Help us shape the future of Go! Take the 2026 Go Developer Survey

engine

package
v0.4.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 31, 2026 License: Apache-2.0 Imports: 42 Imported by: 0

Documentation

Overview

Package engine implements the private encrypted replication protocol.

Index

Constants

View Source
const (
	MaxSnapshotRows  = 1 << 23
	MaxSnapshotBytes = 2 << 30
)

Decoder bounds. A snapshot is untrusted input from the authority or a URL.

View Source
const ChunkSize = 64 * 1024
View Source
const MaxGrants = 256
View Source
const MaxRequestBytes int64 = 1 << 50
View Source
const RowCost int64 = 256
View Source
const SnapshotBlobID = "snapshot"

SnapshotBlobID is the fixed blob key of a folder's packed snapshot. It is not a hex blob id, so no ticket or row can name it: Download, DownloadURLs and Upload stay denied for it. BlobStores must accept it alongside hex ids.

Variables

View Source
var (
	ErrWaitLimit = errors.New("too many outstanding waits; retry later")

	ErrDenied    = errors.New("not found or access denied")
	ErrBusy      = errors.New("path has an active upload")
	ErrExpired   = errors.New("upload reservation expired")
	ErrQuota     = errors.New("owner quota limit")
	ErrConflict  = errors.New("version conflict")
	ErrInvalid   = errors.New("invalid request")
	ErrKey       = errors.New("incorrect folder key")
	ErrIntegrity = errors.New("encrypted data integrity failure")
)

Functions

func CheckKey

func CheckKey(k FolderKey, check []byte) error

func DecodeWire

func DecodeWire(r io.Reader, v any) error

func KeyCheck

func KeyCheck(k FolderKey, folder string) []byte

func LoadIndex added in v0.4.0

func LoadIndex(db *sql.DB, fn func(IndexEntry) error) error

LoadIndex reads a replica's index.sqlite for diagnostics and tests. It validates exactly as attaching does.

func NormalizePath

func NormalizePath(s string) (string, error)

NormalizePath accepts portable, relative UTF-8 paths. It rejects rather than cleans traversal.

func OpenContent

func OpenContent(w io.Writer, r io.Reader, k FolderKey, folder, blob, pid string) error

OpenContent only promises integrity on successful return. Callers must stage output before publishing it.

func PathID

func PathID(k FolderKey, folder, p string) (string, error)

func ReadSnapshot added in v0.4.0

func ReadSnapshot(r io.Reader, folder string, version uint64, fn func(Row) error) (horizon uint64, err error)

ReadSnapshot streams a packed snapshot's rows to fn in path order. The header must name folder and version exactly; every row must be live, at or below version, and the stream must end exactly after its counted trailer. Rows are not authenticated here: their sealed metadata still needs OpenMetadata like rows from Changes. Errors from r pass through; framing and bound violations are ErrIntegrity.

func SealContent

func SealContent(w io.Writer, r io.Reader, k FolderKey, folder, blob, pid string) error

func SealMetadata

func SealMetadata(k FolderKey, folder, pid string, m FileMetadata) ([]byte, error)

func SealedSize

func SealedSize(n int64) int64

SealedSize includes the authenticated final empty chunk, even for an empty file.

Types

type Account

type Account struct{ Bytes, Rows, Folders int64 }

Account is a durable quota counter, updated with the selected folder delta.

type Authenticator

type Authenticator func(*http.Request) (Principal, error)

type BlobStore

BlobStore must create immutable objects, report actual stored sizes, and honor context cancellation. Objects are identified by server-generated folder/blob IDs. A presigned implementation can implement the same contract without an SDK here.

type BlobURLStore added in v0.4.0

type BlobURLStore interface {
	DownloadURL(ctx context.Context, folder, id string, ttl time.Duration) (string, error)
}

BlobURLStore is the optional BlobStore extension for direct downloads.

type Client

type Client interface {
	PrepareFolder(context.Context) (FolderChallenge, error)
	CreateFolder(context.Context, FolderSpec) (Folder, error)
	Grant(context.Context, string, Principal, Role) error
	Revoke(context.Context, string, Principal) error
	DeleteFolder(context.Context, string) error
	SetLimits(context.Context, string, Limits) error
	ListFolders(context.Context) ([]Folder, error)
	GetFolder(context.Context, string) (Folder, error)
	Reserve(context.Context, string, UploadRequest) (Ticket, error)
	Upload(context.Context, string, Ticket, io.Reader) error
	CancelUpload(context.Context, string, string) error
	Commit(context.Context, string, []Mutation) (Delta, error)
	Changes(context.Context, string, uint64) (Delta, error)
	Download(context.Context, string, string) (io.ReadCloser, error)
	DownloadURLs(context.Context, string, []string) ([]string, error)
	// Snapshot returns a packed snapshot's version and a short-lived bearer
	// URL, or zero and "" when none is offered. Decode it with ReadSnapshot.
	Snapshot(context.Context, string) (uint64, string, error)
	Wait(context.Context, string, uint64) (uint64, error)
}

Client is an authenticated transport. Server authorization is independent of transport.

type ConflictError

type ConflictError struct{ Paths []string }

ConflictError identifies only the paths whose bases are stale.

func (*ConflictError) Error

func (e *ConflictError) Error() string

func (*ConflictError) Unwrap

func (e *ConflictError) Unwrap() error

type Delta

type Delta struct {
	Full    bool
	Horizon uint64
	Next    string `json:",omitempty"`
	Version uint64
	Rows    []Row
}

func DecodeSnapshot added in v0.4.0

func DecodeSnapshot(r io.Reader, folder string, version uint64) (Delta, error)

DecodeSnapshot reads a whole packed snapshot as a full Delta at version.

type DirectoryBlobStore

type DirectoryBlobStore struct {
	// contains filtered or unexported fields
}

func OpenDirectoryBlobStore

func OpenDirectoryBlobStore(dir string) (*DirectoryBlobStore, error)

func (*DirectoryBlobStore) Close

func (b *DirectoryBlobStore) Close() error

func (*DirectoryBlobStore) Delete

func (b *DirectoryBlobStore) Delete(ctx context.Context, f, id string) error

func (*DirectoryBlobStore) Open

func (b *DirectoryBlobStore) Open(ctx context.Context, f, id string) (io.ReadCloser, error)

func (*DirectoryBlobStore) Put

func (b *DirectoryBlobStore) Put(ctx context.Context, f, id string, r io.Reader) (int64, error)

func (*DirectoryBlobStore) Size

func (b *DirectoryBlobStore) Size(ctx context.Context, f, id string) (int64, error)

type Entry added in v0.4.0

type Entry struct {
	Path        string
	Size        int64
	Directory   bool
	Placeholder bool
}

Entry is one path the replica tracks, read from local state without the network.

type Event

type Event struct {
	Version uint64
	Err     error
}

type FetchResult added in v0.4.0

type FetchResult struct {
	// Fetched lists the placeholders this call downloaded; Bytes is their plaintext size.
	Fetched []string
	Bytes   int64
	// Present counts matched files that were already downloaded.
	Present int
	// Unmatched lists patterns that matched no tracked file.
	Unmatched []string
	Failed    []Rejection
}

FetchResult reports one Fetch.

type FileMetadata

type FileMetadata struct {
	Path, BlobID string
	Size         int64
	Mode         uint32
	Directory    bool
	Hash         string
}

func OpenMetadata

func OpenMetadata(k FolderKey, folder string, row Row) (FileMetadata, error)

type Folder

type Folder struct {
	ID                string
	Owner             Principal
	Name, Description string
	Limits            Limits
	KeyCheck          []byte
	Version           uint64
	Horizon           uint64
	Usage             Usage
	Role              Role
}

func CreateFolder

func CreateFolder(ctx context.Context, c Client, spec FolderSpec, k FolderKey) (Folder, error)

CreateFolder computes the salted check only after the authority names the folder. The key remains in this client helper for both transports.

type FolderChallenge

type FolderChallenge struct {
	ID    string
	Proof []byte
}

type FolderKey

type FolderKey [32]byte

func NewFolderKey

func NewFolderKey() FolderKey

type FolderRecord

type FolderRecord struct {
	AuthEpoch     string
	Folder        Folder
	Grants        map[string]Role `json:"-"`
	Allocated     bool
	Deleted       bool
	FileUsage     Usage
	TransferUsage Usage
}

type FolderSpec

type FolderSpec struct {
	ID                string
	CreationProof     []byte
	Name, Description string
	Limits            Limits
	KeyCheck          []byte
}

type Garbage

type Garbage struct {
	FolderID, BlobID string
	Owner            Principal
	Size             int64
	Writing          bool
	// Writer and Lease are copied from the ticket that became this garbage.
	// Another authority's lease is still live until Lease, so collection must
	// not delete the blob early.
	Writer string
	Lease  time.Time
}

type HTTPClient

type HTTPClient struct {
	BaseURL          string
	HTTP             *http.Client
	Headers          http.Header
	MaxResponseBytes int64
}

HTTPClient carries caller-provided authentication headers. Use HTTPS outside local tests.

func NewHTTPClient

func NewHTTPClient(base string, headers http.Header) *HTTPClient

func (*HTTPClient) CancelUpload

func (c *HTTPClient) CancelUpload(x context.Context, id, tid string) error

func (*HTTPClient) Changes

func (c *HTTPClient) Changes(x context.Context, id string, v uint64) (Delta, error)

func (*HTTPClient) Commit

func (c *HTTPClient) Commit(x context.Context, id string, m []Mutation) (Delta, error)

func (*HTTPClient) CreateFolder

func (c *HTTPClient) CreateFolder(x context.Context, v FolderSpec) (Folder, error)

func (*HTTPClient) DeleteFolder

func (c *HTTPClient) DeleteFolder(x context.Context, id string) error

func (*HTTPClient) Download

func (c *HTTPClient) Download(x context.Context, id, blob string) (io.ReadCloser, error)

func (*HTTPClient) DownloadURLs added in v0.4.0

func (c *HTTPClient) DownloadURLs(ctx context.Context, folder string, blobs []string) ([]string, error)

func (*HTTPClient) GetFolder

func (c *HTTPClient) GetFolder(x context.Context, id string) (Folder, error)

func (*HTTPClient) Grant

func (c *HTTPClient) Grant(x context.Context, id string, p Principal, r Role) error

func (*HTTPClient) ListFolders

func (c *HTTPClient) ListFolders(x context.Context) ([]Folder, error)

func (*HTTPClient) PrepareFolder

func (c *HTTPClient) PrepareFolder(ctx context.Context) (FolderChallenge, error)

func (*HTTPClient) Reserve

func (c *HTTPClient) Reserve(x context.Context, id string, r UploadRequest) (Ticket, error)

func (*HTTPClient) Revoke

func (c *HTTPClient) Revoke(x context.Context, id string, p Principal) error

func (*HTTPClient) SetLimits

func (c *HTTPClient) SetLimits(x context.Context, id string, l Limits) error

func (*HTTPClient) Snapshot added in v0.4.0

func (c *HTTPClient) Snapshot(ctx context.Context, folder string) (uint64, string, error)

func (*HTTPClient) Upload

func (c *HTTPClient) Upload(x context.Context, id string, t Ticket, body io.Reader) error

func (*HTTPClient) Wait

func (c *HTTPClient) Wait(x context.Context, id string, v uint64) (uint64, error)

type InProcessClient

type InProcessClient struct {
	Server    *Server
	Principal Principal
}

func (*InProcessClient) CancelUpload

func (c *InProcessClient) CancelUpload(x context.Context, id, tid string) error

func (*InProcessClient) Changes

func (c *InProcessClient) Changes(x context.Context, id string, v uint64) (Delta, error)

func (*InProcessClient) Commit

func (c *InProcessClient) Commit(x context.Context, id string, m []Mutation) (Delta, error)

func (*InProcessClient) CreateFolder

func (c *InProcessClient) CreateFolder(x context.Context, v FolderSpec) (Folder, error)

func (*InProcessClient) DeleteFolder

func (c *InProcessClient) DeleteFolder(x context.Context, id string) error

func (*InProcessClient) Download

func (c *InProcessClient) Download(x context.Context, id, blob string) (io.ReadCloser, error)

func (*InProcessClient) DownloadURLs added in v0.4.0

func (c *InProcessClient) DownloadURLs(ctx context.Context, id string, blobs []string) ([]string, error)

func (*InProcessClient) GetFolder

func (c *InProcessClient) GetFolder(x context.Context, id string) (Folder, error)

func (*InProcessClient) Grant

func (c *InProcessClient) Grant(x context.Context, id string, p Principal, r Role) error

func (*InProcessClient) ListFolders

func (c *InProcessClient) ListFolders(x context.Context) ([]Folder, error)

func (*InProcessClient) PrepareFolder

func (c *InProcessClient) PrepareFolder(ctx context.Context) (FolderChallenge, error)

func (*InProcessClient) Reserve

func (*InProcessClient) Revoke

func (c *InProcessClient) Revoke(x context.Context, id string, p Principal) error

func (*InProcessClient) SetLimits

func (c *InProcessClient) SetLimits(x context.Context, id string, l Limits) error

func (*InProcessClient) Snapshot added in v0.4.0

func (c *InProcessClient) Snapshot(x context.Context, id string) (uint64, string, error)

func (*InProcessClient) Upload

func (c *InProcessClient) Upload(x context.Context, id string, t Ticket, r io.Reader) error

func (*InProcessClient) Wait

func (c *InProcessClient) Wait(x context.Context, id string, v uint64) (uint64, error)

type IndexEntry

type IndexEntry struct {
	Path, Local                                           string
	Hash                                                  [32]byte
	Blob                                                  [16]byte
	Version                                               uint64
	Size                                                  int64
	Dev, Inode                                            uint64
	Mode                                                  uint32
	Placeholder, RemoteOnly, Deleted, Awaiting, Directory bool
}

IndexEntry contains only authenticated local state, never sealed metadata. Path and Local share their string storage unless a case collision needs an alias.

type LimitError

type LimitError struct {
	Limit              string
	Maximum, Requested int64
}

func (*LimitError) Error

func (e *LimitError) Error() string

type Limits

type Limits struct{ MaxFileBytes, MaxTotalBytes, MaxFiles, MaxRows int64 }

type LocalFile

type LocalFile struct {
	Path, Local, Hash string
	Size              int64
	Mode              uint32
	Directory         bool
}

type MemoryBlobStore

type MemoryBlobStore struct {
	// contains filtered or unexported fields
}

func NewMemoryBlobStore

func NewMemoryBlobStore() *MemoryBlobStore

func (*MemoryBlobStore) Delete

func (b *MemoryBlobStore) Delete(ctx context.Context, f, id string) error

func (*MemoryBlobStore) Open

func (b *MemoryBlobStore) Open(ctx context.Context, f, id string) (io.ReadCloser, error)

func (*MemoryBlobStore) Put

func (b *MemoryBlobStore) Put(ctx context.Context, f, id string, r io.Reader) (int64, error)

func (*MemoryBlobStore) Size

func (b *MemoryBlobStore) Size(ctx context.Context, f, id string) (int64, error)

type MetaStore

type MetaStore interface {
	Transaction(context.Context, func(*Metadata) error) error
}

MetaStore serializes transactions across all server instances sharing it. A callback's error rolls back every change. Implementations must never expose state after a callback. For writes, load scoped records and owner Accounts, call Metadata.Prepare, then the callback and Metadata.Finish; persist changes atomically. With Paths selected, Files contains only those rows and FileUsage is the full cache. ReadOnly scopes use an independent snapshot and never persist the callback. Private account totals must not require account-wide rows.

type Metadata

type Metadata struct {
	Folders  map[string]FolderRecord
	Files    map[string]map[string]Row
	Tickets  map[string]Ticket
	Garbage  map[string]Garbage
	Accounts map[string]Account
	// contains filtered or unexported fields
}

func (*Metadata) Finish

func (m *Metadata) Finish()

Finish computes contributions once and atomically updates caches/counters.

func (*Metadata) Prepare

func (m *Metadata) Prepare(filesLoaded bool)

Prepare captures contributions before mutation. With partial/no file loading, FileUsage must contain the full cache; Files holds just the selected rows.

type Mutation

type Mutation struct {
	PathID      string
	BaseVersion uint64
	TicketID    string
	Metadata    []byte
	Deleted     bool
}

type NotificationSource

type NotificationSource interface{ Notifications() *Notifications }

Authorities opening the same SQLite database in this process share wakes. The embedder must route cross-process notifications through its transport; external stores can provide NotificationSource for that purpose.

type Notifications

type Notifications = notifications

Notifications is the process-local folder wake hub used by a metadata store.

func NewNotifications

func NewNotifications() *Notifications

NewNotifications creates a hub shared by authorities using an external store.

type Options

type Options struct {
	Name, StateDir                          string
	Debounce, RescanInterval, RetryInterval time.Duration
	Ignore                                  []string
	Manual                                  bool
	// Moved reports that dir is the attached root renamed on the same volume.
	Moved bool
	// OnDemand keeps undownloaded files as empty, unreadable placeholders.
	OnDemand bool
	// Downloads bounds concurrent blob downloads; zero selects 8.
	Downloads int
	// MaxPlaceholders (default 20,000, breadth first) and MaxFolderPlaceholders
	// (default 1,000 direct entries) bound placeholders; past either, a folder collapses.
	MaxPlaceholders, MaxFolderPlaceholders int
	// GuideName and Guide write a local-only guide at the root and in collapsed folders.
	GuideName, Guide string
}

type PostgresMetaStore added in v0.2.0

type PostgresMetaStore struct {
	// contains filtered or unexported fields
}

PostgresMetaStore is a MetaStore backed by one Postgres schema. Several processes may open the same schema. The caller owns db and must open it with the pgx stdlib driver (driver name "pgx"). Close does not close db. The pool must allow at least three connections: one stays on LISTEN and two remain for transactions. Unlimited (MaxOpenConnections 0) is accepted. Garbage collection claims a lease row and does not hold a pooled connection.

func OpenPostgresMetaStore added in v0.2.0

func OpenPostgresMetaStore(ctx context.Context, db *sql.DB, schema string) (*PostgresMetaStore, error)

OpenPostgresMetaStore creates schema when it is missing and starts the cross-process listener. An empty schema name uses "drivesync". schema must be a lowercase identifier. There is no migration path: the tables are the prototype shape and are created with IF NOT EXISTS. db must allow at least three connections. See PostgresMetaStore.

func (*PostgresMetaStore) Close added in v0.2.0

func (s *PostgresMetaStore) Close() error

func (*PostgresMetaStore) Notifications added in v0.2.0

func (s *PostgresMetaStore) Notifications() *Notifications

func (*PostgresMetaStore) Transaction added in v0.2.0

func (s *PostgresMetaStore) Transaction(ctx context.Context, fn func(*Metadata) error) error

type Principal

type Principal struct{ Tenant, Subject string }

type QuarantinedRow

type QuarantinedRow struct {
	Path    string
	PathID  string
	Version uint64
}

type Quota

type Quota struct{ MaxTotalBytes, MaxFolders, MaxFileBytes, MaxFiles int64 }

type QuotaFunc

type QuotaFunc func(context.Context, Principal) (Quota, error)

func (QuotaFunc) Quota

func (f QuotaFunc) Quota(c context.Context, p Principal) (Quota, error)

type QuotaPolicy

type QuotaPolicy interface {
	Quota(context.Context, Principal) (Quota, error)
}

Zero limits mean unlimited; negative values are invalid. Bytes are sealed bytes.

type Rejection

type Rejection struct {
	Path, Reason string
	Hash         string
	RetryAt      time.Time
}

type Replica

type Replica struct {
	// contains filtered or unexported fields
}

func Attach

func Attach(ctx context.Context, c Client, id string, k FolderKey, dir string, o Options) (*Replica, error)

func (*Replica) Close

func (r *Replica) Close() error

func (*Replica) Entries added in v0.4.0

func (r *Replica) Entries(patterns ...string) ([]Entry, error)

func (*Replica) Fetch added in v0.4.0

func (r *Replica) Fetch(ctx context.Context, patterns ...string) (FetchResult, error)

Fetch claims paths under syncMu, transfers without it, then validates the index version and inode again under the lock before publishing plaintext.

func (*Replica) Remember

func (r *Replica) Remember(v IndexEntry)

func (*Replica) RetryRejected

func (r *Replica) RetryRejected()

func (*Replica) ScanLocal

func (r *Replica) ScanLocal() (map[string]LocalFile, error)

func (*Replica) Status

func (r *Replica) Status() Status

func (*Replica) Sync

func (r *Replica) Sync(ctx context.Context) error

type Role

type Role string
const (
	Owner  Role = "owner"
	Writer Role = "writer"
	Reader Role = "reader"
)

type Row

type Row struct {
	FolderID, PathID, BlobID string
	Version                  uint64
	SealedSize               int64
	Metadata                 []byte
	Deleted                  bool
	DeletedAt                int64
}

type SQLiteMetaStore

type SQLiteMetaStore struct {
	// contains filtered or unexported fields
}

SQLiteMetaStore stores one durable SQL row per folder, file and reservation.

func OpenSQLiteMetaStore

func OpenSQLiteMetaStore(name string) (*SQLiteMetaStore, error)

func (*SQLiteMetaStore) Close

func (s *SQLiteMetaStore) Close() error

func (*SQLiteMetaStore) Notifications

func (s *SQLiteMetaStore) Notifications() *Notifications

func (*SQLiteMetaStore) Transaction

func (s *SQLiteMetaStore) Transaction(ctx context.Context, fn func(*Metadata) error) error

type Scope

type Scope struct {
	TicketPaths []string
	Principal   Principal
	Folder      string
	Create      bool
	GC          bool
	NoFiles     bool
	ReadOnly    bool
	Paths       []string
	Tickets     []string
	Garbage     []string
	Write       bool
	Owner       bool
}

Scope describes the records needed by a metadata transaction. Folder operations select only Folder and its primary owner counter; an empty Folder lists visible definitions or creates one. GC is an explicit maintenance scope. A nonnil Paths selects only those file rows (empty means none); nil loads all unless NoFiles/GC is set. ReadOnly callbacks are read snapshots without accounting updates or a writer lock.

func ScopeFromContext

func ScopeFromContext(ctx context.Context) (Scope, bool)

ScopeFromContext lets alternate MetaStore implementations select the same records as SQLite. An unscoped transaction is an administrative full view.

type Server

type Server struct {
	Meta           MetaStore
	Blobs          BlobStore
	Quotas         QuotaPolicy
	ReservationTTL time.Duration
	Now            func() time.Time

	TombstoneTTL time.Duration

	// SnapshotRows is the live-row count at which Snapshot offers a packed
	// snapshot. Zero selects 1,000; negative disables snapshots.
	SnapshotRows int
	// contains filtered or unexported fields
}

func NewServer

func NewServer(meta MetaStore, blobs BlobStore) *Server

func (*Server) CancelUpload

func (s *Server) CancelUpload(ctx context.Context, p Principal, id, tid string) error

func (*Server) Changes

func (s *Server) Changes(ctx context.Context, p Principal, id string, after uint64) (Delta, error)

func (*Server) ChangesPage

func (s *Server) ChangesPage(ctx context.Context, p Principal, id string, after, until uint64, page string) (Delta, error)

ChangesPage returns at most 512 rows. The continuation carries the initial full/incremental decision and horizon; compaction cannot switch modes mid-pull. Full pages use path order so concurrent updates remain in the current set.

func (*Server) Client

func (s *Server) Client(p Principal) *InProcessClient

func (*Server) CollectGarbage

func (s *Server) CollectGarbage(ctx context.Context) error

CollectGarbage expires tickets and durably queues and collects obsolete blobs. Run periodically even when no clients are active. Failed deletions remain charged.

func (*Server) Commit

func (s *Server) Commit(ctx context.Context, p Principal, id string, mut []Mutation) (Delta, error)

func (*Server) CompactTombstones

func (s *Server) CompactTombstones(ctx context.Context) error

CompactTombstones selects on the read pool and retires bounded path batches.

func (*Server) CreateFolder

func (s *Server) CreateFolder(ctx context.Context, p Principal, spec FolderSpec) (Folder, error)

func (*Server) DeleteFolder

func (s *Server) DeleteFolder(ctx context.Context, p Principal, id string) error

func (*Server) Download

func (s *Server) Download(ctx context.Context, p Principal, id, blob string) (io.ReadCloser, error)

func (*Server) DownloadURLs added in v0.4.0

func (s *Server) DownloadURLs(ctx context.Context, p Principal, id string, blobs []string) ([]string, error)

DownloadURLs authorizes the entire request before issuing bearer URLs.

func (*Server) GetFolder

func (s *Server) GetFolder(ctx context.Context, p Principal, id string) (Folder, error)

func (*Server) Grant

func (s *Server) Grant(ctx context.Context, p Principal, id string, grantee Principal, role Role) error

func (*Server) Handler

func (s *Server) Handler(auth Authenticator) http.Handler

func (*Server) ListFolders

func (s *Server) ListFolders(ctx context.Context, p Principal) ([]Folder, error)

func (*Server) PrepareFolder

func (s *Server) PrepareFolder(ctx context.Context, p Principal) (FolderChallenge, error)

The stateless, principal-bound challenge keeps IDs authority-generated, without exposing an existence oracle or retaining unauthenticated drafts.

func (*Server) RecoverUploads

func (s *Server) RecoverUploads(ctx context.Context) error

RecoverUploads retires interrupted publications. A writing ticket records the publishing authority and a lease that is renewed while bytes flow. This authority retires its own ticket once that publication ends. Another authority retires it only after the lease expires. SQLite is one process per database file and uses the same rule.

func (*Server) Reserve

func (s *Server) Reserve(ctx context.Context, p Principal, id string, r UploadRequest) (Ticket, error)

func (*Server) Revoke

func (s *Server) Revoke(ctx context.Context, p Principal, id string, grantee Principal) error

func (*Server) Run

func (s *Server) Run(ctx context.Context, interval time.Duration) error

Run recovers interrupted publications, then performs background collection and compaction. Postgres authorities share one schema: each pass claims the maintenance lease or skips. An in-flight upload is not a reason to wait. This process's publication is visible through wakes.live, and another authority's lease stays charged until it expires. SQLite remains one process per database file.

func (*Server) RunGC

func (s *Server) RunGC(ctx context.Context, interval time.Duration) error

RunGC runs maintenance in a background worker owned by the embedder. Start it once per authority and cancel its context before closing stores.

func (*Server) SetLimits

func (s *Server) SetLimits(ctx context.Context, p Principal, id string, l Limits) error

func (*Server) SetMaxWaitsPerPrincipal added in v0.3.0

func (s *Server) SetMaxWaitsPerPrincipal(n int)

SetMaxWaitsPerPrincipal raises or lowers the long-poll cap for every principal on this authority. Zero restores the default.

func (*Server) Snapshot added in v0.4.0

func (s *Server) Snapshot(ctx context.Context, p Principal, id string) (uint64, string, error)

Snapshot returns a short-lived URL for the folder's packed snapshot and the version it describes. Zero and an empty URL mean none is offered: the folder is small, the blob store cannot sign URLs, or building or signing failed. The snapshot may be older than the folder; read Changes after Version.

func (*Server) Subscribe

func (s *Server) Subscribe(ctx context.Context, p Principal, id string, after uint64) (<-chan Event, error)

Subscribe closes after cancellation or revocation, with a terminal error event.

func (*Server) Upload

func (s *Server) Upload(ctx context.Context, p Principal, id string, provided Ticket, r io.Reader) error

func (*Server) Wait

func (s *Server) Wait(ctx context.Context, p Principal, id string, after uint64) (uint64, error)

type Status

type Status struct {
	Quarantined                      []QuarantinedRow
	PendingUpBytes, PendingDownBytes int64
	Conflicts                        []string
	Rejected                         []Rejection
	Skipped                          []string
	LastSync                         time.Time
	Errors                           []string
	Version                          uint64
	Watcher                          string
	Placeholders, PlaceholderBytes   int64
}

type Ticket

type Ticket struct {
	AuthEpoch                                string
	SessionID                                string
	ID, FolderID, BlobID, PathID             string
	Principal                                Principal
	BaseVersion                              uint64
	SealedSize, ReservedBytes, ReservedFiles int64
	ReservedRows                             int64
	Expires                                  time.Time
	Uploaded                                 bool
	Writing                                  bool
	// Writer is the process publishing this ticket. Lease is when that claim
	// expires. Recovery and garbage collection treat a writing ticket as live
	// until Lease, including across processes. A zero Lease is already expired.
	Writer string
	Lease  time.Time
}

type UploadRequest

type UploadRequest struct {
	// SessionID identifies one replica state directory (random 128-bit hex).
	// Only the same principal/session can replace its previous ticket; empty or
	// different sessions get ErrBusy. This is contention control, not a grant.
	SessionID     string
	PathID        string
	BaseVersion   uint64
	SealedSize    int64
	MetadataBytes int64
}

type Usage

type Usage struct{ Bytes, Files, Rows, Reserved, ReservedFiles, ReservedRows, GarbageRows int64 }

type WireRequest

type WireRequest struct {
	Op, Folder, Ticket, Blob string
	Blobs                    []string `json:",omitempty"`
	Spec                     FolderSpec
	Grantee                  Principal
	Role                     Role
	Limits                   Limits
	Upload                   UploadRequest
	Mutations                []Mutation
	After                    uint64
	Page                     string
	Until                    uint64
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL