demoseed

package
v1.0.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 17, 2026 License: Apache-2.0 Imports: 24 Imported by: 0

Documentation

Overview

Package demoseed implements the fail-closed Live Demo seed plan.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func GenerateHistory

func GenerateHistory(anchor time.Time) ([]model.AuditLog, []model.Approval, error)

GenerateHistory creates the fixed 300/24 demo corpus without reading the clock or using randomness. The anchor day and ordinal fully determine every field.

func SortedFixedIDs

func SortedFixedIDs(manifest Manifest) (datasources, agents []string)

func ValidateAPIKey

func ValidateAPIKey(value string) error

ValidateAPIKey accepts only the exact format emitted by store.GenerateAPIKey.

func ValidateHistory

func ValidateHistory(audits []model.AuditLog, approvals []model.Approval, anchor time.Time) error

ValidateHistory verifies both the aggregate contract and per-day coverage.

Types

type AgentManifest

type AgentManifest struct {
	ID        string `yaml:"id"`
	Name      string `yaml:"name"`
	Level     string `yaml:"level"`
	APIKeyEnv string `yaml:"api_key_env"`
}

type B5Manifest

type B5Manifest struct {
	AgentID      string   `yaml:"agent_id"`
	DatasourceID string   `yaml:"datasource_id"`
	PolicyID     string   `yaml:"policy_id"`
	Statements   []string `yaml:"statements"`
}

type DatasourceManifest

type DatasourceManifest struct {
	ID            string `yaml:"id"`
	Name          string `yaml:"name"`
	DBType        string `yaml:"db_type"`
	Host          string `yaml:"host"`
	Port          int    `yaml:"port"`
	Database      string `yaml:"database"`
	Username      string `yaml:"username"`
	PasswordEnv   string `yaml:"password_env"`
	ConnLimit     int    `yaml:"conn_limit"`
	StmtTimeoutMS int    `yaml:"stmt_timeout_ms"`
	RowLimit      int    `yaml:"row_limit"`
}

type DatasourcePinger

type DatasourcePinger interface {
	Ping(ctx context.Context, datasource model.Datasource, password string) error
}

DatasourcePinger is injectable so the default CLI can dial real databases while unit tests remain hermetic.

type FeatureEnroller

type FeatureEnroller interface {
	EnrollPostgresPolicySelect(context.Context, model.Datasource, []byte, string, executor.Limits) (executor.PostgresPolicyEnrollment, error)
	EnrollPostgresPolicyDML(context.Context, model.Datasource, []byte, string, executor.Limits) (executor.PostgresPolicyEnrollment, error)
}

type LookupEnv

type LookupEnv func(string) (string, bool)

type Manifest

type Manifest struct {
	Version     int                  `yaml:"version"`
	Banner      string               `yaml:"banner"`
	QPSPerAgent int                  `yaml:"qps_per_agent"`
	Datasources []DatasourceManifest `yaml:"datasources"`
	Agents      []AgentManifest      `yaml:"agents"`
	MaskRules   []MaskRuleManifest   `yaml:"mask_rules"`
	Policies    []PolicyManifest     `yaml:"policies"`
	B5          B5Manifest           `yaml:"b5"`
	Rules       []RuleManifest       `yaml:"rules"`
}

Manifest contains only public connection metadata and environment-variable references. It intentionally has no plaintext secret, key, or DSN fields.

func ParseManifest

func ParseManifest(contents []byte) (Manifest, error)

ParseManifest strictly decodes exactly one YAML document.

func (Manifest) Validate

func (manifest Manifest) Validate(cfg config.Config) error

Validate checks the manifest's fixed Live Demo contract against config and the executable built-in rule catalog.

type MaskRuleManifest

type MaskRuleManifest struct {
	ID            string `yaml:"id"`
	DatasourceID  string `yaml:"datasource_id"`
	SchemaName    string `yaml:"schema_name"`
	TableName     string `yaml:"table_name"`
	ColumnName    string `yaml:"column_name"`
	SensitiveType string `yaml:"sensitive_type"`
	Algo          string `yaml:"algo"`
}

type PolicyManifest

type PolicyManifest struct {
	ID            string `yaml:"id"`
	AgentID       string `yaml:"agent_id"`
	DatasourceID  string `yaml:"datasource_id"`
	ObjectType    string `yaml:"object_type"`
	ObjectName    string `yaml:"object_name"`
	Columns       string `yaml:"columns,omitempty"`
	EnrollmentSQL string `yaml:"enrollment_sql,omitempty"`
	Action        string `yaml:"action"`
}

type RuleManifest

type RuleManifest struct {
	ID      string `yaml:"id"`
	Enabled bool   `yaml:"enabled"`
}

type Secrets

type Secrets struct {
	Passwords map[string]string
	APIKeys   map[string]string
}

func LoadSecrets

func LoadSecrets(manifest Manifest, lookup LookupEnv) (Secrets, error)

LoadSecrets resolves every secret reference before any write occurs.

type Summary

type Summary struct {
	Datasources int
	Agents      int
	MaskRules   int
	Policies    int
	Rules       int
	Audits      int
	Approvals   int
	B5Grants    int
	B2Mode      string
}

func Run

func Run(
	ctx context.Context,
	metadataStore *store.Store,
	manifest Manifest,
	secrets Secrets,
	anchor time.Time,
	verifyOnly bool,
	pinger DatasourcePinger,
	enroller FeatureEnroller,
	masterSecret []byte,
) (Summary, error)

Run creates or verifies the complete fixed demo seed. Existing rows are compared and are never rotated; fixed-ID mask rules are updated to the current manifest so an upgraded demo database remains restart-safe.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL