Documentation
¶
Overview ¶
Package settings is the per-org, per-product configuration plane for the unified Hanzo Cloud binary — the /v1/settings/:product surface that lets an org read and edit a product's configuration, backed by a durable per-tenant store with KMS custody for any secret-typed field.
ONE settings engine, EVERY product. The console drives all ~130 products' Settings tab through this single surface (product id → :product). The config SCHEMA is a small, fixed, honest default set (fields that are genuinely stored, org-scoped, and readable by a product's own backend via the in-process seam) — merged with the org's persisted overrides. There is no per-product bespoke server code; a product is just a (org, product) key.
TENANT ISOLATION (what Red will attack). The org is ALWAYS principal.Tenant — the validated IAM owner claim (HIP-0026), never a client-supplied header, query param, or body field. Every store query binds `WHERE org=? AND product=?`; every KMS secret is keyed /orgs/{org}/settings/{product}/{key}. An org can therefore read or write ONLY its own product config. The product path segment is strictly slug-validated at the boundary so it can never smuggle path structure into the KMS key or the store key.
SECRET CUSTODY. A secret-typed field's VALUE lives ONLY in KMS (sealed, AES-256-GCM envelope); the store keeps only a non-secret marker that the secret is set. A GET never returns a secret value (masked). If KMS is not Ready, a write that includes a secret field fails closed (503) — a secret is NEVER written to SQLite in plaintext.
Surface (subsystem "settings", prefix /v1/settings; /v1 only):
GET /v1/settings/:product the merged config doc (secrets masked) -> settingsView PUT /v1/settings/:product persist config overrides -> settingsView
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Config ¶
Config returns an org's persisted NON-secret settings values for a product (the merged view of defaults + overrides), for a product's own backend to consume. Fails closed (nil) when unmounted. Secret values are NOT returned here — a consumer fetches those from KMS by the documented path.
Types ¶
type Record ¶
type Record struct {
Org string
Product string
Doc string // opaque JSON config document (non-secret values + secret markers)
UpdatedAt int64
}
Record is one org's persisted settings for one product.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store is the settings metastore over one SQLite file. MaxOpenConns(1) serializes writes against the file lock (same discipline as eval/integrations).
Source Files