remotesync

type Action string

type Change struct {
	Action Action `json:"action"`
	Kind   string `json:"kind"`
	Ident  string `json:"ident"`
	Label  string `json:"label"`
	Error  string `json:"error,omitempty"`
}

type Entry struct {
	Digest  string `json:"digest"`
	Version int    `json:"version"`
}

type Key = database.SyncKey

type Manifest map[Key]Entry

type Meta struct {
	Name       string   `json:"name"`
	Comment    string   `json:"comment"`
	Tags       []string `json:"tags"`
	Notes      []Note   `json:"notes"`
	HasPrivate bool     `json:"has_private"`
}

type Note struct {
	ID        string    `json:"id"`
	Body      string    `json:"body"`
	CreatedAt time.Time `json:"created_at"`
}

type Object struct {
	Kind  string
	Ident string
	// Public is the certificate DER, the key's SubjectPublicKeyInfo DER, or
	// the SSH authorized_keys line.
	Public []byte
	// Private is the PKCS#8 DER or the SSH private key file; nil when not
	// loaded or not present (see Meta.HasPrivate).
	Private             []byte
	PassphraseProtected bool
	Source              string
	ImportedAt          time.Time
	Meta
}

type Options struct {
	DryRun bool
}

type Report struct {
	Remote   string   `json:"remote"`
	DryRun   bool     `json:"dry_run,omitempty"`
	Objects  int      `json:"objects"` // objects on the remote afterwards
	Changes  []Change `json:"changes"`
	Failed   int      `json:"failed"`
	Attempts int      `json:"attempts"`
}

type Store interface {
	// Identity names the remote; sync state is kept per identity.
	Identity() string
	// Manifest returns the manifest and its version (0 when there is none).
	Manifest(ctx context.Context) (Manifest, int, error)
	// PutManifest replaces the manifest if its version is still cas, or
	// returns ErrConflict.
	PutManifest(ctx context.Context, m Manifest, cas int) error
	// Get fetches an object with its private material.
	Get(ctx context.Context, k Key) (*Object, int, error)
	// Put writes an object if its version is still cas (0: must not exist)
	// and returns the new version, or returns ErrConflict.
	Put(ctx context.Context, o *Object, cas int) (int, error)
	// Delete removes an object and its history.
	Delete(ctx context.Context, k Key) error
}

type VaultStore struct {
	Client *vaultkv.Client
	Mount  string
	Path   string
	// Transit, when set, encrypts private keys with a Vault Transit key
	// before they are written, so KV readers without transit decrypt
	// permission only see ciphertext.
	Transit *vaultkv.Transit
	// Namespace is part of the identity only.
	Namespace string
}