targets

type Authorizer interface {
	// VisibleTargets returns the targets granted to the user, given the spaces
	// they are a member of. Returns least-disclosure projections.
	VisibleTargets(ctx context.Context, userID string, spaceIDs []string) ([]PublicView, error)
	// MayUse reports whether the user may use target targetID for space spaceID.
	MayUse(ctx context.Context, userID, spaceID, targetID string) (bool, error)
}

type BootstrapConfig struct {
	// Enable gates the whole operation; false is the safe default.
	Enable bool
	// ID is the stable identifier of the seeded target.
	ID   string
	Name string

	Endpoint     string
	Region       string
	Bucket       string
	Prefix       string
	UsePathStyle bool
	DisableTLS   bool

	// Creds are the S3 credentials a backup run uses. They are sealed
	// immediately and never retained in this struct beyond the call.
	Creds PlainCreds
	// MaintenanceCreds are the credentials a prune run uses. Optional: left
	// empty, both roles use Creds, which is the single-key deployment.
	MaintenanceCreds PlainCreds
}

type BootstrapEnv struct {
	Enable                     bool          `env:"BOOTSTRAP_ENABLE" doc:"Seed the target below on start, if no target exists yet. Needs TW_KEY."`
	TargetID                   string        `env:"BOOTSTRAP_TARGET_ID" doc:"Id of the seeded target. Unset, a fixed default id."`
	TargetName                 string        `env:"BOOTSTRAP_TARGET_NAME" doc:"Display name of the seeded target."`
	Endpoint                   string        `env:"BOOTSTRAP_S3_ENDPOINT" doc:"S3 endpoint, host:port or URL."`
	Region                     string        `env:"BOOTSTRAP_S3_REGION" doc:"S3 region."`
	Bucket                     string        `env:"BOOTSTRAP_S3_BUCKET" doc:"S3 bucket."`
	Prefix                     string        `env:"BOOTSTRAP_S3_PREFIX" doc:"Prefix inside the bucket."`
	UsePathStyle               bool          `env:"BOOTSTRAP_S3_USE_PATH_STYLE" doc:"Path-style addressing (Garage and most self-hosted S3 need it)."`
	DisableTLS                 bool          `env:"BOOTSTRAP_S3_DISABLE_TLS" doc:"Plain HTTP to the endpoint."`
	AccessKeyID                config.Secret `env:"BOOTSTRAP_S3_ACCESS_KEY_ID" doc:"Access key id backups write with."`
	SecretAccessKey            config.Secret `env:"BOOTSTRAP_S3_SECRET_ACCESS_KEY" doc:"Secret for that access key id."`
	MaintenanceAccessKeyID     config.Secret `` /* 134-byte string literal not displayed */
	MaintenanceSecretAccessKey config.Secret `env:"BOOTSTRAP_S3_MAINTENANCE_SECRET_ACCESS_KEY" doc:"Secret for the maintenance access key id."`
}

type CredSealer interface {
	// Seal wraps a target's credentials for storage.
	Seal(c CredentialSet) (wrapped []byte, version int, err error)
	// Open unwraps stored credentials for immediate, in-memory use.
	Open(wrapped []byte) (CredentialSet, error)
}

type CredentialSet struct {
	Backup      PlainCreds
	Maintenance PlainCreds
}

type Grant struct {
	TargetID string     `json:"target_id"`
	Scope    GrantScope `json:"scope"`
	// UserID is set when Scope == ScopeUser: an OpenCloud user id.
	UserID string `json:"user_id,omitempty"`
	// SpaceID is set when Scope == ScopeSpace.
	SpaceID string `json:"space_id,omitempty"`
}

type GrantScope int

type MemoryStore struct {
	// contains filtered or unexported fields
}

type NotFoundError struct{ ID string }

type PlainCreds struct {
	AccessKeyID     string
	SecretAccessKey string
}

type PublicView struct {
	ID   string
	Name string
}

type Role string

type StateStore struct {
	// contains filtered or unexported fields
}

type Store interface {
	// CreateTarget persists a target (with its already-sealed WrappedCreds).
	CreateTarget(ctx context.Context, t Target) (Target, error)
	// UpdateTarget updates target metadata. If WrappedCreds is nil the stored
	// credentials are left unchanged (supports "edit without re-entering creds",
	// phase-8).
	UpdateTarget(ctx context.Context, t Target) (Target, error)
	// DeleteTarget removes a target and its grants.
	DeleteTarget(ctx context.Context, id string) error
	// GetTarget returns a target by ID (including WrappedCreds for worker use).
	GetTarget(ctx context.Context, id string) (Target, error)
	// ListTargets returns all targets (admin view).
	ListTargets(ctx context.Context) ([]Target, error)

	// PutGrant adds or replaces a grant.
	PutGrant(ctx context.Context, g Grant) error
	// DeleteGrant removes a grant.
	DeleteGrant(ctx context.Context, g Grant) error
	// ListGrants returns the grants for a target.
	ListGrants(ctx context.Context, targetID string) ([]Grant, error)
	// ReplaceGrants sets a target's whole audience in one write. The admin API
	// edits grants as a set, and the durable store keeps them as one document
	// per version, so applying such an edit as a sequence of PutGrant and
	// DeleteGrant calls would leave a crash able to stop halfway through — with
	// a grant list nobody chose. Passing an empty list revokes everything,
	// which is a decision an admin can legitimately make and is therefore not
	// the same as deleting the target.
	ReplaceGrants(ctx context.Context, targetID string, grants []Grant) error
}

type Target struct {
	ID           string `json:"id"`
	Name         string `json:"name"`
	Endpoint     string `json:"endpoint"`
	Region       string `json:"region,omitempty"`
	Bucket       string `json:"bucket"`
	Prefix       string `json:"prefix,omitempty"`
	UsePathStyle bool   `json:"use_path_style,omitempty"`
	DisableTLS   bool   `json:"disable_tls,omitempty"`
	// WrappedCreds is the TW-wrapped S3 credential blob (never plaintext, never
	// logged, never returned by any read API). Versioned like the key envelope.
	// It holds the target's whole CredentialSet — every Role — as one sealed
	// record, so a rotation re-seals one blob rather than keeping several in
	// step.
	WrappedCreds []byte    `json:"wrapped_creds,omitempty"`
	CreatedAt    time.Time `json:"created_at,omitzero"`
	UpdatedAt    time.Time `json:"updated_at,omitzero"`
	// Version is the WrappedCreds envelope version (compatibility promise).
	Version int `json:"version,omitempty"`
	// MaintenanceConfigured records whether WrappedCreds holds a separate
	// maintenance pair. It is metadata, not key material: a yes/no written at
	// seal time from what the writer supplied.
	//
	// It exists because the admin UI must be able to show whether a target is
	// credential-separated, and the only other way to answer that is to open
	// the sealed blob — which the admin path may not do (decisions.md #14).
	// Records written before this field read as false, which is the right
	// answer for the single-credential deployment they describe.
	MaintenanceConfigured bool `json:"maintenance_configured,omitempty"`
}

type UnreadableTargetsError struct{ Keys []string }