docstore

type Backend interface {
	// Name is the backend's identity in a record ("local", "s3").
	Name() string
	// Put stores the bytes of the file at path under hash. It may be called for a
	// hash it already holds, and must then leave the stored bytes as they are.
	Put(ctx context.Context, hash, path string, size int64, contentType string) error
	// Open reads the bytes stored under hash. A hash it does not hold is os.ErrNotExist.
	Open(ctx context.Context, hash string) (io.ReadCloser, error)
	// Delete removes the bytes stored under hash; a hash it does not hold is no error.
	Delete(ctx context.Context, hash string) error
}

type Bucket struct {
	// contains filtered or unexported fields
}

type Cipher interface {
	SealBytes(subject, name string, plain []byte) ([]byte, error)
	OpenBytes(subject, name string, sealed []byte) ([]byte, error)
	Erased(err error) bool
	// HasKey reports whether a subject's key still exists, so a sweep can remove the
	// documents an erasure made unreadable.
	HasKey(subject string) (bool, error)
}

type Local struct {
	// contains filtered or unexported fields
}

type ObjectStore interface {
	PutDocument(ctx context.Context, worker, bucket, key, contentType, disposition string, data []byte, metadata map[string]string) (map[string]any, error)
	GetDocument(ctx context.Context, worker, bucket, key string) ([]byte, error)
	DeleteDocument(ctx context.Context, worker, bucket, key string) error
}

type Options struct {
	// MaxBytes is the largest document accepted, the installation's limits.Document;
	// zero or less means the default document budget.
	MaxBytes int64
	// Default is the backend new documents are written to; nil is the local backend.
	Default Backend
	// Others are further backends existing records may name (the local backend is
	// always among them, so a document written before a switch stays readable).
	Others []Backend
	// Now is the clock; nil is time.Now.
	Now func() time.Time
	// Cipher enciphers the documents of personal variables; nil leaves Seal refusing.
	Cipher Cipher
}

type Record struct {
	ID string `json:"id"`
	// Name is the file name the uploader gave, without any directory part.
	Name string `json:"name"`
	// DeclaredType is the content type the uploader claimed; ContentType is what the
	// first bytes say, which is what the document is served as.
	DeclaredType string `json:"declaredType,omitempty"`
	ContentType  string `json:"contentType"`
	Size         int64  `json:"size"`
	SHA256       string `json:"sha256"`
	// Backend names where the bytes are, so a later change of the default does not
	// strand this document.
	Backend string `json:"backend"`
	// Uploader is the principal that uploaded it, "" with authentication off.
	Uploader string `json:"uploader,omitempty"`
	// CreatedAt is unix nanoseconds.
	CreatedAt int64 `json:"createdAt"`
	// BoundTo are the root process instances the document entered, ascending. Empty
	// means pending.
	BoundTo []uint64 `json:"boundTo,omitempty"`
	// Subject is the data subject whose key enciphers the bytes, when a variable the
	// process declares personal named the document (ADR-0314); "" when the bytes are
	// plain. Blob is then the SHA-256 of the ciphertext, the key the backend holds it
	// under — SHA256 stays the content's hash, which is what the reference states.
	Subject string `json:"subject,omitempty"`
	Blob    string `json:"blob,omitempty"`
}

type Store struct {
	// contains filtered or unexported fields
}

type SweepResult struct {
	Expired  int // pending documents past their time to live
	Released int // bound documents whose instances are all gone
	Erased   int // personal documents whose data subject was erased
	Blobs    int // byte blobs no record named any more
}