objectstore

type DeleteInput ¶

type DeleteInput struct {
	Ref ObjectRef
}

DeleteInput removes one object reference. Ref.VersionID is honored by stores that support versioned objects.

type GetInput ¶

type GetInput struct {
	Ref      ObjectRef
	MaxBytes int64
}

GetInput reads one object reference with a required maximum byte cap.

type GetOutput ¶

type GetOutput struct {
	Ref         ObjectRef
	Payload     []byte
	ContentType string
	Metadata    map[string]string
}

GetOutput is the bounded byte payload returned by Store.Get.

type ObjectRef ¶

type ObjectRef struct {
	Bucket    string
	Key       string
	VersionID string
}

ObjectRef identifies one object in an S3-compatible object store.

Bucket and Key are always required. VersionID is optional and is used only by version-aware operations such as Get and Delete.

func ParseObjectRef(raw string) (ObjectRef, error)

func (r ObjectRef) Validate() error

type PresignPutInput ¶

type PresignPutInput struct {
	Ref            ObjectRef
	ContentLength  int64
	ChecksumSHA256 string
	ContentType    string
	MaxBytes       int64
	ExpiresIn      time.Duration
}

PresignPutInput describes one bounded upload grant request.

Every field is required. Ref must be an exact, unversioned s3://bucket/key reference; ContentLength must be positive and no larger than MaxBytes; ChecksumSHA256 must be the canonical base64 encoding of the 32-byte SHA-256 digest of the exact bytes the client will upload; ContentType must be non-empty; and ExpiresIn must be a whole number of seconds, positive and at most MaxPresignPutExpiresIn. ContentLength, MaxBytes and ExpiresIn are typed integers here, so a fractional byte count or expiry cannot even be expressed; the other runtimes refuse one with ErrInvalidPresignPut instead.

func (i PresignPutInput) Validate() error

type PresignPutOutput ¶

type PresignPutOutput struct {
	Ref       ObjectRef
	URL       string
	Method    string
	Headers   map[string]string
	ExpiresAt time.Time
}

PresignPutOutput is a bounded upload grant.

Headers holds exactly the headers the client must send with the upload. The URL only ever authorizes those bytes: content length, content type and checksum are part of the signed headers.

type PutInput ¶

type PutInput struct {
	Ref         ObjectRef
	Payload     []byte
	ContentType string
	Metadata    map[string]string
}

PutInput writes a byte payload to one object reference.

type S3EncryptionConfig ¶

type S3EncryptionConfig struct {
	Mode     S3EncryptionMode
	KMSKeyID string
}

S3EncryptionConfig configures fail-closed S3 server-side encryption headers.

type S3EncryptionMode ¶

type S3EncryptionMode string

S3EncryptionMode selects the server-side encryption headers emitted for S3 PutObject.

const (
	// S3EncryptionBucketDefault emits no server-side encryption headers and relies on bucket policy/defaults.
	S3EncryptionBucketDefault S3EncryptionMode = "bucket-default"
	// S3EncryptionS3Managed emits the S3-managed AES256 server-side encryption header.
	S3EncryptionS3Managed S3EncryptionMode = "s3-managed"
	// S3EncryptionKMS emits AWS KMS server-side encryption headers with a required key ID.
	S3EncryptionKMS S3EncryptionMode = "kms"
)

type S3StoreConfig ¶

type S3StoreConfig struct {
	Encryption S3EncryptionConfig
}

S3StoreConfig configures the narrow S3-backed Store implementation.

type Store ¶

type Store interface {
	Put(context.Context, PutInput) (ObjectRef, error)
	Get(context.Context, GetInput) (*GetOutput, error)
	Delete(context.Context, DeleteInput) error
}

Store is AppTheory's narrow object-store contract.

It intentionally supports only byte Put, bounded Get, and Delete. There is no unbounded read method and no listing, public URL, multipart, copy, head, or raw client escape hatch.

UploadGranter is the one bounded presigning exception and is deliberately a separate capability interface rather than a fourth Store method, so a store opts in to minting upload links and no existing Store implementation changes shape.

func NewS3Store(ctx context.Context, storeConfig S3StoreConfig) (Store, error)

granter, ok := store.(objectstore.UploadGranter)

type UploadGranter ¶

type UploadGranter interface {
	PresignPut(context.Context, PresignPutInput) (*PresignPutOutput, error)
}

UploadGranter is AppTheory's bounded upload-grant capability.

It is deliberately separate from Store: the bounded Put/Get/Delete contract is unchanged, and a store opts in to minting upload links. The only grant it can mint authorizes a single PUT of declared bytes to one exact object reference, with a signed content length, content type and SHA-256 checksum, for at most MaxPresignPutExpiresIn.

Presigned GET, presigning without a checksum, list, multipart, copy, head, public URLs and raw clients remain forbidden: they have no method here and none on Store.