Documentation
¶
Overview ¶
Package demoseed implements the fail-closed Live Demo seed plan.
Index ¶
- func GenerateHistory(anchor time.Time) ([]model.AuditLog, []model.Approval, error)
- func SortedFixedIDs(manifest Manifest) (datasources, agents []string)
- func ValidateAPIKey(value string) error
- func ValidateHistory(audits []model.AuditLog, approvals []model.Approval, anchor time.Time) error
- type AgentManifest
- type B5Manifest
- type DatasourceManifest
- type DatasourcePinger
- type FeatureEnroller
- type LookupEnv
- type Manifest
- type MaskRuleManifest
- type PolicyManifest
- type RuleManifest
- type Secrets
- type Summary
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GenerateHistory ¶
GenerateHistory creates the fixed 300/24 demo corpus without reading the clock or using randomness. The anchor day and ordinal fully determine every field.
func SortedFixedIDs ¶
func ValidateAPIKey ¶
ValidateAPIKey accepts only the exact format emitted by store.GenerateAPIKey.
Types ¶
type AgentManifest ¶
type B5Manifest ¶
type DatasourceManifest ¶
type DatasourceManifest struct {
ID string `yaml:"id"`
Name string `yaml:"name"`
DBType string `yaml:"db_type"`
Host string `yaml:"host"`
Port int `yaml:"port"`
Database string `yaml:"database"`
Username string `yaml:"username"`
PasswordEnv string `yaml:"password_env"`
ConnLimit int `yaml:"conn_limit"`
StmtTimeoutMS int `yaml:"stmt_timeout_ms"`
RowLimit int `yaml:"row_limit"`
}
type DatasourcePinger ¶
type DatasourcePinger interface {
Ping(ctx context.Context, datasource model.Datasource, password string) error
}
DatasourcePinger is injectable so the default CLI can dial real databases while unit tests remain hermetic.
type FeatureEnroller ¶
type FeatureEnroller interface {
EnrollPostgresPolicySelect(context.Context, model.Datasource, []byte, string, executor.Limits) (executor.PostgresPolicyEnrollment, error)
EnrollPostgresPolicyDML(context.Context, model.Datasource, []byte, string, executor.Limits) (executor.PostgresPolicyEnrollment, error)
}
type Manifest ¶
type Manifest struct {
Version int `yaml:"version"`
Banner string `yaml:"banner"`
QPSPerAgent int `yaml:"qps_per_agent"`
Datasources []DatasourceManifest `yaml:"datasources"`
Agents []AgentManifest `yaml:"agents"`
MaskRules []MaskRuleManifest `yaml:"mask_rules"`
Policies []PolicyManifest `yaml:"policies"`
B5 B5Manifest `yaml:"b5"`
Rules []RuleManifest `yaml:"rules"`
}
Manifest contains only public connection metadata and environment-variable references. It intentionally has no plaintext secret, key, or DSN fields.
func ParseManifest ¶
ParseManifest strictly decodes exactly one YAML document.
type MaskRuleManifest ¶
type PolicyManifest ¶
type PolicyManifest struct {
ID string `yaml:"id"`
AgentID string `yaml:"agent_id"`
DatasourceID string `yaml:"datasource_id"`
ObjectType string `yaml:"object_type"`
ObjectName string `yaml:"object_name"`
Columns string `yaml:"columns,omitempty"`
EnrollmentSQL string `yaml:"enrollment_sql,omitempty"`
Action string `yaml:"action"`
}
type RuleManifest ¶
type Summary ¶
type Summary struct {
Datasources int
Agents int
MaskRules int
Policies int
Rules int
Audits int
Approvals int
B5Grants int
B2Mode string
}
func Run ¶
func Run( ctx context.Context, metadataStore *store.Store, manifest Manifest, secrets Secrets, anchor time.Time, verifyOnly bool, pinger DatasourcePinger, enroller FeatureEnroller, masterSecret []byte, ) (Summary, error)
Run creates or verifies the complete fixed demo seed. Existing rows are compared and are never rotated; fixed-ID mask rules are updated to the current manifest so an upgraded demo database remains restart-safe.