leasehttp

type Authorize ¶

type Authorize = replicationauth.Authorize

Authorize authenticates a verified mTLS peer. Its returned stable identity is deliberately not supplied by a lease frame or URL.

func NewMTLSAuthorizer(config MTLSConfig) (Authorize, error)

type Client ¶

type Client struct {
	// contains filtered or unexported fields
}

Client implements primarylease.LeaseStore over a single verified HTTPS member endpoint. QuorumStore owns majority behavior across several clients.

func NewClient(options ClientOptions) (*Client, error)

func (client *Client) CompareAndSwapPrimaryLease(ctx context.Context, databaseID [16]byte, previous *primarylease.LeaseRecord, next primarylease.LeaseRecord) (bool, error)

func (client *Client) LoadPrimaryLease(ctx context.Context, databaseID [16]byte) (primarylease.LeaseRecord, bool, error)

func (client *Client) PrimaryLeaseMemberIdentities() []string

func (client *Client) PrimaryLeaseMemberIdentity() string

type ClientOptions ¶

type ClientOptions struct {
	Endpoint string
	// ExpectedServerFingerprint is the legacy single-leaf configuration. New
	// deployments should use ExpectedServerFingerprints so an old and a new
	// leaf can overlap during a controlled rotation. The two fields are mutually
	// exclusive.
	ExpectedServerFingerprint string
	// ExpectedServerFingerprints is one to four lowercase SHA-256 server leaf
	// fingerprints. Every configured leaf identifies the same static quorum
	// member; QuorumStore rejects an overlap with another replica's pin set.
	ExpectedServerFingerprints []string
	HTTPClient                 *http.Client
}

ClientOptions creates one HTTPS LeaseStore client for a configured quorum member. HTTPClient should carry the caller's mTLS certificate and trusted server roots. The endpoint cannot include a path, query, userinfo or fragment, preventing URL-controlled routing ambiguity.

type MTLSConfig ¶

type MTLSConfig = replicationauth.MTLSConfig

type Member ¶

type Member struct {
	// contains filtered or unexported fields
}

Member is an HTTP handler for exact Load/CAS LeaseStore operations.

func NewMember(config MemberConfig) (*Member, error)

func (member *Member) ServeHTTP(writer http.ResponseWriter, request *http.Request)

type MemberConfig ¶

type MemberConfig struct {
	Store     primarylease.LeaseStore
	Authorize Authorize
}

MemberConfig configures one controller member handler. The enclosing server must require and verify client certificates; Authorize maps the verified leaf certificate to a configured controller identity.