Documentation
¶
Overview ¶
Package xfile defines the provider-neutral contract for opening externally stored files. References are opaque identifiers, never operating-system paths.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ExpectedDigest ¶
type ExpectedDigest string
ExpectedDigest is an optional algorithm-prefixed digest supplied by a caller as an integrity hint (for example, "sha256:<hex>"). Resolvers must verify it against the opened object when it is non-empty.
type ExpectedSize ¶
type ExpectedSize int64
ExpectedSize is an optional size supplied by a caller as an integrity hint. Resolvers must verify it against the opened object when it is non-zero.
type ID ¶
type ID string
ID is an opaque provider-scoped file identifier. It must not contain or be interpreted as an operating-system path.
type Info ¶
Info contains metadata confirmed for the object actually opened. Provider, ID, Version, Size, and Digest identify the resolved object; Size and Digest are authoritative results, distinct from Ref's caller-supplied expectations. Digest uses an explicit algorithm prefix (for example, "sha256:<hex>").
type Provider ¶
type Provider string
Provider identifies the storage provider that owns a file. Its value is a routing hint, not an authorization credential.
type Ref ¶
type Ref struct {
Provider Provider
ID ID
Version Version
ExpectedSize ExpectedSize
ExpectedDigest ExpectedDigest
}
Ref identifies a file without exposing a storage path. All fields are untrusted input: in particular, none of them grants access to the file.
type Resolver ¶
Resolver opens a referenced file. Implementations must derive caller and tenant authorization exclusively from ctx (using ScopeFromContext); Ref is untrusted selection/integrity data and must never be used as authorization. Implementations should classify errors with kernel/xerr. On success, the caller owns and must close the returned reader.
type Scope ¶
Scope is the authenticated caller and tenant associated with an operation. Its values are copied from xctx so they remain stable if the request scope is later released to the scope pool.
func ScopeFromContext ¶
ScopeFromContext extracts the authenticated caller and tenant from the request scope. Resolvers should call this before authorizing an open and must never infer either value from a Ref.
Missing caller or tenant scope is classified as Unauthorized, consistent with Kernel's request authorization guards.
Source Files