Documentation
¶
Overview ¶
Package erasure erases one person's retained records, scope by scope, and reports complete only when every scope asked for is. It owns the order, the idempotence and the partial-failure answer; each scope's work is a Step the caller supplies, because the steps need the API server's locks and stores.
The fences that make an erasure hold across replicas are not built here: a destroyed subject key is revoked by the key store's durable destroyed_at check, and an erased run output by out-o2's tombstone. A Step only calls them.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNotAvailable = errors.New("erasure: this scope is not available on this server")
ErrNotAvailable is a scope this server has no way to erase.
var ErrScopeUnknown = errors.New("erasure: scopes must be a non-empty list of known names")
ErrScopeUnknown is the error ParseScopes answers for a name that is no scope and for an empty list.
Functions ¶
Types ¶
type IncompleteError ¶
IncompleteError is a partial failure: the scopes in Remaining are not done, the first of them because of Cause. Done lists the ones that are. A retry with the same scopes finishes the rest.
func (*IncompleteError) Error ¶
func (e *IncompleteError) Error() string
func (*IncompleteError) Unwrap ¶
func (e *IncompleteError) Unwrap() error
type Orchestrator ¶
Orchestrator runs steps. A scope with no step is not available on this server, and asking for it fails rather than reporting it erased.
func (*Orchestrator) Orchestrate ¶
func (o *Orchestrator) Orchestrate(ctx context.Context, person string, scopes []Scope) (Report, error)
Orchestrate erases person's records in scopes, once each, in the fixed order. It stops at the first scope that fails and returns an *IncompleteError naming that scope and every one after it, so the caller says exactly what is left. A scope that holds nothing for the person is a success: the call is idempotent, and a retry is the way to finish.
type Report ¶
type Report struct {
// Done lists the scopes that finished, in the order they ran.
Done []Scope
// Details holds what each finished step returned.
Details map[Scope]any
}
Report says what an Orchestrate call did.
type Scope ¶
type Scope string
Scope names one kind of record a person's erasure reaches.
const ( // Credentials: the person's stored credentials and the key they sit under. Credentials Scope = "credentials" // AuditPersonalFields: the key every sealed audit field of the person is // under, destroyed in every version. AuditPersonalFields Scope = "audit_personal_fields" // RunTasks: the task text of the person's runs. RunTasks Scope = "run_tasks" // RunOutputs: the stored output of the person's runs. RunOutputs Scope = "run_outputs" // Recordings: the person's session recordings. Opt-in: nothing deletes one // unless this scope is asked for. Recordings Scope = "recordings" // Components: the components the person saved, and what the snapshot of // every run they defined one for says about it. The run keeps a content-free // row, because it is what a revived run is checked against. Components Scope = "components" // RunSetups: the person's own run templates and their revisions, their // group template-manager grants, and their name as the author of shared // templates, revisions and grants, which stay without it. RunSetups Scope = "run_setups" // MaskCopies: the masking manifests of the person's runs, after their live // attaches and relays are fenced. MaskCopies Scope = "mask_copies" // RunnerPools: the person's own Self-Hosted runner pools, deleted (their // runners leave them and runs waiting for them end), and their name on // every pool of theirs, the deleted ones included. RunnerPools Scope = "runner_pools" // MemberDrives: the drives the person created for themselves, each deleted // with its files through the same path as their own delete. A drive a run // still holds fails the scope, naming the drive. MemberDrives Scope = "member_drives" )
func ParseScopes ¶
ParseScopes turns names into scopes. An empty list or an unknown name is ErrScopeUnknown naming it, so nothing runs on a request that misspelt one.
Source Files