mount

type AllOptions struct {
	// Concurrency is how many manifests are mounted at once; zero or less is
	// DefaultMountConcurrency.
	Concurrency int
}

type Health struct {
	Path     string
	ID       string // the database ID, when mounted
	Mounted  bool
	Optional bool
	Err      error // why the mount failed or was not attempted; nil when mounted
	Elapsed  time.Duration
}

type Options struct {
	// CatalogueDir, when set, is where the inferred-schema catalogue lives,
	// as <CatalogueDir>/<database id>.inferred.json, for every engine —
	// instead of the default next to (or inside) the user's storage
	// (<file>.inferred.json, <folder>/.ovdb/inferred-schema.json).
	CatalogueDir string
	// SkipGitIdentity disables stamping a repo-local git identity on a local
	// inGitDB repository (see ensureGitIdentity; it only ever acts on a
	// repository top level that has no resolvable identity), so mounting
	// leaves .git/config untouched. Commits then rely on the host's own git
	// identity.
	SkipGitIdentity bool

	// ExcludedNativePostgresRelations omits exact schema/relation pairs from a
	// native read-only PostgreSQL mount's discovered schema. The default is to
	// expose every SELECT-readable relation. This is an opt-in consumer boundary:
	// excluded relations are absent from both discovery and the core's physical
	// collection mapping, so a caller cannot recover them by guessing an encoded
	// collection ID. A non-empty list is rejected for non-PostgreSQL engines and
	// non-native PostgreSQL mounts.
	ExcludedNativePostgresRelations []schema.NativeCollectionSource

	// AllowInsecureNativePostgresTransport lets a native read-only PostgreSQL
	// mount reach a remote host without a verified TLS connection (see
	// docs/native-postgres-read.md). By default such a mount requires
	// sslmode=verify-full or sslmode=verify-ca, with no plaintext fallback, unless
	// every host is local (a Unix socket, a loopback address or localhost). The
	// manifest field storage.postgres.insecure_transport and the environment
	// variable OVDB_NATIVE_POSTGRES_INSECURE_TRANSPORT allow the same.
	AllowInsecureNativePostgresTransport bool

	// NativePostgresStatementTimeout is the statement_timeout a native read-only
	// PostgreSQL session starts with, so the server itself ends a statement that
	// runs too long. Zero is DefaultNativePostgresStatementTimeout (15s).
	NativePostgresStatementTimeout time.Duration

	// NativePostgresDiscoveryTimeout bounds the catalogue read of a native
	// read-only PostgreSQL mount. Zero is DefaultNativePostgresDiscoveryTimeout
	// (30s).
	NativePostgresDiscoveryTimeout time.Duration

	// RequireReadOnlyNativePostgresRole refuses to mount a native read-only
	// PostgreSQL database whose role is a superuser, or owns or may write
	// (INSERT, UPDATE, DELETE or TRUNCATE, on a table or any of its columns) any
	// relation the mount exposes. Off by default; a service that exposes a
	// database to the public, such as the demo datasets, turns it on.
	RequireReadOnlyNativePostgresRole bool
}

type Spec struct {
	// Path is the manifest file.
	Path string
	// Options are the mount options of this manifest.
	Options Options
	// Optional lets the other mounts go on when this one fails, for example a
	// PostgreSQL database whose catalogue read fails or is slow while the SQLite
	// databases beside it can be served: the failure is reported in its Health and
	// All does not fail because of it. A required mount (the zero value) that
	// fails fails All.
	Optional bool
}