebAuthnChallenge `json:"webauthn_challenges"`
}

func LoadJSONState added in v0.2.0 

func LoadJSONState(path string, cph secret.Cipher) (State, error)

type Store 

type Store struct {
	// contains filtered or unexported fields
}

func Open 

func Open(path string) (*Store, error)

Open loads (or initializes) the store at path, resolving the at-rest encryption cipher from the environment or a key file under the data directory (see secret.Resolve). An empty path yields an in-memory store with encryption disabled (nothing is persisted).

func OpenWithCipher added in v0.2.0 

func OpenWithCipher(path string, cph secret.Cipher) (*Store, error)

OpenWithCipher is Open with an explicitly supplied at-rest cipher. main uses it after logging the resolved key source; tests use it to inject a known cipher. A nil cipher disables encryption.

func (*Store) AddMonitorResult added in v0.2.0 

func (s *Store) AddMonitorResult(r model.MonitorResult) error

AddMonitorResult appends a probe result, keeping only the most recent maxMonitorResults entries per monitor.

func (*Store) AddTaskResult 

func (s *Store) AddTaskResult(r model.TaskResult) error

func (*Store) AdvanceTOTPStep added in v0.2.0 

func (s *Store) AdvanceTOTPStep(userID string, step uint64) (bool, error)

AdvanceTOTPStep atomically enforces single-use of a TOTP code: it accepts the matched RFC-6238 step only if it is strictly greater than the highest step previously accepted for the user, then persists the new high-water mark. The compare-and-set runs entirely under the store lock so two concurrent logins presenting the same code cannot both succeed (one wins, the other observes a non-increasing step and is rejected). Returns true when the step was accepted and recorded; false when it was a replay (step <= LastTOTPStep) or the user is unknown.

func (*Store) AgentUpdatePolicies added in v0.2.0 

func (s *Store) AgentUpdatePolicies() []model.AgentUpdatePolicy

AgentUpdatePolicies returns all update policies sorted by node id.

func (*Store) AgentUpdatePolicy added in v0.2.0 

func (s *Store) AgentUpdatePolicy(nodeID string) (model.AgentUpdatePolicy, bool)

AgentUpdatePolicy returns the update policy for one node.

func (*Store) AllNFTInputs added in v0.2.0 

func (s *Store) AllNFTInputs() []model.NFTInputs

AllNFTInputs returns all persisted nft inputs sorted by node id.

func (*Store) AppendAudit 

func (s *Store) AppendAudit(ev model.AuditEvent) error

func (*Store) ApplyProxyUsageUpdate added in v0.2.0 

func (s *Store) ApplyProxyUsageUpdate(users []model.ProxyUser, profile *model.ProxyNodeProfile, snapshot *model.ProxyUsageSnapshot) error

func (*Store) Approval 

func (s *Store) Approval(id string) (model.Approval, bool)

func (*Store) Approvals 

func (s *Store) Approvals() []model.Approval

func (*Store) AuditEvents 

func (s *Store) AuditEvents() []model.AuditEvent

func (*Store) AuditWALHead added in v0.2.0 

func (s *Store) AuditWALHead() (string, int, bool)

AuditWALHead returns the current chain head hash and record count, and whether a WAL is configured. The head can be shipped off-box to detect end-truncation.

func (*Store) AuditWALVerify added in v0.2.0 

func (s *Store) AuditWALVerify() (audit.Result, bool, error)

AuditWALVerify re-reads the append-only audit WAL and validates its hash chain. The second return is false when no WAL is configured (in-memory store).

func (*Store) BumpSecurityEpoch added in v0.2.0 

func (s *Store) BumpSecurityEpoch(userID string) (uint64, error)

BumpSecurityEpoch increments the user's SecurityEpoch under the store lock and returns the new value. Sessions carry the epoch at which they were minted, so bumping it invalidates every previously-issued session for the user (used on 2FA disable, password change, and admin revoke). Returns (0, nil) when the user is unknown.

func (*Store) CancelTask added in v0.2.0 

func (s *Store) CancelTask(id string) (model.Task, error)

CancelTask marks a queued task as cancelled so agents will not lease it. A task that is already leased is running on the agent and cannot be reliably stopped from the server, so this refuses it with ErrTaskNotCancelable. The check and the mutation happen under one lock, so concurrent lease/cancel cannot race.

func (*Store) Close added in v0.2.0 

func (s *Store) Close() error

Close releases the audit WAL file handle.

func (*Store) ConsumeOIDCAuthState added in v0.2.0 

func (s *Store) ConsumeOIDCAuthState(state string) (auth.OIDCAuthState, bool)

ConsumeOIDCAuthState atomically fetches and deletes the auth state for the given `state` value (single use). It returns false if the state is unknown or expired; an expired entry is still deleted.

func (*Store) ConsumeRecoveryCode added in v0.2.0 

func (s *Store) ConsumeRecoveryCode(userID, code string) (bool, error)

ConsumeRecoveryCode atomically verifies and removes a single-use recovery code for a user, returning true only if a code matched. The read-modify-write runs entirely under the store lock so concurrent requests cannot double-spend one code or clobber each other's removal.

func (*Store) ConsumeTOTPChallenge added in v0.2.0 

func (s *Store) ConsumeTOTPChallenge(id string) error

ConsumeTOTPChallenge marks a challenge spent by deleting it (single-use).

func (*Store) ConsumeWebAuthnChallenge added in v0.2.0 

func (s *Store) ConsumeWebAuthnChallenge(id string) error

ConsumeWebAuthnChallenge marks a challenge spent by deleting it (single-use).

func (*Store) CountWebAuthnCredentialsByUser added in v0.2.0 

func (s *Store) CountWebAuthnCredentialsByUser(userID string) int

CountWebAuthnCredentialsByUser reports how many passkeys a user has. Used to enforce the cap before beginning a registration ceremony (fail fast) and to decide whether a delete would remove the operator's last passkey.

func (*Store) CountWildcardAdmins added in v0.2.0 

func (s *Store) CountWildcardAdmins(excludeID string) int

CountWildcardAdmins counts users holding the global "*" scope, excluding the given user id. It is the last-admin guard for the user-management API: a delete or de-admin that would drop this to zero must be refused.

func (*Store) CreateTask 

func (s *Store) CreateTask(t model.Task) error

func (*Store) DDNSProfile added in v0.2.0 

func (s *Store) DDNSProfile(id string) (model.DDNSProfile, bool)

DDNSProfile returns a profile by id.

func (*Store) DDNSProfiles added in v0.2.0 

func (s *Store) DDNSProfiles() []model.DDNSProfile

DDNSProfiles returns all profiles sorted by creation time.

func (*Store) DDNSProfilesForNode added in v0.2.0 

func (s *Store) DDNSProfilesForNode(nodeID string) []model.DDNSProfile

DDNSProfilesForNode returns the profiles bound to a node.

func (*Store) DNSDeployment added in v0.2.0 

func (s *Store) DNSDeployment(id string) (model.DNSDeployment, bool)

DNSDeployment returns a self-hosted DNS deployment by id.

func (*Store) DNSDeployments added in v0.2.0 

func (s *Store) DNSDeployments() []model.DNSDeployment

DNSDeployments returns all self-hosted DNS deployments sorted by creation time.

func (*Store) DNSDeploymentsForNode added in v0.2.0 

func (s *Store) DNSDeploymentsForNode(nodeID string) []model.DNSDeployment

DNSDeploymentsForNode returns all DNS deployments bound to a node.

func (*Store) DeleteAgentUpdatePolicy added in v0.2.0 

func (s *Store) DeleteAgentUpdatePolicy(nodeID string) error

DeleteAgentUpdatePolicy removes the update policy for one node.

func (*Store) DeleteDDNSProfile added in v0.2.0 

func (s *Store) DeleteDDNSProfile(id string) error

DeleteDDNSProfile removes a profile.

func (*Store) DeleteDNSDeployment added in v0.2.0 

func (s *Store) DeleteDNSDeployment(id string) error

DeleteDNSDeployment removes a self-hosted DNS deployment.

func (*Store) DeleteGeoRouting added in v0.2.0 

func (s *Store) DeleteGeoRouting(id string) error

DeleteGeoRouting removes a geo-routing record.

func (*Store) DeleteGroup added in v0.2.0 

func (s *Store) DeleteGroup(id string) error

DeleteGroup removes a group. It refuses (returns an error) when the group still has child groups (another group's ParentID points at it) or is the scope of any GroupNetPolicy, so deletion cannot orphan a subtree or silently drop an authored policy. Phase 1 surfaces this as an explicit reparent-to-root flow before delete. A missing id is a no-op (idempotent, matching the other Delete* methods).

func (*Store) DeleteGroupPolicy added in v0.2.0 

func (s *Store) DeleteGroupPolicy(id string) error

DeleteGroupPolicy removes a group-scoped network policy. A missing id is a no-op (idempotent, matching the other Delete* methods).

func (*Store) DeleteGuardZone added in v0.2.1 

func (s *Store) DeleteGuardZone(id string) error

DeleteGuardZone removes a stored guard zone.

func (*Store) DeleteKV added in v0.2.0 

func (s *Store) DeleteKV(bucket, key string) error

func (*Store) DeleteLogSource added in v0.2.0 

func (s *Store) DeleteLogSource(id string) error

DeleteLogSource removes a log source definition. The line store is purged separately by the caller via logstore.PurgeSource.

func (*Store) DeleteMachineProfile added in v0.2.0 

func (s *Store) DeleteMachineProfile(id string) error

DeleteMachineProfile removes a machine profile.

func (*Store) DeleteMachineVendor added in v0.2.1 

func (s *Store) DeleteMachineVendor(id string) error

func (*Store) DeleteMonitor added in v0.2.0 

func (s *Store) DeleteMonitor(id string) error

DeleteMonitor removes a monitor and its result history.

func (*Store) DeleteNFTInputs added in v0.2.0 

func (s *Store) DeleteNFTInputs(nodeID string) error

DeleteNFTInputs removes a node's stored baseline nft input set.

func (*Store) DeleteNetPolicy added in v0.2.0 

func (s *Store) DeleteNetPolicy(nodeID string) error

DeleteNetPolicy removes the network policy for a target node.

func (*Store) DeleteNode added in v0.2.0 

func (s *Store) DeleteNode(nodeID string) (NodeCascadeReport, bool, error)

DeleteNode hard-deletes a node and cascades the removal across every node-owned and node-referencing resource in a SINGLE critical section, then performs exactly one whole-snapshot Save. The bool is false (and no Save runs) when the node does not exist, so the operation is idempotent. Audit rows are never touched: deletion would break the append-only hash-chained WAL, and the SERVER records one node.delete audit event afterwards.

CRITICAL: every step is INLINE raw s.state mutation. The *ForNode / Delete* / Upsert* helpers each take s.mu themselves, and sync.Mutex is non-reentrant, so calling any of them here would self-deadlock.

func (*Store) DeleteNodeGuardBinding added in v0.2.1 

func (s *Store) DeleteNodeGuardBinding(nodeID string) error

DeleteNodeGuardBinding removes a node's guard binding.

func (*Store) DeleteNotifyChannel added in v0.2.0 

func (s *Store) DeleteNotifyChannel(id string) error

DeleteNotifyChannel removes a channel.

func (*Store) DeleteNotifyRule added in v0.2.0 

func (s *Store) DeleteNotifyRule(id string) error

DeleteNotifyRule removes a notification routing rule.

func (*Store) DeleteOIDCIdentitiesByUser added in v0.2.0 

func (s *Store) DeleteOIDCIdentitiesByUser(userID string) int

DeleteOIDCIdentitiesByUser removes every durable subject→user link bound to userID. The map is keyed by provider+subject (not user id), so it is scanned. Used when deleting a user so a stale link can never re-resolve to a removed account. Returns the count removed.

func (*Store) DeleteOIDCProvider added in v0.2.0 

func (s *Store) DeleteOIDCProvider(id string) error

func (*Store) DeleteProxyInbound added in v0.2.0 

func (s *Store) DeleteProxyInbound(id string) error

DeleteProxyInbound removes a central proxy inbound template.

func (*Store) DeleteProxyNodeProfile added in v0.2.0 

func (s *Store) DeleteProxyNodeProfile(nodeID string) error

DeleteProxyNodeProfile removes a per-node proxy render profile.

func (*Store) DeleteProxyUsageSnapshot added in v0.2.0 

func (s *Store) DeleteProxyUsageSnapshot(nodeID string) error

DeleteProxyUsageSnapshot removes a node's last accounting snapshot.

func (*Store) DeleteProxyUser added in v0.2.0 

func (s *Store) DeleteProxyUser(id string) error

DeleteProxyUser removes a proxy subscriber identity.

func (*Store) DeleteSecurityGroup added in v0.2.1 

func (s *Store) DeleteSecurityGroup(id string) error

DeleteSecurityGroup removes a stored security group.

func (*Store) DeleteSession added in v0.2.0 

func (s *Store) DeleteSession(id string) error

DeleteSession removes a session (logout / revocation).

func (*Store) DeleteSessionsByActor added in v0.2.0 

func (s *Store) DeleteSessionsByActor(actorID string) int

DeleteSessionsByActor drops all live cookie sessions for actorID. Used on user delete so sessions are killed immediately rather than only failing closed on their next lookup. Returns the count removed.

func (*Store) DeleteStorageBinding added in v0.2.0 

func (s *Store) DeleteStorageBinding(id string) error

func (*Store) DeleteTask added in v0.2.0 

func (s *Store) DeleteTask(id string) error

DeleteTask removes a task and any stored results for it from history. It returns ErrTaskNotFound when no such task exists.

func (*Store) DeleteToken added in v0.2.0 

func (s *Store) DeleteToken(id string) (model.Token, bool, error)

DeleteToken removes a revoked API token by id. Active tokens must be revoked first by the caller so cleanup cannot accidentally invalidate live automation.

func (*Store) DeleteTunnel added in v0.2.0 

func (s *Store) DeleteTunnel(id string) error

DeleteTunnel removes a tunnel profile.

func (*Store) DeleteUser added in v0.2.0 

func (s *Store) DeleteUser(id string) bool

DeleteUser removes a user by id. Returns false if no such user existed.

func (*Store) DeleteWebAuthnCredential added in v0.2.0 

func (s *Store) DeleteWebAuthnCredential(id, userID string) (bool, error)

DeleteWebAuthnCredential removes a passkey the user owns. Returns false if no such credential exists for that user (id unknown or owned by someone else).

func (*Store) EnableRuntimeBoltHotStore added in v0.2.0 

func (s *Store) EnableRuntimeBoltHotStore(path string) error

EnableRuntimeBoltHotStore moves high-churn runtime collections to a record-level bbolt sidecar while keeping the Store API and in-memory read model unchanged. It is intentionally opt-in so operators can canary the Phase C runtime cutover without changing the JSON control-plane store.

The sidecar owns audit events, interactive sessions, proxy users, per-node proxy profiles, and proxy usage snapshots. Existing JSON values are imported into bbolt on first enable; existing bbolt values are merged back into memory on every enable so a restart recovers hot-domain writes that intentionally did not rewrite the whole JSON file.

func (*Store) EnabledNotifyChannels added in v0.2.0 

func (s *Store) EnabledNotifyChannels() []model.NotifyChannel

EnabledNotifyChannels returns only channels that are enabled.

func (*Store) EnabledNotifyRules added in v0.2.0 

func (s *Store) EnabledNotifyRules() []model.NotifyRule

EnabledNotifyRules returns enabled notification rules.

func (*Store) EnabledOIDCProviders added in v0.2.0 

func (s *Store) EnabledOIDCProviders() []model.OIDCProvider

func (*Store) FailTOTPChallenge added in v0.2.0 

func (s *Store) FailTOTPChallenge(id string, maxAttempts int) error

FailTOTPChallenge records a failed second-factor attempt against a challenge, burning it once it reaches maxAttempts so a single challenge cannot serve as an unlimited guessing oracle for its whole TTL.

func (*Store) GeoRouting added in v0.2.0 

func (s *Store) GeoRouting(id string) (model.GeoRouting, bool)

GeoRouting returns a geo-routing record by id.

func (*Store) GeoRoutings added in v0.2.0 

func (s *Store) GeoRoutings() []model.GeoRouting

GeoRoutings returns all geo-routing records sorted by creation time.

func (*Store) GeoRoutingsForNode added in v0.2.0 

func (s *Store) GeoRoutingsForNode(nodeID string) []model.GeoRouting

GeoRoutingsForNode returns geo-routing records that reference nodeID as a participating target or an authoritative DNS node (for re-render on change).

func (*Store) Group added in v0.2.0 

func (s *Store) Group(id string) (model.Group, bool)

Group returns a group by id (deep-copied).

func (*Store) GroupPolicies added in v0.2.0 

func (s *Store) GroupPolicies() []model.GroupNetPolicy

GroupPolicies returns all group policies sorted by id. Expansion (Phase 2) applies the (Priority, id, ruleIndex) precedence; id-sort here only guarantees a deterministic list.

func (*Store) GroupPolicy added in v0.2.0 

func (s *Store) GroupPolicy(id string) (model.GroupNetPolicy, bool)

GroupPolicy returns a group policy by id (deep-copied).

func (*Store) Groups added in v0.2.0 

func (s *Store) Groups() []model.Group

Groups returns all groups sorted by id. Callers that render the tree order by (ParentID, Order); id-sort here only guarantees a deterministic list.

func (*Store) GuardZone added in v0.2.1 

func (s *Store) GuardZone(id string) (model.GuardZone, bool)

GuardZone returns one stored guard zone by id.

func (*Store) GuardZones added in v0.2.1 

func (s *Store) GuardZones() []model.GuardZone

GuardZones returns all stored guard zones sorted by id.

func (*Store) KV 

func (s *Store) KV(bucket string) []model.KVEntry

func (*Store) KVEntry added in v0.2.0 

func (s *Store) KVEntry(bucket, key string) (model.KVEntry, bool)

func (*Store) LastMonitorResultForNode added in v0.2.0 

func (s *Store) LastMonitorResultForNode(monitorID, nodeID string) (model.MonitorResult, bool)

LastMonitorResultForNode returns a node's most recent result for a monitor.

func (*Store) LeaseTasks 

func (s *Store) LeaseTasks(nodeID string, limit int) ([]model.Task, error)

func (*Store) LogSource added in v0.2.0 

func (s *Store) LogSource(id string) (model.LogSource, bool)

LogSource returns a log source by id.

func (*Store) LogSources added in v0.2.0 

func (s *Store) LogSources() []model.LogSource

LogSources returns all log sources sorted by creation time.

func (*Store) LogSourcesForNode added in v0.2.0 

func (s *Store) LogSourcesForNode(nodeID string) []model.LogSource

LogSourcesForNode returns the enabled log sources a node should tail.

func (*Store) MachineProfile added in v0.2.0 

func (s *Store) MachineProfile(id string) (model.MachineProfile, bool)

MachineProfile returns a profile by id.

func (*Store) MachineProfileForNode added in v0.2.0 

func (s *Store) MachineProfileForNode(nodeID string) (model.MachineProfile, bool)

MachineProfileForNode returns the profile bound to a node, enforcing the v1 one-profile-per-node invariant at the API layer.

func (*Store) MachineProfiles added in v0.2.0 

func (s *Store) MachineProfiles() []model.MachineProfile

MachineProfiles returns all profiles sorted by creation time.

func (*Store) MachineVendor added in v0.2.1 

func (s *Store) MachineVendor(id string) (model.MachineVendor, bool)

func (*Store) MachineVendorByName added in v0.2.1 

func (s *Store) MachineVendorByName(name string) (model.MachineVendor, bool)

func (*Store) MachineVendors added in v0.2.1 

func (s *Store) MachineVendors() []model.MachineVendor

func (*Store) MarkStaleNodesOffline added in v0.2.0 

func (s *Store) MarkStaleNodesOffline(threshold time.Duration, now time.Time) ([]model.Node, error)

MarkStaleNodesOffline flips Online -> false for every node that is currently Online but whose last heartbeat (LastSeen) is older than threshold. It is the liveness sweep that corrects the otherwise-sticky Online flag (which was only ever set true on a beat and never reset, so a dead node kept showing online forever). It returns the nodes that transitioned online->offline so the caller can audit/notify, and persists once if anything changed.

func (*Store) Monitor added in v0.2.0 

func (s *Store) Monitor(id string) (model.Monitor, bool)

Monitor returns a monitor by id.

func (*Store) MonitorResults added in v0.2.0 

func (s *Store) MonitorResults(monitorID string) []model.MonitorResult

MonitorResults returns the result history for a monitor (oldest first).

func (*Store) Monitors added in v0.2.0 

func (s *Store) Monitors() []model.Monitor

Monitors returns all monitors sorted by creation time.

func (*Store) MonitorsForNode added in v0.2.0 

func (s *Store) MonitorsForNode(nodeID string) []model.Monitor

MonitorsForNode returns the enabled monitors a node should run.

func (*Store) NFTInputs added in v0.2.0 

func (s *Store) NFTInputs(nodeID string) (model.NFTInputs, bool)

NFTInputs returns the persisted inputs for a node.

func (*Store) NetPolicies added in v0.2.0 

func (s *Store) NetPolicies() []model.NetPolicy

NetPolicies returns all network policies sorted by target node id.

func (*Store) NetPolicy added in v0.2.0 

func (s *Store) NetPolicy(nodeID string) (model.NetPolicy, bool)

NetPolicy returns the policy for a target node.

func (*Store) Node 

func (s *Store) Node(id string) (model.Node, bool)

func (*Store) NodeGuardBinding added in v0.2.1 

func (s *Store) NodeGuardBinding(nodeID string) (model.NodeGuardBinding, bool)

NodeGuardBinding returns the guard binding for a node.

func (*Store) NodeGuardBindings added in v0.2.1 

func (s *Store) NodeGuardBindings() []model.NodeGuardBinding

NodeGuardBindings returns all guard bindings sorted by node id.

func (*Store) Nodes 

func (s *Store) Nodes() []model.Node

func (*Store) NotifyChannels added in v0.2.0 

func (s *Store) NotifyChannels() []model.NotifyChannel

NotifyChannels returns all channels sorted by creation time.

func (*Store) NotifyRules added in v0.2.0 

func (s *Store) NotifyRules() []model.NotifyRule

NotifyRules returns all notification rules sorted by creation time.

func (*Store) OIDCIdentity added in v0.2.0 

func (s *Store) OIDCIdentity(providerID, subject string) (model.OIDCIdentity, bool)

func (*Store) OIDCProvider added in v0.2.0 

func (s *Store) OIDCProvider(id string) (model.OIDCProvider, bool)

func (*Store) OIDCProviders added in v0.2.0 

func (s *Store) OIDCProviders() []model.OIDCProvider

func (*Store) PlanDeleteNode added in v0.2.0 

func (s *Store) PlanDeleteNode(nodeID string) (NodeCascadeReport, bool)

PlanDeleteNode computes the same cascade report DeleteNode would produce without mutating or persisting anything (a dry run). The bool is false when the node does not exist.

func (*Store) PluginInstallation added in v0.2.0 

func (s *Store) PluginInstallation(id string) (model.PluginInstallation, bool)

func (*Store) PluginInstallations added in v0.2.0 

func (s *Store) PluginInstallations() []model.PluginInstallation

func (*Store) ProxyInbound added in v0.2.0 

func (s *Store) ProxyInbound(id string) (model.ProxyInbound, bool)

ProxyInbound returns a proxy inbound template by id.

func (*Store) ProxyInbounds added in v0.2.0 

func (s *Store) ProxyInbounds() []model.ProxyInbound

ProxyInbounds returns all proxy inbound templates sorted by creation time.

func (*Store) ProxyNodeProfile added in v0.2.0 

func (s *Store) ProxyNodeProfile(nodeID string) (model.ProxyNodeProfile, bool)

ProxyNodeProfile returns a proxy node profile by node id.

func (*Store) ProxyNodeProfiles added in v0.2.0 

func (s *Store) ProxyNodeProfiles() []model.ProxyNodeProfile

ProxyNodeProfiles returns all proxy node profiles sorted by node id.

func (*Store) ProxyUsageSnapshot added in v0.2.0 

func (s *Store) ProxyUsageSnapshot(nodeID string) (model.ProxyUsageSnapshot, bool)

ProxyUsageSnapshot returns the last accounting snapshot for a node.

func (*Store) ProxyUsageSnapshots added in v0.2.0 

func (s *Store) ProxyUsageSnapshots() []model.ProxyUsageSnapshot

ProxyUsageSnapshots returns all proxy accounting snapshots sorted by node id.

func (*Store) ProxyUser added in v0.2.0 

func (s *Store) ProxyUser(id string) (model.ProxyUser, bool)

ProxyUser returns a proxy user by id.

func (*Store) ProxyUsers added in v0.2.0 

func (s *Store) ProxyUsers() []model.ProxyUser

ProxyUsers returns all proxy users sorted by creation time.

func (*Store) ProxyUsersForInbound added in v0.2.0 

func (s *Store) ProxyUsersForInbound(inboundID string) []model.ProxyUser

ProxyUsersForInbound returns users provisioned on an inbound. Empty InboundIDs means the user is eligible for every enabled inbound.

func (*Store) PutKV 

func (s *Store) PutKV(entry model.KVEntry) error

func (*Store) PutOIDCAuthState added in v0.2.0 

func (s *Store) PutOIDCAuthState(st auth.OIDCAuthState) error

func (*Store) PutOIDCIdentity added in v0.2.0 

func (s *Store) PutOIDCIdentity(idn model.OIDCIdentity) error

func (*Store) PutSession added in v0.2.0 

func (s *Store) PutSession(sess auth.Session) error

PutSession persists a session, pruning expired entries and enforcing the session cap on every write so neither memory nor the state file grows unbounded under credential-stuffing or churn.

func (*Store) PutStatic 

func (s *Store) PutStatic(obj model.StaticObject) error

func (*Store) PutTOTPChallenge added in v0.2.0 

func (s *Store) PutTOTPChallenge(c auth.TOTPChallenge) error

PutTOTPChallenge stores a pending second-factor challenge, sweeping expired or used ones first so the set stays bounded (challenges have a short TTL).

func (*Store) PutWebAuthnChallenge added in v0.2.0 

func (s *Store) PutWebAuthnChallenge(c auth.WebAuthnChallenge) error

PutWebAuthnChallenge stores a pending passkey ceremony challenge, sweeping expired/used ones first so the set stays bounded (challenges are short-lived), exactly like PutTOTPChallenge.

func (*Store) ReadyCheck added in v0.2.0 

func (s *Store) ReadyCheck() error

ReadyCheck verifies that the in-memory state is initialized and can still be serialized with the configured at-rest cipher. It does not write to disk or return state contents; callers use it for readiness probes.

func (*Store) RenameWebAuthnCredential added in v0.2.0 

func (s *Store) RenameWebAuthnCredential(id, userID, name string) (auth.WebAuthnCredential, bool, error)

RenameWebAuthnCredential updates the operator-editable label of a passkey the user owns. Ownership is enforced here so a caller cannot rename someone else's credential by guessing its id. Returns the updated record.

func (*Store) Results 

func (s *Store) Results() []model.TaskResult

func (*Store) RevokeStorageAccessToken added in v0.2.0 

func (s *Store) RevokeStorageAccessToken(id string) (model.StorageAccessToken, bool, error)

func (*Store) RevokeTokensByActor added in v0.2.0 

func (s *Store) RevokeTokensByActor(actorID string) int

RevokeTokensByActor marks every non-revoked API token owned by actorID as revoked. Used when deleting a user: bearer tokens are validated by hash + RevokedAt and ignore the user's SecurityEpoch, so they must be revoked explicitly or they outlive the account. Returns the count revoked.

func (*Store) RotateNodeToken added in v0.2.0 

func (s *Store) RotateNodeToken(nodeID, tokenHash string) (bool, error)

func (*Store) Save 

func (s *Store) Save() error

func (*Store) SecurityGroup added in v0.2.1 

func (s *Store) SecurityGroup(id string) (model.SecurityGroup, bool)

SecurityGroup returns one stored security group by id.

func (*Store) SecurityGroups added in v0.2.1 

func (s *Store) SecurityGroups() []model.SecurityGroup

SecurityGroups returns all stored security groups sorted by id.

func (*Store) Session added in v0.2.0 

func (s *Store) Session(id string) (auth.Session, bool)

Session returns an active session by id. Expired or revoked sessions report not-found without a write.

func (*Store) SetNodeDisabled added in v0.2.0 

func (s *Store) SetNodeDisabled(nodeID string, disabled bool) (bool, error)

SetNodeDisabled flips a node's revocation flag. A disabled node's token is refused by authentication, so this is an immediate revocation without deleting history or config.

func (*Store) SetPluginStatus added in v0.2.0 

func (s *Store) SetPluginStatus(id, status string) error

func (*Store) Static 

func (s *Store) Static(bucket string) []model.StaticObject

func (*Store) StaticObject added in v0.2.0 

func (s *Store) StaticObject(bucket, objectPath string) (model.StaticObject, bool)

func (*Store) StorageAccessToken added in v0.2.0 

func (s *Store) StorageAccessToken(id string) (model.StorageAccessToken, bool)

func (*Store) StorageAccessTokens added in v0.2.0 

func (s *Store) StorageAccessTokens(kind string) []model.StorageAccessToken

func (*Store) StorageBindingForHost added in v0.2.0 

func (s *Store) StorageBindingForHost(kind, hostname string) (model.StorageBinding, bool)

func (*Store) StorageBindings added in v0.2.0 

func (s *Store) StorageBindings(kind string) []model.StorageBinding

func (*Store) StorageBucket added in v0.2.0 

func (s *Store) StorageBucket(kind, name string) (model.StorageBucket, bool)

func (*Store) StorageBuckets added in v0.2.0 

func (s *Store) StorageBuckets(kind string) []model.StorageBucket

func (*Store) TOTPChallenge added in v0.2.0 

func (s *Store) TOTPChallenge(id string) (auth.TOTPChallenge, bool)

TOTPChallenge returns an active (unused, unexpired) challenge by id.

func (*Store) Task added in v0.2.0 

func (s *Store) Task(id string) (model.Task, bool)

func (*Store) Tasks 

func (s *Store) Tasks() []model.Task

func (*Store) Token added in v0.2.0 

func (s *Store) Token(id string) (model.Token, bool)

func (*Store) Tokens 

func (s *Store) Tokens() []model.Token

func (*Store) TouchNodeToken added in v0.2.0 

func (s *Store) TouchNodeToken(nodeID string, at time.Time, minInterval time.Duration) (bool, error)

func (*Store) TouchStorageAccessToken added in v0.2.0 

func (s *Store) TouchStorageAccessToken(id string) error

func (*Store) TouchWebAuthnCredential added in v0.2.0 

func (s *Store) TouchWebAuthnCredential(id string, signCount uint32, backupState bool, usedAt time.Time) error

TouchWebAuthnCredential records the results of a successful login against a credential: the refreshed signature counter, the current backup state, and the last-used timestamp. Ownership scoping keeps the write authoritative. The caller has already applied the clone-detection policy; this method only persists the agreed new values.

func (*Store) Tunnel added in v0.2.0 

func (s *Store) Tunnel(id string) (model.TunnelProfile, bool)

Tunnel returns a tunnel profile by id.

func (*Store) Tunnels added in v0.2.0 

func (s *Store) Tunnels() []model.TunnelProfile

Tunnels returns all tunnel profiles sorted by creation time.

func (*Store) UpdateMetrics 

func (s *Store) UpdateMetrics(nodeID string, metrics model.Metrics, version, publicIP, publicIPv6, internalIP, internalIPv6, wgIP string, hostFacts model.HostFacts) error

func (*Store) UpdateNodeGeo added in v0.2.0 

func (s *Store) UpdateNodeGeo(nodeID string, geo *model.NodeGeo) (model.Node, bool, error)

func (*Store) UpdateNodeMeta added in v0.2.0 

func (s *Store) UpdateNodeMeta(nodeID, name, role, comment string, tags []string, agentSourceAllowlist *[]string, inventory **model.NodeInventory) (model.Node, bool, error)

UpdateNodeMeta sets the operator-owned node identity fields and optional agent source allowlist in one locked read-modify-write so it cannot clobber concurrently-reported metrics/last-seen. Tags are trimmed, de-duplicated, and empties dropped. A nil agentSourceAllowlist leaves that policy unchanged; non-nil replaces it, including an empty slice to clear it. inventory uses the same nil-means-unchanged convention one level deeper: a nil outer pointer leaves the stored inventory untouched, while a non-nil outer replaces it with its (possibly nil, i.e. cleared) inner value. Returns the updated node and whether it existed.

func (*Store) UpsertAgentUpdatePolicy added in v0.2.0 

func (s *Store) UpsertAgentUpdatePolicy(policy model.AgentUpdatePolicy) error

UpsertAgentUpdatePolicy creates or updates the server-owned update intent for one node. NodeID is the stable key; policies carry no secrets.

func (*Store) UpsertApproval 

func (s *Store) UpsertApproval(a model.Approval) error

func (*Store) UpsertDDNSProfile added in v0.2.0 

func (s *Store) UpsertDDNSProfile(p model.DDNSProfile) error

UpsertDDNSProfile creates or updates a DDNS profile.

func (*Store) UpsertDNSDeployment added in v0.2.0 

func (s *Store) UpsertDNSDeployment(dep model.DNSDeployment) error

UpsertDNSDeployment stores a self-hosted DNS deployment intent record.

func (*Store) UpsertGeoRouting added in v0.2.0 

func (s *Store) UpsertGeoRouting(gr model.GeoRouting) error

UpsertGeoRouting creates or updates a geo-routing record.

func (*Store) UpsertGroup added in v0.2.0 

func (s *Store) UpsertGroup(g model.Group) error

UpsertGroup creates or updates a fleet group. The group's own ID is the key; callers mint it as "grp_<id>" (see internal/id). Slices are deep-copied on store so the caller cannot mutate persisted state through a retained header.

Phase 1: group CRUD endpoints add slug/name uniqueness, parent-cycle, and nesting-depth validation here (or in a service layer above this method); this Phase-0 store write intentionally persists intent without those checks.

func (*Store) UpsertGroupPolicy added in v0.2.0 

func (s *Store) UpsertGroupPolicy(p model.GroupNetPolicy) error

UpsertGroupPolicy creates or updates a group-scoped network policy. The policy ID is the key; callers mint it as "gnp_<id>" (see internal/id). Rules (and their Ports) are deep-copied on store.

func (*Store) UpsertGuardZone added in v0.2.1 

func (s *Store) UpsertGuardZone(zone model.GuardZone) error

UpsertGuardZone creates or updates a named guard zone.

func (*Store) UpsertLogSource added in v0.2.0 

func (s *Store) UpsertLogSource(ls model.LogSource) error

UpsertLogSource creates or updates a log source definition.

func (*Store) UpsertMachineProfile added in v0.2.0 

func (s *Store) UpsertMachineProfile(p model.MachineProfile) error

UpsertMachineProfile creates or updates operator-authored machine metadata.

func (*Store) UpsertMachineVendor added in v0.2.1 

func (s *Store) UpsertMachineVendor(v model.MachineVendor) error

UpsertMachineVendor creates or updates operator-authored vendor metadata.

func (*Store) UpsertMonitor added in v0.2.0 

func (s *Store) UpsertMonitor(m model.Monitor) error

UpsertMonitor creates or updates a monitor.

func (*Store) UpsertNFTInputs added in v0.2.0 

func (s *Store) UpsertNFTInputs(inputs model.NFTInputs) error

UpsertNFTInputs stores the authoritative baseline nft input set for a node. The key is NodeID so DNS/ACL/proxy providers can compose into one per-node lattice_guard render without coordinating a separate id namespace.

func (*Store) UpsertNetPolicy added in v0.2.0 

func (s *Store) UpsertNetPolicy(policy model.NetPolicy) error

UpsertNetPolicy stores the operator-authored network policy for a node.

func (*Store) UpsertNode 

func (s *Store) UpsertNode(n model.Node) error

func (*Store) UpsertNodeGuardBinding added in v0.2.1 

func (s *Store) UpsertNodeGuardBinding(binding model.NodeGuardBinding) (model.NodeGuardBinding, error)

UpsertNodeGuardBinding creates or updates a node's guard binding with the same optimistic-concurrency contract as UpsertSecurityGroup.

func (*Store) UpsertNotifyChannel added in v0.2.0 

func (s *Store) UpsertNotifyChannel(c model.NotifyChannel) error

UpsertNotifyChannel creates or updates a notification channel.

func (*Store) UpsertNotifyRule added in v0.2.0 

func (s *Store) UpsertNotifyRule(rule model.NotifyRule) error

UpsertNotifyRule creates or updates a notification routing rule.

func (*Store) UpsertOIDCProvider added in v0.2.0 

func (s *Store) UpsertOIDCProvider(p model.OIDCProvider) error

func (*Store) UpsertPluginInstallation added in v0.2.0 

func (s *Store) UpsertPluginInstallation(p model.PluginInstallation) error

func (*Store) UpsertProxyInbound added in v0.2.0 

func (s *Store) UpsertProxyInbound(in model.ProxyInbound) error

UpsertProxyInbound stores a central proxy inbound template.

func (*Store) UpsertProxyNodeProfile added in v0.2.0 

func (s *Store) UpsertProxyNodeProfile(profile model.ProxyNodeProfile) error

UpsertProxyNodeProfile stores the per-node proxy render profile.

func (*Store) UpsertProxyUsageSnapshot added in v0.2.0 

func (s *Store) UpsertProxyUsageSnapshot(snapshot model.ProxyUsageSnapshot) error

UpsertProxyUsageSnapshot stores the last accounting snapshot for a node.

func (*Store) UpsertProxyUser added in v0.2.0 

func (s *Store) UpsertProxyUser(u model.ProxyUser) error

UpsertProxyUser stores a central proxy subscriber identity.

func (*Store) UpsertSecurityGroup added in v0.2.1 

func (s *Store) UpsertSecurityGroup(group model.SecurityGroup) (model.SecurityGroup, error)

UpsertSecurityGroup creates or updates a reusable security group. New records must carry Version 0; updates must echo the stored Version. The store bumps the version and returns the persisted record.

func (*Store) UpsertStorageAccessToken added in v0.2.0 

func (s *Store) UpsertStorageAccessToken(t model.StorageAccessToken) error

func (*Store) UpsertStorageBinding added in v0.2.0 

func (s *Store) UpsertStorageBinding(b model.StorageBinding) error

func (*Store) UpsertStorageBucket added in v0.2.0 

func (s *Store) UpsertStorageBucket(b model.StorageBucket) error

func (*Store) UpsertToken 

func (s *Store) UpsertToken(t model.Token) error

func (*Store) UpsertTunnel added in v0.2.0 

func (s *Store) UpsertTunnel(t model.TunnelProfile) error

UpsertTunnel creates or updates a tunnel profile.

func (*Store) UpsertUser 

func (s *Store) UpsertUser(u model.User) error

func (*Store) UpsertWebAuthnCredential added in v0.2.0 

func (s *Store) UpsertWebAuthnCredential(c auth.WebAuthnCredential) error

UpsertWebAuthnCredential stores (or replaces) a passkey record. On insert it enforces the per-user cap so a client cannot register unbounded credentials; updates to an existing record (rename, sign-count refresh) are always allowed.

func (*Store) UpsertWorker 

func (s *Store) UpsertWorker(w model.WorkerScript) error

func (*Store) User 

func (s *Store) User(id string) (model.User, bool)

func (*Store) UserByUsername 

func (s *Store) UserByUsername(username string) (model.User, bool)

UserByUsername looks up a user by username, case-insensitively. Usernames are effectively case-insensitive identifiers (and OIDC binds on a lowercased email), so password login and SSO resolve the same account regardless of the case used to provision it.

func (*Store) UserCount added in v0.2.0 

func (s *Store) UserCount() int

func (*Store) Users added in v0.2.0 

func (s *Store) Users() []model.User

Users returns all operator user records (for the user-management admin API). Callers must project to a secret-free view before serializing.

func (*Store) WebAuthnChallenge added in v0.2.0 

func (s *Store) WebAuthnChallenge(id string) (auth.WebAuthnChallenge, bool)

WebAuthnChallenge returns an active (unused, unexpired) challenge by id.

func (*Store) WebAuthnCredential added in v0.2.0 

func (s *Store) WebAuthnCredential(id string) (auth.WebAuthnCredential, bool)

WebAuthnCredential returns a passkey record by store id.

func (*Store) WebAuthnCredentialByCredentialID added in v0.2.0 

func (s *Store) WebAuthnCredentialByCredentialID(credentialID []byte) (auth.WebAuthnCredential, bool)

WebAuthnCredentialByCredentialID looks a passkey up by its raw WebAuthn credential id (not the store id). Used on login to reject an unknown credential and during registration to reject a duplicate.

func (*Store) WebAuthnCredentialsByUser added in v0.2.0 

func (s *Store) WebAuthnCredentialsByUser(userID string) []auth.WebAuthnCredential

WebAuthnCredentialsByUser returns a user's passkeys, oldest first for a stable management list.

func (*Store) Workers 

func (s *Store) Workers() []model.WorkerScript

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.