status

type BackupFunc func(ctx context.Context) (BackupInfo, error)

type BackupInfo struct {
	Generation     uint64    `json:"generation"`
	Acknowledged   uint64    `json:"acknowledged"`
	AcknowledgedAt time.Time `json:"acknowledgedAt,omitzero"`
	Note           string    `json:"note,omitempty"`
	// Behind is how many generations the keyring is ahead of its backup.
	Behind   uint64 `json:"behind"`
	UpToDate bool   `json:"upToDate"`
}

type CryptoStatus struct {
	// Profile is the active algorithm profile, "standard" or "fips".
	Profile string `json:"profile"`
	// FIPSMode is whether the process runs in FIPS 140-3 mode.
	FIPSMode bool `json:"fipsMode"`
	// FIPSEnforced is whether non-approved algorithms are refused outright
	// (GODEBUG=fips140=only).
	FIPSEnforced bool `json:"fipsEnforced"`
	// ModuleVersion is the version of the Go cryptographic module in use.
	ModuleVersion string `json:"moduleVersion"`
	// Algorithms lists the exact names in the active profile.
	Algorithms []string `json:"algorithms"`
}

type FailedJob struct {
	Kind        string `json:"kind"`
	Purpose     string `json:"purpose,omitempty"`
	KEKID       string `json:"kekId,omitempty"`
	Version     uint32 `json:"version,omitempty"`
	Consecutive int    `json:"consecutive"`
}

type JobsStatus struct {
	InFlight int         `json:"inFlight"`
	Waiting  int         `json:"waiting"`
	Failed   []FailedJob `json:"failed,omitempty"`
}

type Options struct {
	// Store is the registry. Required.
	Store registry.Store
	// Rotator supplies due dates, eligibility and erasure status. Required.
	Rotator *rotate.Rotator
	// Providers are checked for health.
	Providers []provider.Provider
	// Purposes are the purposes to report. Required.
	Purposes []keyforge.Purpose
	// Policy is the policy in force, to show each purpose's settings.
	Policy policy.Set
	// Selector, when set, supplies the active algorithm profile.
	Selector *algorithm.Selector
	// Backups reports backup state by provider name, for providers that have a
	// keyring to back up.
	Backups map[string]BackupFunc
	// Scheduler, when set, supplies the latest tick's overdue and failed work.
	Scheduler *jobs.Scheduler
	// Clock defaults to the system clock.
	Clock keyforge.Clock
	// Logger receives the full text of the errors a report summarizes. A
	// report is shown to whoever may read status, and an error from a provider
	// or a store can name file paths, permissions and SQL, so the report says
	// what kind of failure it was and the detail goes here. The default is
	// [slog.Default].
	Logger *slog.Logger
}

type PolicyStatus struct {
	KEKInterval       time.Duration `json:"kekInterval"`
	DEKMaxAge         time.Duration `json:"dekMaxAge"`
	DEKMaxEncryptions uint64        `json:"dekMaxEncryptions"`
	RetirementDelay   time.Duration `json:"retirementDelay"`
	RetainVersions    int           `json:"retainVersions"`
	RequireBackup     bool          `json:"requireBackup"`
}

type ProviderStatus struct {
	Name    string `json:"name"`
	Healthy bool   `json:"healthy"`
	// Error says why it is not healthy. It names no key material.
	Error  string      `json:"error,omitempty"`
	Backup *BackupInfo `json:"backup,omitempty"`
	// BackupError says why the backup state could not be read.
	BackupError string `json:"backupError,omitempty"`
}

type PurposeStatus struct {
	Purpose  string `json:"purpose"`
	Provider string `json:"provider,omitempty"`
	KEKID    string `json:"kekId,omitempty"`
	// ActiveVersion is zero when the purpose has no usable key, which is a
	// problem: writes fail closed.
	ActiveVersion uint32          `json:"activeVersion"`
	Versions      []VersionStatus `json:"versions,omitempty"`

	// NextRotation is when the active version is due, and Overdue says whether
	// that is past.
	NextRotation time.Time     `json:"nextRotation,omitzero"`
	Overdue      bool          `json:"overdue"`
	OverdueBy    time.Duration `json:"overdueBy,omitempty"`

	// DataKeys counts the purpose's data keys by state.
	DataKeys map[string]int `json:"dataKeys,omitempty"`

	Policy PolicyStatus `json:"policy"`
	// Error is set when the purpose could not be read.
	Error string `json:"error,omitempty"`
}

type Report struct {
	GeneratedAt time.Time `json:"generatedAt"`
	// Healthy is false when anything below needs an operator: an unhealthy
	// provider, an overdue rotation, a stale backup, a failed job, a pending
	// erasure past its estimate, or a purpose with no usable key.
	Healthy bool `json:"healthy"`
	// Problems lists in plain words what makes Healthy false.
	Problems []string `json:"problems,omitempty"`

	Crypto    CryptoStatus     `json:"crypto"`
	Providers []ProviderStatus `json:"providers"`
	Purposes  []PurposeStatus  `json:"purposes"`
	Shreds    []ShredSummary   `json:"shreds,omitempty"`
	Jobs      *JobsStatus      `json:"jobs,omitempty"`
}

type Reporter struct {
	// contains filtered or unexported fields
}

type ShredSummary struct {
	Purpose         string    `json:"purpose"`
	Subject         string    `json:"subject"`
	RequestedAt     time.Time `json:"requestedAt"`
	PendingVersions int       `json:"pendingVersions"`
	ExpectedBy      time.Time `json:"expectedBy,omitzero"`
}

type VersionStatus struct {
	Version     uint32    `json:"version"`
	State       string    `json:"state"`
	ActivatedAt time.Time `json:"activatedAt,omitzero"`
	RotatedAt   time.Time `json:"rotatedAt,omitzero"`
	RetireAfter time.Time `json:"retireAfter,omitzero"`
	// References is how many data keys are still wrapped under it.
	References int `json:"references"`
	// Retirable is whether it may be retired now, and Reasons says why not.
	Retirable bool     `json:"retirable"`
	Reasons   []string `json:"reasons,omitempty"`
}