Documentation
¶
Index ¶
- Constants
- Variables
- type Authenticator
- type Authorizer
- type Config
- type DeletePolicy
- type DurablePolicyGenerationStore
- type DurableRPCIdempotencyStore
- type Handler
- type InsertPolicy
- type PolicyGenerationStore
- type Principal
- type QueryPolicy
- type QueryPolicyLease
- type QueryPolicyResolver
- type RPCAuthorizer
- type RPCError
- type RPCIdempotencyClaim
- type RPCIdempotencyCompletion
- type RPCIdempotencyDecision
- type RPCIdempotencyDecisionKind
- type RPCIdempotencyMaintenance
- type RPCIdempotencyStore
- type RPCMethod
- type RPCMethodResolver
- type RPCTransactionalMethod
- type RPCTransactionalMethodResolver
- type ServerStats
- type UpdatePolicy
- type WorkerAuthenticator
- type WorkerHub
- func (hub *WorkerHub) ResolveQueryPolicy(ctx context.Context, principal Principal, collection string, ...) (QueryPolicy, bool, error)
- func (hub *WorkerHub) ResolveRPCMethod(name string) (RPCMethod, bool)
- func (hub *WorkerHub) ResolveRPCTransactionalMethod(name string) (RPCTransactionalMethod, bool)
- func (hub *WorkerHub) ServeHTTP(writer http.ResponseWriter, request *http.Request)
- func (hub *WorkerHub) Stats() WorkerHubStats
- type WorkerHubConfig
- type WorkerHubStats
- type WorkerPrincipal
Constants ¶
const ( // ProtocolVersion is the current realtime/RPC envelope version. Existing // versions are immutable; incompatible grammar requires a new version. ProtocolVersion = 1 )
Variables ¶
var ( ErrUnauthenticated = errors.New("meldbase server: unauthenticated") ErrForbidden = errors.New("meldbase server: forbidden") )
var ErrInvalidPolicyLease = errors.New("meldbase server: invalid query policy lease")
Functions ¶
This section is empty.
Types ¶
type Authenticator ¶
type Authorizer ¶
type Authorizer interface {
AuthorizeQuery(context.Context, Principal, string, meldbase.QuerySpec) (QueryPolicy, error)
AuthorizeInsert(context.Context, Principal, string, meldbase.Document) (InsertPolicy, error)
AuthorizeUpdate(context.Context, Principal, string, meldbase.QuerySpec, meldbase.MutationSpec) (UpdatePolicy, error)
AuthorizeDelete(context.Context, Principal, string, meldbase.QuerySpec) (DeletePolicy, error)
}
type Config ¶
type Config struct {
DB *meldbase.DB
Authenticator Authenticator
Authorizer Authorizer
QueryPolicyResolver QueryPolicyResolver
PublicRealtimeURL string
OriginPatterns []string
AllowedHTTPOrigins []string
TicketTTL time.Duration
ResumeTokenKey []byte
ResumeTokenTTL time.Duration
MaxBodyBytes int
MaxQueryResultBytes int
MaxRealtimeFrameBytes int
MaxRealtimeOutboundBytes int
MaxSubscriptionsPerConnection int
QueryLimits meldbase.QueryLimits
ReplaySource meldbase.QueryReplaySource
RPCMethods map[string]RPCMethod
RPCTransactionalMethods map[string]RPCTransactionalMethod
RPCMethodResolver RPCMethodResolver
RPCTransactionalMethodResolver RPCTransactionalMethodResolver
RPCAuthorizer RPCAuthorizer
MaxConcurrentRPC int
MaxRPCPerConnection int
MaxRPCArguments int
MaxRPCResultBytes int
RPCIdempotencyStore RPCIdempotencyStore
RPCIdempotencyRetention time.Duration
RPCIdempotencyCommitTimeout time.Duration
}
type DeletePolicy ¶
type DeletePolicy struct {
QueryPolicy
MaxAffected int
}
type DurablePolicyGenerationStore ¶
type DurablePolicyGenerationStore struct {
// contains filtered or unexported fields
}
func NewDurablePolicyGenerationStore ¶
func NewDurablePolicyGenerationStore(db *meldbase.DB) (*DurablePolicyGenerationStore, error)
func (*DurablePolicyGenerationStore) LoadPolicyGeneration ¶
type DurableRPCIdempotencyStore ¶
type DurableRPCIdempotencyStore interface {
RPCIdempotencyStore
RPCIdempotencyMaintenance
}
func NewDurableRPCIdempotencyStore ¶
func NewDurableRPCIdempotencyStore(db *meldbase.DB) (DurableRPCIdempotencyStore, error)
NewDurableRPCIdempotencyStore creates the built-in V2-backed store. Memory databases and V1 files are rejected rather than receiving a non-durable fallback.
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
func (*Handler) Stats ¶
func (h *Handler) Stats() ServerStats
type InsertPolicy ¶
type PolicyGenerationStore ¶
type QueryPolicy ¶
type QueryPolicyLease ¶
type QueryPolicyLease struct {
// contains filtered or unexported fields
}
QueryPolicyLease linearizes policy revocation against authorized output. Revoke first prevents new acquisitions and closes Done, then waits for every acquisition already encoding or enqueueing a response to finish. Frames already placed in the transport queue are considered authorized in flight. One lease may be shared by many subscriptions governed by the same version.
func NewQueryPolicyLease ¶
func NewQueryPolicyLease(version string) (*QueryPolicyLease, error)
func (*QueryPolicyLease) Done ¶
func (lease *QueryPolicyLease) Done() <-chan struct{}
func (*QueryPolicyLease) Revoke ¶
func (lease *QueryPolicyLease) Revoke(ctx context.Context) error
Revoke is idempotent. A canceled context stops waiting but does not undo the revocation; a later call may wait for the same lease to drain.
func (*QueryPolicyLease) Valid ¶
func (lease *QueryPolicyLease) Valid() bool
func (*QueryPolicyLease) Version ¶
func (lease *QueryPolicyLease) Version() string
type QueryPolicyResolver ¶
type QueryPolicyResolver interface {
ResolveQueryPolicy(context.Context, Principal, string, meldbase.QuerySpec) (QueryPolicy, bool, error)
}
QueryPolicyResolver adds a dynamic, data-only visibility policy after the application's Authorizer has allowed a query. When configured, a missing resolution fails closed. Implementations may never return documents; they only narrow row membership, query paths, result fields and result count.
type RPCAuthorizer ¶
RPCAuthorizer is evaluated for every call before arguments are decoded or application code runs. Registration alone never grants call permission.
type RPCError ¶
type RPCError struct {
Code string
}
RPCError exposes one stable, non-sensitive application error code. Arbitrary handler errors are returned as "internal" and their text never crosses the transport boundary.
type RPCIdempotencyClaim ¶
type RPCIdempotencyClaim struct {
ScopeHash [32]byte
KeyHash [32]byte
Fingerprint [32]byte
SessionID [16]byte
ClaimID [16]byte
ExpiresAt time.Time
}
RPCIdempotencyClaim is persisted before application code starts. ScopeHash and KeyHash prevent the durable keyspace from retaining raw identities or caller keys. SessionID and ClaimID are compare-and-set ownership tokens.
type RPCIdempotencyCompletion ¶
type RPCIdempotencyCompletion struct {
Claim RPCIdempotencyClaim
Result []byte
ErrorCode string
ErrorStatus int
}
type RPCIdempotencyDecision ¶
type RPCIdempotencyDecision struct {
Kind RPCIdempotencyDecisionKind
Result []byte
ErrorCode string
ErrorStatus int
}
type RPCIdempotencyDecisionKind ¶
type RPCIdempotencyDecisionKind uint8
const ( RPCIdempotencyExecute RPCIdempotencyDecisionKind = iota + 1 RPCIdempotencyReplayResult RPCIdempotencyReplayError RPCIdempotencyInProgress RPCIdempotencyOutcomeUnknown RPCIdempotencyConflict )
type RPCIdempotencyStore ¶
type RPCIdempotencyStore interface {
Claim(context.Context, RPCIdempotencyClaim) (RPCIdempotencyDecision, error)
Complete(context.Context, RPCIdempotencyCompletion) error
MarkUnknown(context.Context, RPCIdempotencyClaim) error
}
RPCIdempotencyStore must be linearizable and durable. Claim must publish a new pending record before returning Execute. Complete and MarkUnknown are CAS transitions matching SessionID and ClaimID. Implementations must never turn a pending record owned by another session back into Execute.
type RPCMethod ¶
RPCMethod is a bounded, authenticated data-only request handler. Arguments and results use Meldbase's closed Value model, preserving Int64, Date, Binary and object semantics across Go and JavaScript.
type RPCMethodResolver ¶
RPCMethodResolver resolves dynamic trusted-worker methods. It is consulted only after the immutable local registry misses.
type RPCTransactionalMethod ¶
type RPCTransactionalMethod func(context.Context, Principal, []meldbase.Value, *meldbase.WriteTransaction) (meldbase.Value, error)
RPCTransactionalMethod stages point writes against a short immutable V2 snapshot. A successful result and all staged writes share one durable publication with the RPC idempotency terminal record after optimistic commit validation.
type RPCTransactionalMethodResolver ¶
type RPCTransactionalMethodResolver interface {
ResolveRPCTransactionalMethod(string) (RPCTransactionalMethod, bool)
}
RPCTransactionalMethodResolver is the equivalent dynamic boundary for transaction-aware methods.
type ServerStats ¶
type ServerStats struct {
CapturedAt time.Time `json:"capturedAt"`
StartedAt time.Time `json:"startedAt"`
ActiveConnections uint64 `json:"activeConnections"`
ConnectionsAccepted uint64 `json:"connectionsAccepted"`
RealtimeOutboundOverflows uint64 `json:"realtimeOutboundOverflows"`
RPCRequests uint64 `json:"rpcRequests"`
RPCActive uint64 `json:"rpcActive"`
RPCSucceeded uint64 `json:"rpcSucceeded"`
RPCFailed uint64 `json:"rpcFailed"`
RPCCanceled uint64 `json:"rpcCanceled"`
RPCRejected uint64 `json:"rpcRejected"`
RPCBusy uint64 `json:"rpcBusy"`
RPCArguments uint64 `json:"rpcArguments"`
RPCRequestBytes uint64 `json:"rpcRequestBytes"`
RPCResultBytes uint64 `json:"rpcResultBytes"`
RPCTotalNanos uint64 `json:"rpcTotalNanos"`
RPCMaxLatency time.Duration `json:"rpcMaxLatencyNanos"`
RPCIdempotencyClaims uint64 `json:"rpcIdempotencyClaims"`
RPCIdempotencyReplays uint64 `json:"rpcIdempotencyReplays"`
RPCIdempotencyConflicts uint64 `json:"rpcIdempotencyConflicts"`
RPCIdempotencyInProgress uint64 `json:"rpcIdempotencyInProgress"`
RPCIdempotencyUnknown uint64 `json:"rpcIdempotencyUnknown"`
RPCIdempotencyFailures uint64 `json:"rpcIdempotencyFailures"`
RPCAtomicCommits uint64 `json:"rpcAtomicCommits"`
RPCAtomicRollbacks uint64 `json:"rpcAtomicRollbacks"`
RPCAtomicNoopCompletions uint64 `json:"rpcAtomicNoopCompletions"`
Worker WorkerHubStats `json:"worker"`
}
ServerStats is a fixed-cardinality process-session snapshot. It deliberately contains no method, principal, tenant, argument, result or error text.
type UpdatePolicy ¶
type UpdatePolicy struct {
QueryPolicy
AllowAllUpdatePaths bool
AllowedUpdatePaths map[string]struct{}
MaxAffected int
}
type WorkerAuthenticator ¶
type WorkerAuthenticator interface {
AuthenticateWorker(*http.Request) (WorkerPrincipal, error)
}
WorkerAuthenticator is a separate control-plane trust boundary. Client authenticators must never be reused implicitly for worker connections.
func NewWorkerTokenAuthenticator ¶
func NewWorkerTokenAuthenticator(token string) (WorkerAuthenticator, error)
NewWorkerTokenAuthenticator creates a constant-time bearer authenticator. The raw token is not retained after construction.
type WorkerHub ¶
type WorkerHub struct {
// contains filtered or unexported fields
}
WorkerHub routes dynamically registered, separately authenticated worker methods. Mount it on a private control listener and pass it as both resolver fields when transactional worker methods are desired.
func NewWorkerHub ¶
func NewWorkerHub(config WorkerHubConfig) (*WorkerHub, error)
func (*WorkerHub) ResolveQueryPolicy ¶
func (*WorkerHub) ResolveRPCMethod ¶
func (*WorkerHub) ResolveRPCTransactionalMethod ¶
func (hub *WorkerHub) ResolveRPCTransactionalMethod(name string) (RPCTransactionalMethod, bool)
func (*WorkerHub) ServeHTTP ¶
func (hub *WorkerHub) ServeHTTP(writer http.ResponseWriter, request *http.Request)
func (*WorkerHub) Stats ¶
func (hub *WorkerHub) Stats() WorkerHubStats
type WorkerHubConfig ¶
type WorkerHubConfig struct {
Authenticator WorkerAuthenticator
PublicationCollections []string
RegistrationTimeout time.Duration
MaxFrameBytes int
MaxMethodsPerWorker int
MaxPublicationsPerWorker int
MaxPendingCalls int
MaxOperationsPerCall int
PolicyQueryLimits meldbase.QueryLimits
PolicyEvaluationTimeout time.Duration
PolicyGenerationStore PolicyGenerationStore
}
type WorkerHubStats ¶
type WorkerHubStats struct {
ConnectedWorkers uint64 `json:"connectedWorkers"`
RegisteredMethods uint64 `json:"registeredMethods"`
RegisteredPublications uint64 `json:"registeredPublications"`
CallsStarted uint64 `json:"callsStarted"`
CallsActive uint64 `json:"callsActive"`
CallsSucceeded uint64 `json:"callsSucceeded"`
CallsFailed uint64 `json:"callsFailed"`
CallsCanceled uint64 `json:"callsCanceled"`
CallsBusy uint64 `json:"callsBusy"`
ProtocolFailures uint64 `json:"protocolFailures"`
BytesReceived uint64 `json:"bytesReceived"`
BytesSent uint64 `json:"bytesSent"`
TransactionOps uint64 `json:"transactionOps"`
PolicyEvaluations uint64 `json:"policyEvaluations"`
PolicyActive uint64 `json:"policyActive"`
PolicySucceeded uint64 `json:"policySucceeded"`
PolicyDenied uint64 `json:"policyDenied"`
PolicyFailed uint64 `json:"policyFailed"`
PolicyCanceled uint64 `json:"policyCanceled"`
PolicyBusy uint64 `json:"policyBusy"`
PolicyInvalidations uint64 `json:"policyInvalidations"`
}
type WorkerPrincipal ¶
type WorkerPrincipal struct{ Subject string }