server

type Authenticate func(context.Context, string) (store.Access, error)

type Options struct {
	// DeprecatedVersions announces planned retirement of still-served majors.
	// Empty omits the signal; dates never disable routes. The host must satisfy
	// the contract's overlap, notice and continued-client-support obligations.
	DeprecatedVersions []p.DeprecatedVersion
	// DisplayName is the operator's optional label for people, not identity.
	DisplayName          string
	AuthMethods          []string
	AuthorizationServers []string
	ContentOrigin        string
	// Provision opts a deployment into creating datasets over HTTP. Leaving it
	// nil is not an oversight: a server that offers the route is making a
	// promise of its own. The engine must also implement store.Provisioning,
	// or the route stays refused.
	Provision Provision
	// CreationOffered lets a deployment stop offering creation while it is
	// running. Capability is deployment state and authority is per-caller
	// state, so this is separate from Provision: one decides whether anybody
	// may create here, the other whether this caller may.
	//
	// nil means offered whenever the engine can provision and Provision is
	// supplied. Returning false withdraws the advertisement and refuses the
	// route with not_supported — and must leave recovery working, which is
	// what keeps "cannot create" distinguishable from "cannot reconcile".
	CreationOffered func() bool
	// SharedReads advertises that this deployment's authorization server
	// accepts a request to read everything shared with the account. The
	// record protocol serves such an installation like any other; it is the
	// approval that differs, and only the deployment knows whether it offers
	// one.
	SharedReads bool
	// Provisioned tells the deployment about a dataset that now exists, so
	// that whatever it does for the datasets it holds it also does for this
	// one. Without it a dataset created over the wire is one the engine knows
	// and the deployment does not: its creator holds it according to the
	// storage and according to nothing else, and no administration surface
	// can see it until the server is restarted.
	//
	// It runs before the response, on the fresh creation and on a replay
	// alike, so bookkeeping that failed once is retried by the retry the
	// caller was going to make anyway. It must therefore be idempotent, and
	// its failure is reported — the dataset exists and the idempotency key
	// recovers it, so a caller that retries gets both the identity and the
	// bookkeeping.
	Provisioned func(context.Context, store.Access, string) error
}

type Provision func(context.Context, store.Access) error