blobstore

type LAN struct {
	// contains filtered or unexported fields
}

type Memory struct {
	// contains filtered or unexported fields
}

type S3 struct {
	// contains filtered or unexported fields
}

type S3Config struct {
	// Bucket name. Must already exist; we don't auto-create.
	Bucket string

	// Region (required by AWS even for S3-alikes; e.g. R2 wants "auto").
	Region string

	// Endpoint is the URL the gateway uses for its own direct SDK
	// calls. Should be reachable
	// from inside the gateway — for docker-compose dev that's the
	// internal docker hostname like http://clank-minio:9000. Leave
	// empty for AWS S3.
	Endpoint string

	// PublicEndpoint is the URL baked into presigned URLs handed out to
	// the laptop and any remote sprite. Must resolve from BOTH ends to
	// the same backing storage (because SigV4 binds the host into the
	// signature). When empty, falls back to Endpoint.
	//
	// Why two endpoints: the docker dev stack wraps minio behind a
	// Cloudflare quick tunnel so a fly.io sprite can pull from it; the
	// tunnel rewrites the Host header on inbound requests, which breaks
	// SigV4 if the gateway itself goes through it. The gateway short-
	// circuits to the docker-internal hostname for its own calls while
	// minting presigned URLs with the tunnel hostname.
	PublicEndpoint string

	// AccessKey + SecretKey for the bucket. Required.
	AccessKey string
	SecretKey string

	// UsePathStyle forces path-style addressing (bucket as URL path
	// segment, not subdomain). Required for MinIO and most R2 setups.
	UsePathStyle bool
}

type Storage interface {
	// PresignPut returns a presigned PUT URL valid for ttl. The URL is
	// itself the capability — anyone holding it can upload to that key
	// until ttl expires. Callers MUST scope key construction via a
	// validated key builder, never accept raw paths from untrusted input.
	PresignPut(ctx context.Context, key string, ttl time.Duration) (url string, err error)

	// PresignGet returns a presigned GET URL valid for ttl. Same
	// capability semantics as PresignPut.
	PresignGet(ctx context.Context, key string, ttl time.Duration) (url string, err error)

	// Exists reports whether an object exists at key. Used for
	// content-addressed dedup — if the keyed object is already there, the
	// caller can skip the PUT URL entirely.
	Exists(ctx context.Context, key string) (bool, error)

	// DeletePrefix removes every object whose key starts with prefix.
	// Idempotent — deleting an empty/already-gone prefix is not an error.
	// Used for tenant erasure (account deletion): one sweep of "<userID>/"
	// purges all of a user's blobs. Callers MUST build the prefix via a
	// validated key builder so an empty/escaped value can't widen the
	// sweep to the whole bucket.
	DeletePrefix(ctx context.Context, prefix string) error
}